Edit tour

Windows Analysis Report
3SqWYf8qFi.exe

Overview

General Information

Sample name:	3SqWYf8qFi.exe renamed because original name is a hash value
Original sample name:	27b3e45a81641d0e7d0dea29938774ae.exe
Analysis ID:	1407471
MD5:	27b3e45a81641d0e7d0dea29938774ae
SHA1:	b169677b0772e523a49aee97a0d5aca89ade3068
SHA256:	ab7237aba6c89c09aeaf5111575614041aafc280f2461f3e669195ce6943e4e1
Tags:	64exe
Infos:

Detection

Glupteba, Mars Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Yara detected Glupteba

Yara detected Mars stealer

Yara detected Stealc

Yara detected Vidar stealer

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Creates HTML files with .exe extension (expired dropper behavior)

Disables UAC (registry)

Drops script or batch files to the startup folder

Found Tor onion address

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Sample uses process hollowing technique

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Connects to several IPs in different countries

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file does not import any functions

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Stores files to the Windows start menu directory

Tries to load missing DLLs

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

3SqWYf8qFi.exe (PID: 6908 cmdline: C:\Users\user\Desktop\3SqWYf8qFi.exe MD5: 27B3E45A81641D0E7D0DEA29938774AE)

powershell.exe (PID: 43952 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3SqWYf8qFi.exe" -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 14400 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

CasPol.exe (PID: 43980 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe MD5: 914F728C04D3EDDD5FBA59420E74E56B)

vkIsjAzkgrOzUK7uj2IHc9JM.exe (PID: 8660 cmdline: "C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe" MD5: AF528677E66608860208878377380FD9)

syncUpd.exe (PID: 9392 cmdline: C:\Users\user\AppData\Local\Temp\syncUpd.exe MD5: C722591F624FB69970F246B8C81D830F)

BroomSetup.exe (PID: 10876 cmdline: C:\Users\user\AppData\Local\Temp\BroomSetup.exe MD5: EEE5DDCFFBED16222CAC0A1B4E2E466E)

cmd.exe (PID: 14184 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\Task.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 14804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

F3bLUEvvHahM06jSZWbJPDdX.exe (PID: 9004 cmdline: "C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe" MD5: 5F2CE2E258A6EEF93E5E22DCE2717F82)

rMuSSyE2z14xNxfrVLVv1kvs.exe (PID: 9124 cmdline: "C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe" --silent --allusers=0 MD5: 18A0C971C87F30E90DC78E5331D1643C)

rMuSSyE2z14xNxfrVLVv1kvs.exe (PID: 11524 cmdline: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6c4b21c8,0x6c4b21d4,0x6c4b21e0 MD5: 18A0C971C87F30E90DC78E5331D1643C)

rMuSSyE2z14xNxfrVLVv1kvs.exe (PID: 14548 cmdline: "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\rMuSSyE2z14xNxfrVLVv1kvs.exe" --version MD5: 18A0C971C87F30E90DC78E5331D1643C)

wQ9dgKtBZDeIUddSVpW8BvEm.exe (PID: 9196 cmdline: "C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe" MD5: 95B643F1AB74DB2FD054852EF281577D)

jpm6qF5Qiq3f7hmREIabTmaO.exe (PID: 9252 cmdline: "C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe" MD5: 95B643F1AB74DB2FD054852EF281577D)

dC7amCutZVjsSWxQ9FIlZYqw.exe (PID: 9408 cmdline: "C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe" MD5: 5F2CE2E258A6EEF93E5E22DCE2717F82)

3iX1J0J7PXcnIfnf5KGl849r.exe (PID: 9436 cmdline: "C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe" MD5: AF528677E66608860208878377380FD9)

UPwYHcUA3TbsX6l2qc9SZcBH.exe (PID: 10536 cmdline: "C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe" --silent --allusers=0 MD5: 968B869AA841B0C675BF2C61DFEAA509)

UPwYHcUA3TbsX6l2qc9SZcBH.exe (PID: 13116 cmdline: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2d4,0x300,0x6b8021c8,0x6b8021d4,0x6b8021e0 MD5: 968B869AA841B0C675BF2C61DFEAA509)

H1Mms5Gptfho9VyHt62sHSNN.exe (PID: 10652 cmdline: "C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe" MD5: AF528677E66608860208878377380FD9)

VWhRbFHRqImCr0UdFf6QtJNt.exe (PID: 10908 cmdline: "C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe" MD5: AF528677E66608860208878377380FD9)

f2CDTsUNlMadewChtQe3a8Da.exe (PID: 10968 cmdline: "C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe" MD5: 95B643F1AB74DB2FD054852EF281577D)

VySSnHhKNg09wrV9qkpgKtg9.exe (PID: 11056 cmdline: "C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe" MD5: 5F2CE2E258A6EEF93E5E22DCE2717F82)

dZhcoTSgym1JGRiEQOUqAdeo.exe (PID: 11100 cmdline: "C:\Users\user\Pictures\dZhcoTSgym1JGRiEQOUqAdeo.exe" MD5: 5F2CE2E258A6EEF93E5E22DCE2717F82)

rfKusEcfqkKKVyx19jVITYlO.exe (PID: 11164 cmdline: "C:\Users\user\Pictures\rfKusEcfqkKKVyx19jVITYlO.exe" MD5: 95B643F1AB74DB2FD054852EF281577D)

Rfsq67IamA4rPpnX6LHMDFkm.exe (PID: 11280 cmdline: "C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe" --silent --allusers=0 MD5: 9BFF769347ADF4195895A2AA8C977EFF)

Rfsq67IamA4rPpnX6LHMDFkm.exe (PID: 13232 cmdline: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2c4,0x304,0x6bd721c8,0x6bd721d4,0x6bd721e0 MD5: 9BFF769347ADF4195895A2AA8C977EFF)

zKY9gVt7bugdAVV29pfHDO1J.exe (PID: 11604 cmdline: "C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe" --silent --allusers=0 MD5: 9D6D8C23FE185D39AA9259B64543248E)

zKY9gVt7bugdAVV29pfHDO1J.exe (PID: 14488 cmdline: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6ae821c8,0x6ae821d4,0x6ae821e0 MD5: 9D6D8C23FE185D39AA9259B64543248E)

mxmsi31bOIKdEb9VIHBYJshQ.exe (PID: 13968 cmdline: "C:\Users\user\Pictures\mxmsi31bOIKdEb9VIHBYJshQ.exe" MD5: AF528677E66608860208878377380FD9)

j1XOgROBJfvz0cRzU7rPw7NS.exe (PID: 14020 cmdline: "C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe" --silent --allusers=0 MD5: 6E7737F5251D3BC5CF1D0D75778589ED)

j1XOgROBJfvz0cRzU7rPw7NS.exe (PID: 15840 cmdline: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6a9c21c8,0x6a9c21d4,0x6a9c21e0 MD5: 6E7737F5251D3BC5CF1D0D75778589ED)

2n6aZsnLKtKXJNMzWvG8Ou1L.exe (PID: 14148 cmdline: "C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe" --silent --allusers=0 MD5: 3C982E3594F2F49BE9CB21C88EDA12D6)

2n6aZsnLKtKXJNMzWvG8Ou1L.exe (PID: 16532 cmdline: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6a5021c8,0x6a5021d4,0x6a5021e0 MD5: 3C982E3594F2F49BE9CB21C88EDA12D6)

jLh2jXNiKaCQ93A91IuQMDiC.exe (PID: 14256 cmdline: "C:\Users\user\Pictures\jLh2jXNiKaCQ93A91IuQMDiC.exe" MD5: AF528677E66608860208878377380FD9)

VF98zhY4QVhDxJpNtAE2TU6d.exe (PID: 14320 cmdline: "C:\Users\user\Pictures\VF98zhY4QVhDxJpNtAE2TU6d.exe" MD5: 95B643F1AB74DB2FD054852EF281577D)

CasPol.exe (PID: 7340 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe MD5: 914F728C04D3EDDD5FBA59420E74E56B)

WerFault.exe (PID: 7948 cmdline: C:\Windows\system32\WerFault.exe -u -p 6908 -s 56832 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Glupteba	Glupteba is a trojan horse malware that is one of the top ten malware variants of 2021. After infecting a system, the Glupteba malware can be used to deliver additional malware, steal user authentication information, and enroll the infected system in a cryptomining botnet.	No Attribution	http://resources.infosecinstitute.com/tdss4-part-1/ https://blog.chainalysis.com/reports/2022-crypto-crime-report-preview-malware/ https://blog.google/technology/safety-security/new-action-combat-cyber-crime/ https://blog.google/threat-analysis-group/disrupting-glupteba-operation/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/	https://malpedia.caad.fkie.fraunhofer.de/details/win.glupteba

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.172.128.145/3cd2b41cbde8fc9c.php"}

Threatname: Vidar

{"C2 url": "http://185.172.128.145/3cd2b41cbde8fc9c.php"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000026.00000001.2270329448.0000000000843000.00000040.00000001.01000000.0000002A.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
0000000F.00000003.1947105334.00000000007B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000F.00000003.1947105334.00000000007B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000000F.00000002.2877662329.0000000000833000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xd38:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000F.00000002.2877720615.0000000000848000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: syncUpd.exe PID: 9392	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: syncUpd.exe PID: 9392	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: syncUpd.exe PID: 9392	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: f2CDTsUNlMadewChtQe3a8Da.exe PID: 10968	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
Process Memory Space: VF98zhY4QVhDxJpNtAE2TU6d.exe PID: 14320	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
15.2.syncUpd.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
15.2.syncUpd.exe.400000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
15.2.syncUpd.exe.6a0e67.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
15.2.syncUpd.exe.6a0e67.1.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
15.3.syncUpd.exe.7b0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
15.3.syncUpd.exe.7b0000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
15.2.syncUpd.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
15.2.syncUpd.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
15.3.syncUpd.exe.7b0000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
15.3.syncUpd.exe.7b0000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
15.2.syncUpd.exe.6a0e67.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
15.2.syncUpd.exe.6a0e67.1.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
38.1.VF98zhY4QVhDxJpNtAE2TU6d.exe.400000.0.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
23.3.f2CDTsUNlMadewChtQe3a8Da.exe.3690000.6.unpack	JoeSecurity_Glupteba	Yara detected Glupteba	Joe Security
Click to see the 9 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3SqWYf8qFi.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3SqWYf8qFi.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\Desktop\3SqWYf8qFi.exe, ParentImage: C:\Users\user\Desktop\3SqWYf8qFi.exe, ParentProcessId: 6908, ParentProcessName: 3SqWYf8qFi.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3SqWYf8qFi.exe" -Force, ProcessId: 43952, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3SqWYf8qFi.exe" -Force, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3SqWYf8qFi.exe" -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\Desktop\3SqWYf8qFi.exe, ParentImage: C:\Users\user\Desktop\3SqWYf8qFi.exe, ParentProcessId: 6908, ParentProcessName: 3SqWYf8qFi.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3SqWYf8qFi.exe" -Force, ProcessId: 43952, ProcessName: powershell.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe, ProcessId: 43980, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MCYmcBRyIU8ux2QHjbZuxfqz.bat

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000F.00000003.1947105334.00000000007B0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "http://185.172.128.145/3cd2b41cbde8fc9c.php"}
Source: syncUpd.exe.9392.15.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.172.128.145/3cd2b41cbde8fc9c.php"}

Multi AV Scanner detection for submitted file

Source: 3SqWYf8qFi.exe	ReversingLabs: Detection: 18%
Source: 3SqWYf8qFi.exe	Virustotal: Detection: 25%			Perma Link

Yara detected Glupteba

Source: Yara match	File source: 38.1.VF98zhY4QVhDxJpNtAE2TU6d.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.f2CDTsUNlMadewChtQe3a8Da.exe.3690000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000026.00000001.2270329448.0000000000843000.00000040.00000001.01000000.0000002A.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: f2CDTsUNlMadewChtQe3a8Da.exe PID: 10968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VF98zhY4QVhDxJpNtAE2TU6d.exe PID: 14320, type: MEMORYSTR

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\DG5NfvChXpdFrpWmBrnRWaQb.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\9pxDWajsJYwYwL1brTzHEdek.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\9HGEbLH7EssqmLwFcrlZYSWT.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\5QpyioUXq8ASWQahMvzU4ahz.exe	Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: CtIvEWInDoW
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: AgEBOxw
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: ijklmnopqrs
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: /#%33@@@
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: abcdefghijklmnopqrs
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: @@@@<@@@
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: abcdefghijklmnopqrs
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: "&&""..""&&"">>""&&"".."ikSQWQSQ_QBEklmn^pqrBtuvFxyzL123H5679+/\|
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: %s\%V/yVs
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: %s\*.
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: }567y9n/S
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: ntTekeny
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: ging
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: PassMord0
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: J@@@`z`@J@@@J@@@
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: OPQRSTUVWXY
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: 456753+/---- '
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: '--- '
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: qRslaZ9Iw\|
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: HeapFree
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: GetLocaleInfoA
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: ntProcessId
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: wininet.dll
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: shlwapi.dll
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: shell32.dll
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: .dll
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: column_text
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: }67b)>4`,LXZu2L6qd
Source: 15.2.syncUpd.exe.400000.0.raw.unpack	String decryptor: login:

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00409540 CryptUnprotectData,LocalAlloc,LocalFree,	15_2_00409540
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_004155A0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	15_2_004155A0
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00406C10 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	15_2_00406C10
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_004094A0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	15_2_004094A0
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_0040BF90 memset,lstrlen,CryptStringToBinaryA,memcpy,lstrcat,lstrcat,lstrcat,	15_2_0040BF90
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006B5807 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	15_2_006B5807
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006AC1F7 memset,lstrlen,CryptStringToBinaryA,memcpy,lstrcat,lstrcat,lstrcat,	15_2_006AC1F7
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006A6E77 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	15_2_006A6E77
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006A9707 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	15_2_006A9707
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006A97A7 CryptUnprotectData,LocalAlloc,LocalFree,	15_2_006A97A7

Bitcoin Miner

Yara detected Glupteba

Source: Yara match	File source: 38.1.VF98zhY4QVhDxJpNtAE2TU6d.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.f2CDTsUNlMadewChtQe3a8Da.exe.3690000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000026.00000001.2270329448.0000000000843000.00000040.00000001.01000000.0000002A.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: f2CDTsUNlMadewChtQe3a8Da.exe PID: 10968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VF98zhY4QVhDxJpNtAE2TU6d.exe PID: 14320, type: MEMORYSTR

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

Unpacked PE file: 15.2.syncUpd.exe.400000.0.unpack

Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240312120432506.log
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240312120451640.log
Source: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240312120439871.log
Source: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240312120440744.log
Source: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240312120500215.log
Source: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240312120451637.log

Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: 3SqWYf8qFi.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Loader.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer.exe.pdb source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CA1000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.00000000001F1000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000091000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.0000000000021000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.00000000001F1000.00000040.00000001.01000000.00000029.sdmp
Source:	Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: `K_lib.dll.pdb@+ source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000000.1862298101.00000000011A7000.00000080.00000001.01000000.0000000C.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000000.1946950834.0000000000407000.00000080.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000000.1943633581.0000000000F07000.00000080.00000001.01000000.00000018.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000001C.00000000.1976024041.00000000011A7000.00000080.00000001.01000000.0000000C.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000000.1948656923.0000000000AA7000.00000080.00000001.01000000.0000001D.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000000.2012097688.0000000000407000.00000080.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000000.2054392398.0000000000F07000.00000080.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000000.2058242868.0000000000457000.00000080.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000000.2064487479.00000000002F7000.00000080.00000001.01000000.00000028.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 00000028.00000000.2058335131.0000000000AA7000.00000080.00000001.01000000.0000001D.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000000.2084551332.0000000000287000.00000080.00000001.01000000.0000002C.sdmp
Source:	Binary string: Age does not matchThe module age and .pdb age do not match. source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: symsrv.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003F08000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .exe.pdb source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000000.1862298101.00000000011A7000.00000080.00000001.01000000.0000000C.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000000.1946950834.0000000000407000.00000080.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000000.1943633581.0000000000F07000.00000080.00000001.01000000.00000018.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000001C.00000000.1976024041.00000000011A7000.00000080.00000001.01000000.0000000C.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000000.1948656923.0000000000AA7000.00000080.00000001.01000000.0000001D.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000000.2012097688.0000000000407000.00000080.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000000.2054392398.0000000000F07000.00000080.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000000.2058242868.0000000000457000.00000080.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000000.2064487479.00000000002F7000.00000080.00000001.01000000.00000028.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 00000028.00000000.2058335131.0000000000AA7000.00000080.00000001.01000000.0000001D.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000000.2084551332.0000000000287000.00000080.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000000.2090220336.0000000000457000.00000080.00000001.01000000.00000029.sdmp
Source:	Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Downloading symbols for [%s] %ssrvsymsrvhttp://https://_bad_pdb_file.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer_lib.dll.pdb source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer_lib.dll.pdb@+ source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\Release\Winmon.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\vbox\branch\w64-1.6\out\win.amd64\release\obj\src\VBox\HostDrivers\VBoxDrv\VBoxDrv.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\x64\Release\Winmon.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Drive not readyThis error indicates a .pdb file related failure. source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: `K_lib.dll.pdb source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000000.1862298101.00000000011A7000.00000080.00000001.01000000.0000000C.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000000.1946950834.0000000000407000.00000080.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000000.1943633581.0000000000F07000.00000080.00000001.01000000.00000018.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000001C.00000000.1976024041.00000000011A7000.00000080.00000001.01000000.0000000C.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000000.1948656923.0000000000AA7000.00000080.00000001.01000000.0000001D.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000000.2012097688.0000000000407000.00000080.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000000.2054392398.0000000000F07000.00000080.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000000.2058242868.0000000000457000.00000080.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000000.2064487479.00000000002F7000.00000080.00000001.01000000.00000028.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 00000028.00000000.2058335131.0000000000AA7000.00000080.00000001.01000000.0000001D.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000000.2084551332.0000000000287000.00000080.00000001.01000000.0000002C.sdmp
Source:	Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: zzz_AsmCodeRange_*FrameDatainvalid string positionstring too long.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Unable to locate the .pdb file in this location source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\x64\Release\WinmonFS.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: The module signature does not match with .pdb signature. source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .pdb.dbg source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: '(EfiGuardDxe.pdbx source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: symsrv.pdbGCTL source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003F08000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\Release\WinmonProcessMonitor.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\Release\WinmonFS.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: or you do not have access permission to the .pdb location. source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\x64\Release\WinmonProcessMonitor.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: EfiGuardDxe.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .exe.pdb@ source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000000.1862298101.00000000011A7000.00000080.00000001.01000000.0000000C.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000000.1946950834.0000000000407000.00000080.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000000.1943633581.0000000000F07000.00000080.00000001.01000000.00000018.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000001C.00000000.1976024041.00000000011A7000.00000080.00000001.01000000.0000000C.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000000.1948656923.0000000000AA7000.00000080.00000001.01000000.0000001D.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000000.2012097688.0000000000407000.00000080.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000000.2054392398.0000000000F07000.00000080.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000000.2058242868.0000000000457000.00000080.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000000.2064487479.00000000002F7000.00000080.00000001.01000000.00000028.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 00000028.00000000.2058335131.0000000000AA7000.00000080.00000001.01000000.0000001D.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000000.2084551332.0000000000287000.00000080.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000000.2090220336.0000000000457000.00000080.00000001.01000000.00000029.sdmp
Source:	Binary string: Signature does not matchThe module signature does not match with .pdb signature source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer.exe.pdb@ source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000CA1000.00000040.00000001.01000000.00000018.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CA1000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.00000000001F1000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000091000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.0000000000021000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.00000000001F1000.00000040.00000001.01000000.00000029.sdmp
Source:	Binary string: dbghelp.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: dbghelp.pdbGCTL source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_00408123 FindFirstFileA,FindClose,	10_2_00408123
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_004085B8 DeleteFileA,DeleteFileA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	10_2_004085B8
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_0040342B FindFirstFileA,	10_2_0040342B
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00412570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_00412570
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_0040D1C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	15_2_0040D1C0
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_004015C0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_004015C0
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00411650 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	15_2_00411650
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_0040B610 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	15_2_0040B610
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_0040DB60 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	15_2_0040DB60
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00411B80 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	15_2_00411B80
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_0040D540 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_0040D540
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_004121F0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	15_2_004121F0
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006AB877 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	15_2_006AB877
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006B2457 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	15_2_006B2457
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006A1827 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_006A1827
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006AD427 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	15_2_006AD427
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006B18B7 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	15_2_006B18B7
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006B1DE7 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	15_2_006B1DE7
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006ADDC7 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	15_2_006ADDC7
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006B27D7 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_006B27D7
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006AD7A7 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_006AD7A7
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: 31_1_001CCF22 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	31_1_001CCF22

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.172.128.145/3cd2b41cbde8fc9c.php
Source: Malware configuration extractor	URLs: http://185.172.128.145/3cd2b41cbde8fc9c.php

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: IvU2uyNuWFigEygNV6rctFCx.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: yyOg8vFUEf8ewje7ePyYaYrp.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: k24uGEMvDOJxGSYIEJfkvAv5.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: jzqvqBGkG9ji22i8AoGkLtvR.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: CaOK3iO8OQAwsgQeckh3C4UP.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: wGwvjr8JuoYAqhoeP1STOomL.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: X0QE4YfIdkFIaFg73EESBmNY.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: 9er3Js7GDifxgqZh2XipvtXh.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: OrUhyJcu1NvcVz9aYKgQaEHF.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: yyIn2S9KkOFmc5VIOG5URAcM.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: ThBPJoGxW6s6xOvtetaJLwi2.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: oRNRkRJgpfntnnUy3280Q2gz.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: NmDs1HYwuXH0hryD0mdBt3jX.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: UT13zjeHVdOFi7IHMIp0XqHQ.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: eWykOtAnMlV1bwkA64D3jk1r.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: ZeGipmT3eHYuvmbIxgXMhYeA.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: yuOzOMiGu18r6OI15UqZiVhD.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: g74FLtS6pxPabgJh1GOJP0y9.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: WBuKGU5qJ5VUXxoLOGiXoBkH.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: YTPWaMfX30OWGAa0N4zQELWE.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: WIPfhQxM6KJXx251iZNwCqDU.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: orrmvmRrWiQUvvR2gvxmt2Uq.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: IVPQ2alvXAGOa4ZbvjP04aTV.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: TdtQ1FE4bYO5ogxoTGdiEN38.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: wkhy7uRGkuNSmBiMfg2ujY77.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: sZTgVuBgO0l3CMzVYan4pxrE.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: qLwqLSV4rPxepI9a27kf3QoZ.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: J5gykLd70qOkxMaAyCwBf3AO.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: fiUeZNNCTIS5H2aPexzpE5Lz.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: n9Mh8v3pnnImlBJy2SUqnwt7.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: yk5Kg8CP5R0lBkwzd8NmvR55.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: k61IyshjXf2xgCwUvOFWwmgI.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: CasE9Xp1QOtkW4E3aVj16cmV.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: 87JPMSplrYgzi5Cttm3Z375k.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: Ci70jxmBCikoxRrlulJIEQH3.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: uTpnhMoQAbjpswVVMilQAog8.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: JmFHdFFXnf32rCkwI8iKN74G.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: 6EttYMEl0lv0TgoioCDqPARX.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: 6FilrATN3dQE8srgx4AKUMVc.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: UKcOeyzFWKgEp3jiLlc53JId.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: khZWbExKB8w1JkxRWheAWkKQ.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: ICXg2Ke2vnpuobif1V7ZIlR7.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: IC4DTPQmGTctezS5guL9vFLJ.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: 3rV9RY4D0vXRAkg7JT32cmCD.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: bbLIw48fKM1lzSnI9fseLQ0z.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: ma5ZV2wEknznzPeuTeaX9Fk3.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: J0L5GIP8nWdOG64Uj1tuCr4I.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: TmyU19puPszO5dD6QaXXYS9j.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: P52PQNhb6DjA6yqnfJVJRvJc.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: 1IiLAoyBh4YnTxVttC3glecg.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: Ti2wvx1Jt0MWHlDpZMMIhhND.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: 89IAnuHgvZ52kCx57pWfMJyj.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: VbjnVPoWpC8ngAejNWQ8DLBN.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: K3a3RLkBmOAUgzYQ2MxzfB6S.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: kIkH03mHJncFYDqHqXdphzO5.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: Sp4RC4Fzn9R3nxCm7XaceyVC.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: PHBccilKfK9jHQUPwgnTj8b3.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: qISpsWpv4oIvhES3MTpCAdcJ.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: 0rPqVWXk4L1q7vaDqSSAYuOV.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: 2mVrLbuGc4HvqI1vBpAy5Z7r.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: 2ut031I6nOWGwcANYtiL1o1J.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: 0MO04SVirwqcj6WPf5Zv7PoT.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: owaM0vzN2jKxgkVfs4bImjfe.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: 0iUkmKUli4rxdTjqlhfb3STv.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: ka3JrCFlTPYjnvR6dwKLC1vl.exe.4.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: oXoLzyLcYgk57zCvqPsFCNIg.exe.4.dr

Found Tor onion address

Source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003690000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2
Source: VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	String found in binary or memory: Nyiakeng_Puachue_HmongPakistan Standard TimeParaguay Standard TimeRoGetActivationFactoryRtlDeleteFunctionTableRtlGetNtVersionNumbersSafeArrayGetRecordInfoSafeArraySetRecordInfoSakhalin Standard TimeSao Tome Standard TimeSeImpersonatePrivilegeSetupDiEnumDriverInfoWSetupDiGetClassDevsExWTasmania Standard TimeTor bootstrap progressTor service is runningUnsupported Media TypeWSAGetOverlappedResultWSALookupServiceBeginWWaitForMultipleObjectsWget/1.12 (freebsd8.1)Xenu Link Sleuth/1.3.8access-control-max-ageaddress already in useadvapi32.dll not foundargument list too longassembly checks failedbad g->status in readybad sweepgen in refillbitcoin3nqy3db7c.onionbody closed by handlercannot allocate memoryclient not initializedcompileCallabck: type couldn't create devicecouldn't get file infocouldn't start servicecoulnd't write to filecreate main window: %wdecode and decrypt: %wdriver: bad connectionduplicated defer entryelectrum.leblancnet.uselectrum3.hodlister.coelectrum5.hodlister.coelectrumxhqdsmlu.onionencrypt and encode: %werror decoding messageerror parsing regexp: failed to get UUID: %wfailed to hide app: %wfailed to open key: %wfailed to open src: %wfailed to register: %wfailed to set UUID: %wframe_data_pad_too_bigfreeIndex is not validgenerate challenge: %wgetenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shide process ID %d: %whpack: string too longhsmiths4fyqlw5xw.onionhsmiths5mjk6uijs.onionhttp2: frame too largehttp://localhost:3433/https://duniadekho.baridna: invalid label %qinappropriate fallbackinteger divide by zerointegrity check failedinterface conversion: internal inconsistencyinvalid Trailer key %qinvalid address familyinvalid number base %djson: unknown field %qkernel32.dll not foundmalformed HTTP versionminpc or maxpc invalidmissing ']' in addressmultiple :: in addressndndword5lpb7eex.onionnetwork is unreachableno connection providednon-Go function at pc=oldoverflow is not niloperation was canceledoverflowing coordinateozahtqwp25chjdjd.onionprotocol not availableprotocol not supportedqtornadoklbgdyww.onionread response body: %wreflect.Value.MapIndexreflect.Value.SetFloatreflectlite.Value.Elemreflectlite.Value.Typeremote address changedruntime.main not on m0runtime: work.nwait = runtime:scanstack: gp=s.freeindex > s.nelemss7clinmo4cazmhul.onionscanstack - bad statussecure boot is enabledsend on closed channelserver.peers.subscribeservice does not existservice is not runningset Tor mode to %s: %wskipping Question Nameskipping Question Typespan has no free spacesql: no Rows availablestack not a power of 2status/bootstrap-phasetrace reader (blocked)trace: alloc too largetransaction is stoppedtransaction not existsunexpected length codeunexpected method stepwirep: invalid p statewrite on closed bufferx509: malformed issuerzero length BIT STRINGzlib: invalid checksum into Go value of type ) must be a power of 2

Source: unknown

Network traffic detected: IP country count 30

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

Code function: 15_2_00404C70 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

15_2_00404C70

Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.000000000007A000.00000040.00000001.01000000.0000002C.sdmp	String found in binary or memory: c. Facebook Messenger: A messaging service provided by Facebook, Inc., Meta Platforms Ireland Ltd. or related companies, depending on where you are accessing their services. Terms of use are available at https://www.facebook.com/legal/terms; and equals www.facebook.com (Facebook)
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: hatsapp.com/legal; and c. Facebook Messenger: A messaging service provided by Facebook, Inc., Meta Platforms Ireland Ltd. or related companies, depending on where you are accessing their services. Terms of use are available at https://www.facebook.com/l equals www.facebook.com (Facebook)

Source: syncUpd.exe, 0000000F.00000002.2877720615.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/15f649199f40275b/freebl3.dll
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/15f649199f40275b/mozglue.dll
Source: syncUpd.exe, 0000000F.00000002.2877720615.0000000000886000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/15f649199f40275b/msvcp140.dll
Source: syncUpd.exe, 0000000F.00000002.2877720615.0000000000886000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/15f649199f40275b/msvcp140.dll7
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/15f649199f40275b/nss3.dll
Source: syncUpd.exe, 0000000F.00000002.2877720615.0000000000886000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/15f649199f40275b/softokn3.dll
Source: syncUpd.exe, 0000000F.00000002.2877720615.0000000000886000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/15f649199f40275b/softokn3.dlld
Source: syncUpd.exe, 0000000F.00000003.2281435291.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/15f649199f40275b/sqlite3.dll
Source: syncUpd.exe, 0000000F.00000003.2281435291.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/15f649199f40275b/sqlite3.dlllLx
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/15f649199f40275b/vcruntime140.dll
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/15f649199f40275b/vcruntime140.dllo
Source: syncUpd.exe, 0000000F.00000003.2281435291.000000000089F000.00000004.00000020.00020000.00000000.sdmp, syncUpd.exe, 0000000F.00000002.2877720615.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/3cd2b41cbde8fc9c.php
Source: syncUpd.exe, 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.172.128.145/3cd2b41cbde8fc9c.php0d62641a64885f84d53bf1676aabn
Source: syncUpd.exe, 0000000F.00000003.2281435291.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145/3cd2b41cbde8fc9c.phpnI
Source: syncUpd.exe, 0000000F.00000002.2877720615.0000000000848000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.145P
Source: vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.187/
Source: syncUpd.exe, 0000000F.00000002.3205646166.0000000026F5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.187/Ledger-Live.exe
Source: syncUpd.exe, 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.172.128.187/Ledger-Live.exe00
Source: syncUpd.exe, 0000000F.00000002.3205646166.0000000026F06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.187/Ledger-Live.exe3
Source: syncUpd.exe, 0000000F.00000002.3205646166.0000000026F06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.187/Ledger-Live.exeT
Source: syncUpd.exe, 0000000F.00000002.3205646166.0000000026F06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.187/Ledger-Live.exe_
Source: syncUpd.exe, 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://185.172.128.187/Ledger-Live.exeposition:
Source: vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000003.1920722672.00000000006EC000.00000004.00000020.00020000.00000000.sdmp, vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.00000000006E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.187/T
Source: vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.000000000067E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.187/ping.php?substr=two
Source: vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.000000000067E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.187/ping.php?substr=twoO
Source: vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.187/ping.php?substr=twoP
Source: vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.187/ping.php?substr=twoh
Source: vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000003.1920722672.00000000006EC000.00000004.00000020.00020000.00000000.sdmp, vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.00000000006E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.187/ping.php?substr=twop
Source: vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.187/ping.php?substr=twot
Source: vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.187/ping.php?substr=twox
Source: vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.187/v
Source: vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.00000000006BE000.00000004.00000020.00020000.00000000.sdmp, vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.2057372935.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.000000000067E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.90/cpa/ping.php?substr=two&s=ab
Source: vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.2057372935.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.000000000067E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.90/cpa/ping.php?substr=two&s=ab/SILENT/TOSTACK/NOCANCELgethttp://185.172.128.187/
Source: vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.90/cpa/ping.php?substr=two&s=ab0
Source: vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.90/cpa/ping.php?substr=two&s=abP
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: http://autoupdate-staging.services.ams.osa/
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: http://autoupdate-staging.services.ams.osa/v4/v5/netinstaller///windows/x64v2/Fetching
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2045088050.0000000003E1D000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2286793548.0000000003429000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2104253449.00000000038EC000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2343905294.00000000037B2000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2287293767.000000000335B000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2045088050.0000000003E1D000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2286793548.0000000003429000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2104253449.00000000038EC000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2343905294.00000000037B2000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2287293767.000000000335B000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2045088050.0000000003E1D000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2286793548.0000000003429000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2104253449.00000000038EC000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2343905294.00000000037B2000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2287293767.000000000335B000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2045088050.0000000003E1D000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2286793548.0000000003429000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2104253449.00000000038EC000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2343905294.00000000037B2000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2287293767.000000000335B000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2045088050.0000000003E1D000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2286793548.0000000003429000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2104253449.00000000038EC000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2343905294.00000000037B2000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2287293767.000000000335B000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2045088050.0000000003E1D000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2286793548.0000000003429000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2104253449.00000000038EC000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2343905294.00000000037B2000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2287293767.000000000335B000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2045088050.0000000003E1D000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2286793548.0000000003429000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2104253449.00000000038EC000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2343905294.00000000037B2000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2287293767.000000000335B000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2045088050.0000000003E1D000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2286793548.0000000003429000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2104253449.00000000038EC000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2343905294.00000000037B2000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2287293767.000000000335B000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003690000.00000004.00001000.00020000.00000000.sdmp, VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	String found in binary or memory: http://devlog.gregarius.net/docs/ua)Links
Source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://https://_bad_pdb_file.pdb
Source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003690000.00000004.00001000.00020000.00000000.sdmp, VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	String found in binary or memory: http://invalidlog.txtlookup
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: http://localhost:3001api/prefs/?product=$1&version=$2..
Source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003690000.00000004.00001000.00020000.00000000.sdmp, VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	String found in binary or memory: http://localhost:3433/https://duniadekho.baridna:
Source: vkIsjAzkgrOzUK7uj2IHc9JM.exe, vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000000.1843284935.000000000040B000.00000002.00000001.01000000.0000000A.sdmp, 3iX1J0J7PXcnIfnf5KGl849r.exe, 00000011.00000000.1859837097.000000000040B000.00000002.00000001.01000000.0000000B.sdmp, H1Mms5Gptfho9VyHt62sHSNN.exe, 00000014.00000000.1948458807.000000000040B000.00000002.00000001.01000000.0000001B.sdmp, VWhRbFHRqImCr0UdFf6QtJNt.exe, 00000016.00000000.1943621838.000000000040B000.00000002.00000001.01000000.00000014.sdmp, mxmsi31bOIKdEb9VIHBYJshQ.exe, 00000021.00000000.2047728912.000000000040B000.00000002.00000001.01000000.00000026.sdmp, jLh2jXNiKaCQ93A91IuQMDiC.exe, 00000025.00000000.2064292451.000000000040B000.00000002.00000001.01000000.00000027.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000000.1843284935.000000000040B000.00000002.00000001.01000000.0000000A.sdmp, 3iX1J0J7PXcnIfnf5KGl849r.exe, 00000011.00000000.1859837097.000000000040B000.00000002.00000001.01000000.0000000B.sdmp, H1Mms5Gptfho9VyHt62sHSNN.exe, 00000014.00000000.1948458807.000000000040B000.00000002.00000001.01000000.0000001B.sdmp, VWhRbFHRqImCr0UdFf6QtJNt.exe, 00000016.00000000.1943621838.000000000040B000.00000002.00000001.01000000.00000014.sdmp, mxmsi31bOIKdEb9VIHBYJshQ.exe, 00000021.00000000.2047728912.000000000040B000.00000002.00000001.01000000.00000026.sdmp, jLh2jXNiKaCQ93A91IuQMDiC.exe, 00000025.00000000.2064292451.000000000040B000.00000002.00000001.01000000.00000027.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2045088050.0000000003E1D000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2286793548.0000000003429000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2104253449.00000000038EC000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2343905294.00000000037B2000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2287293767.000000000335B000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2045088050.0000000003E1D000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2286793548.0000000003429000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2104253449.00000000038EC000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2343905294.00000000037B2000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2287293767.000000000335B000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2045088050.0000000003E1D000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2286793548.0000000003429000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2104253449.00000000038EC000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2343905294.00000000037B2000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2287293767.000000000335B000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2045088050.0000000003E1D000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2286793548.0000000003429000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2104253449.00000000038EC000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2343905294.00000000037B2000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2287293767.000000000335B000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003690000.00000004.00001000.00020000.00000000.sdmp, VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)msnbot/1.1
Source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003690000.00000004.00001000.00020000.00000000.sdmp, VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)net/http:
Source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003690000.00000004.00001000.00020000.00000000.sdmp, VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	String found in binary or memory: http://search.msn.com/msnbot.htm)pkcs7:
Source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003690000.00000004.00001000.00020000.00000000.sdmp, VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	String found in binary or memory: http://www.avantbrowser.com)MOT-V9mm/00.62
Source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003690000.00000004.00001000.00020000.00000000.sdmp, VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	String found in binary or memory: http://www.baidu.com/search/spider.htm)MobileSafari/600.1.4
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2045088050.0000000003E1D000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2286793548.0000000003429000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2104253449.00000000038EC000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2343905294.00000000037B2000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2287293767.000000000335B000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003690000.00000004.00001000.00020000.00000000.sdmp, VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	String found in binary or memory: http://www.google.com/feedfetcher.html)HKLM
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2045088050.0000000003E1D000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2286793548.0000000003429000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2104253449.00000000038EC000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2343905294.00000000037B2000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2287293767.000000000335B000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: http://www.opera.com0
Source: syncUpd.exe, 0000000F.00000002.3094793528.000000001AD84000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: syncUpd.exe, 0000000F.00000003.2281275820.00000000008F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: https://addons.opera.com/en/extensions/details/dify-cashback/
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4f
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4f.opera.com
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2416720122.0000000045A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4fC:
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414111474.0000000000F48000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414111474.0000000000F77000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414111474.0000000000F14000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2401048572.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2423165911.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2381790231.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2363415183.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2382378174.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2391593565.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2387931999.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2364591268.0000000000F09000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410715389.0000000000F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/(
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2364591268.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2387931999.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410715389.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/1?
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/9F
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410615687.0000000000E48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/M
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001612000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2381346872.0000000001610000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/SG
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001612000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2381346872.0000000001610000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/UK
Source: zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2379585399.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/W
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/_Event_
Source: 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2401048572.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2423165911.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2381790231.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2363415183.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2382378174.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2391593565.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/b
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2422974806.0000000000B74000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2409772902.0000000000B74000.00000004.00000020.00020000.00000000.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/geolocation/
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442550747.00000000015B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/geolocation/4
Source: 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2422974806.0000000000B74000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2409772902.0000000000B74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/geolocation/?
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/https://autoupdate.geo.opera.com/geolocation/OperaDesktophttps://cr
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414111474.0000000000F48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/i
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2364591268.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2396767707.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410697635.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410615687.0000000000E48000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2406947090.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2388066950.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2443889635.000000003F640000.00000004.00001000.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.0000000001612000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2444110885.000000003F69C000.00000004.00001000.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442550747.000000000160A000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001612000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2381346872.0000000001610000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442550747.00000000015B8000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2379585399.00000000010A1000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2884161745.00000000010A1000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414111474.0000000000F77000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414111474.0000000000F14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/v5/netinstaller/opera/Stable/windows/x64
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/v5/netinstaller/opera/Stable/windows/x648b
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/v5/netinstaller/opera/Stable/windows/x64Cb
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.0000000001612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/v5/netinstaller/opera/Stable/windows/x64E
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2444110885.000000003F69C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/v5/netinstaller/opera/Stable/windows/x64e?i
Source: zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2379585399.00000000010A1000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2884161745.00000000010A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/v5/netinstaller/opera/Stable/windows/x64uh#
Source: 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2422974806.0000000000B74000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2409772902.0000000000B74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/v5/netinstaller/opera/Stable/windows/x64y
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2396767707.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410697635.0000000000EAC000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2406947090.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2388066950.0000000000EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/v5/netinstaller/opera/Stable/windows/x64z
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2364591268.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2387931999.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410715389.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://autoupdate.geo.opera.com/y
Source: VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	String found in binary or memory: https://blockchain.infoindex
Source: syncUpd.exe, 0000000F.00000003.2281275820.00000000008F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: syncUpd.exe, 0000000F.00000003.2281275820.00000000008F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: syncUpd.exe, 0000000F.00000003.2281275820.00000000008F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: https://crashpad.chromium.org/
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: https://crashpad.chromium.org/bug/new
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2506090579.0000000001430000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2499037489.0000000001280000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2521237730.000000004CA5C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crashstats-collector.opera.com/collector/submit
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2456981913.00000000006E8000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2458031390.000000005C814000.00000004.00001000.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2514125929.000000004CA14000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crashstats-collector.opera.com/collector/submit--annotation=channel=Stable--annotation=plat=
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2515439121.000000004CA24000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crashstats-collector.opera.com/collector/submit0x2e4
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2458048121.000000005C824000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crashstats-collector.opera.com/collector/submit0x2e8
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2425494524.0000000033C24000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crashstats-collector.opera.com/collector/submit0x2f4
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2425494524.0000000033C24000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crashstats-collector.opera.com/collector/submit3
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2425980036.0000000033CB0000.00000004.00001000.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2458331076.000000005C8B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crashstats-collector.opera.com/collector/submitC:
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2515439121.000000004CA24000.00000004.00001000.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2521237730.000000004CA5C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://crashstats-collector.opera.com/collector/submitL
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2796662559.000000000165B000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2387931999.0000000000F11000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410715389.0000000000F11000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001612000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2381346872.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2381346872.0000000001610000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2379585399.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2379585399.00000000010A1000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414111474.0000000000F70000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2387931322.0000000000FBA000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2395100407.0000000000FBA000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2407930928.0000000000FBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410715389.0000000000F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/1
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/3
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.0000000001666000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/8
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001612000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/?
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2796662559.000000000165B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/A
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001612000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2381346872.0000000001610000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/DllFuncName
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414111474.0000000000F14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/E
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2364591268.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2387931999.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410715389.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/P(s
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2796662559.000000000165B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/Security
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2407930928.0000000000FBA000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2404639801.0000000000FBA000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414780293.0000000000FBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/U
Source: 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2401048572.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2423165911.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2381790231.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2363415183.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2382378174.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2391593565.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/V
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001612000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2381346872.0000000001610000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/W
Source: zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/X
Source: 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2401048572.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2423165911.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2391593565.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/b
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414111474.0000000000F14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/exeW
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001612000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/k
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2796662559.000000000165B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/l
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2364591268.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2387931999.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410715389.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/o
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2796662559.000000000165B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/r-sub.osp.opera.software/
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2796662559.000000000165B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/r-sub.osp.opera.software/Dy
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.0000000001666000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/s#
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001612000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/ssContentHintDecodeExDllFuncNamew
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410715389.0000000000F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/t
Source: zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2379585399.00000000010A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/b
Source: 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2409772902.0000000000B74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binary
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2796662559.000000000165B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binary#
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442550747.00000000015B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binary/
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442550747.00000000015B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binary/B
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2796662559.000000000165B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binary2rhi
Source: zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388143044.0000000001110000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binary3
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414111474.0000000000F77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binary6
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binary7
Source: 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2401048572.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2423165911.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2381790231.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2363415183.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2382378174.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2391593565.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binary8c
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2796662559.000000000165B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryA
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001612000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryCa
Source: zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2379585399.00000000010FB000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryF
Source: zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2379585399.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryI
Source: 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2401048572.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2423165911.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2381790231.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2382378174.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2391593565.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryMt
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410615687.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryU
Source: 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2401048572.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2423165911.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2381790231.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2382378174.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2391593565.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryUS)
Source: zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2379585399.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryX
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2364591268.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2387931999.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410715389.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binarya
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2401048572.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2423165911.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2381790231.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2382378174.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2391593565.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binarye
Source: 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2423730656.00000000034C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryera.software
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryera.software_
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410615687.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryera.softwarest
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryetmsg.dll.mui
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410715389.0000000000F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryf
Source: zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388143044.0000000001110000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryg
Source: 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2401048572.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2423165911.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2381790231.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2382378174.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2391593565.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryim9;
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.000000000161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binarym
Source: zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2379585399.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryn
Source: 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2401048572.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2423165911.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2381790231.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2382378174.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2391593565.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryncO
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001612000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2381346872.0000000001610000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binarynt
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2796662559.000000000165B000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2387931999.0000000000F11000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410715389.0000000000F11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryo
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2796662559.000000000165B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryur
Source: 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2422974806.0000000000B74000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2409772902.0000000000B74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryv
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414111474.0000000000F14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/v1/binaryy
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2381346872.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.0000000001666000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://desktop-netinstaller-sub.osp.opera.software/y
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414111474.0000000000F77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.opera.com/
Source: zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2379585399.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.opera.com/-sub.osp.opera.software/y
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2361773425.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2444214649.000000003F6E0000.00000004.00001000.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2379241385.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2410307403.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2430979117.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2393171018.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2381346872.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2435436063.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2381346872.0000000001610000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442781384.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2436840383.000000003F734000.00000004.00001000.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2372910856.0000000000FAB000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2417196433.0000000045A8C000.00000004.00001000.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2408410558.0000000045B34000.00000004.00001000.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2425396629.00000000380E0000.00000004.00001000.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2363345584.0000000000C32000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2363415183.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.opera.com/download/get/?id=65171&autoupdate=1&ni=1
Source: 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2363415183.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.opera.com/download/get/?id=65171&autoupdate=1&ni=10
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2381346872.0000000001610000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.opera.com/download/get/?id=65171&autoupdate=1&ni=19F
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2417221880.0000000045A9C000.00000004.00001000.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2417196433.0000000045A8C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://download.opera.com/download/get/?id=65171&autoupdate=1&ni=1E
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2796662559.000000000164C000.00000004.00000020.00020000.00000000.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2820867767.0000000029B34000.00000004.00001000.00020000.00000000.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2356908534.0000000001653000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2407180517.000000002E134000.00000004.00001000.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2412352500.000000002E0E0000.00000004.00001000.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2364591268.0000000000F26000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2378402420.0000000000F26000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2444214649.000000003F6E0000.00000004.00001000.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2379241385.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2410307403.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2430979117.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2393171018.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2435436063.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442781384.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2436840383.000000003F734000.00000004.00001000.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2368162064.0000000001118000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2379585399.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2379585399.00000000010A1000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2884161745.00000000010A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.opera.com/download/get/?id=65199&autoupdate=1&ni=1&stream=stable&utm_campaign=767&u
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: https://download.opera.com/download/get/?partner=www&opsys=Windows&utm_source=netinstaller
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2796662559.000000000165B000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2379585399.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2379585399.00000000010A1000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414111474.0000000000F77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download3.operacdn.com/
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414111474.0000000000F77000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download3.operacdn.com/$
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414111474.0000000000F14000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2387931322.0000000000FB2000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414738796.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2404639801.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2388133805.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download3.operacdn.com/ftp/pub/opera/desktop/108.0.5067.24/win/Opera_108.0.5067.24_Autoupdat
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2796662559.000000000165B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download3.operacdn.com/zi
Source: syncUpd.exe, 0000000F.00000003.2281275820.00000000008F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: syncUpd.exe, 0000000F.00000003.2281275820.00000000008F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: syncUpd.exe, 0000000F.00000003.2281275820.00000000008F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: https://features.opera-api2.com/api/v2/features?country=%s&language=%s&uuid=%s&product=%s&channel=%s
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.000000000024A000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.00000000000EA000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.000000000007A000.00000040.00000001.01000000.0000002C.sdmp	String found in binary or memory: https://gamemaker.io
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.000000000024A000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.00000000000EA000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.000000000007A000.00000040.00000001.01000000.0000002C.sdmp	String found in binary or memory: https://gamemaker.io)
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.000000000024A000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.00000000000EA000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.000000000007A000.00000040.00000001.01000000.0000002C.sdmp	String found in binary or memory: https://gamemaker.io/en/education.
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.000000000024A000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.00000000000EA000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.000000000007A000.00000040.00000001.01000000.0000002C.sdmp	String found in binary or memory: https://gamemaker.io/en/get.
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.000000000024A000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.00000000000EA000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.000000000007A000.00000040.00000001.01000000.0000002C.sdmp	String found in binary or memory: https://help.instagram.com/581066165581870;
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: https://help.opera.com/latest/
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.000000000024A000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.00000000000EA000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.000000000007A000.00000040.00000001.01000000.0000002C.sdmp	String found in binary or memory: https://legal.opera.com/eula/computers
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.000000000007A000.00000040.00000001.01000000.0000002C.sdmp	String found in binary or memory: https://legal.opera.com/privacy
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.000000000024A000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.00000000000EA000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.000000000007A000.00000040.00000001.01000000.0000002C.sdmp	String found in binary or memory: https://legal.opera.com/privacy.
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.000000000024A000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.00000000000EA000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.000000000007A000.00000040.00000001.01000000.0000002C.sdmp	String found in binary or memory: https://legal.opera.com/terms
Source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.000000000007A000.00000040.00000001.01000000.0000002C.sdmp	String found in binary or memory: https://legal.opera.com/terms.
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: https://opera.com/privacy
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.000000000024A000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.00000000000EA000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.000000000007A000.00000040.00000001.01000000.0000002C.sdmp	String found in binary or memory: https://policies.google.com/terms;
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: https://redir.opera.com/uninstallsurvey/
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2416720122.0000000045A40000.00000004.00001000.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2408410558.0000000045B34000.00000004.00001000.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2425396629.00000000380E0000.00000004.00001000.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2363345584.0000000000C32000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2389660858.0000000038134000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://redir.opera.com/www.opera.com/firstrun/?utm_campaign=767&utm_medium=apb&utm_source=mkt&http_
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.000000000024A000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.00000000000EA000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.000000000007A000.00000040.00000001.01000000.0000002C.sdmp	String found in binary or memory: https://sourcecode.opera.com
Source: syncUpd.exe, 0000000F.00000003.2460020892.0000000027127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: syncUpd.exe, 0000000F.00000003.2460020892.0000000027127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: syncUpd.exe, 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmp, syncUpd.exe, 0000000F.00000003.2110774330.0000000020D0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: syncUpd.exe, 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
Source: syncUpd.exe, 0000000F.00000003.2110774330.0000000020D0D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.000000000024A000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.00000000000EA000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.000000000007A000.00000040.00000001.01000000.0000002C.sdmp	String found in binary or memory: https://telegram.org/tos/
Source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003690000.00000004.00001000.00020000.00000000.sdmp, VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	String found in binary or memory: https://turnitin.com/robot/crawlerinfo.html)cannot
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.000000000024A000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.00000000000EA000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.000000000007A000.00000040.00000001.01000000.0000002C.sdmp	String found in binary or memory: https://twitter.com/en/tos;
Source: syncUpd.exe, 0000000F.00000003.2281275820.00000000008F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: syncUpd.exe, 0000000F.00000003.2281275820.00000000008F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: syncUpd.exe, 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: syncUpd.exe, 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.mozilla.org/about/e
Source: syncUpd.exe, 0000000F.00000003.2460020892.0000000027127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: syncUpd.exe, 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmp, syncUpd.exe, 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: syncUpd.exe, 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/VxHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0
Source: syncUpd.exe, 0000000F.00000003.2460020892.0000000027127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: syncUpd.exe, 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmp, syncUpd.exe, 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: syncUpd.exe, 0000000F.00000003.2460020892.0000000027127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: syncUpd.exe, 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: syncUpd.exe, 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmp, syncUpd.exe, 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: syncUpd.exe, 0000000F.00000003.2460020892.0000000027127000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: syncUpd.exe, 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: https://www.opera.com
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: https://www.opera.com..
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: https://www.opera.com/
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: https://www.opera.com/download/
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	String found in binary or memory: https://www.opera.com/privacy
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.000000000024A000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.00000000000EA000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.000000000007A000.00000040.00000001.01000000.0000002C.sdmp	String found in binary or memory: https://www.whatsapp.com/legal;

Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe

Code function: 10_2_0040710B GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

10_2_0040710B

E-Banking Fraud

Yara detected Glupteba

Source: Yara match	File source: 38.1.VF98zhY4QVhDxJpNtAE2TU6d.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.f2CDTsUNlMadewChtQe3a8Da.exe.3690000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000026.00000001.2270329448.0000000000843000.00000040.00000001.01000000.0000002A.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: f2CDTsUNlMadewChtQe3a8Da.exe PID: 10968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VF98zhY4QVhDxJpNtAE2TU6d.exe PID: 14320, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000000F.00000002.2877662329.0000000000833000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe

Code function: 10_2_00404375 EntryPoint,SetErrorMode,GetVersion,lstrlenA,InitCommonControls,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,DeleteFileA,DeleteFileA,GetWindowsDirectoryA,DeleteFileA,DeleteFileA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,DeleteFileA,DeleteFileA,OleUninitialize,GetCurrentProcess,ExitWindowsEx,ExitProcess,

10_2_00404375

Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: 31_1_001A2C70	31_1_001A2C70
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: 31_1_001A25D0	31_1_001A25D0
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: 31_1_001A16B0	31_1_001A16B0
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: 31_1_001BA230	31_1_001BA230
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: 31_1_001D6A72	31_1_001D6A72
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: 31_1_001BABB4	31_1_001BABB4
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: 31_1_001B33F0	31_1_001B33F0
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: 31_1_001B7419	31_1_001B7419
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: 31_1_001B8454	31_1_001B8454
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: 31_1_001D2492	31_1_001D2492
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: 31_1_001B6788	31_1_001B6788

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: String function: 004043B0 appears 316 times
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: String function: 001E5DF0 appears 40 times
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: String function: 001B1E30 appears 43 times

Source: C:\Users\user\Desktop\3SqWYf8qFi.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6908 -s 56832

Source: 3SqWYf8qFi.exe

Static PE information: invalid certificate

Source: IGVy70B2MbWqfodclXqYMOZv.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: UI7LDXaAp2RaeFVHf9g6LwB6.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: LulQEAYQpS9lk1qZLpImyHK7.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: 9pxDWajsJYwYwL1brTzHEdek.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: 4F7ctSfTyUiwf5E5Jj8ISwxp.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: tlmCvYWISSwVWnUxg9w0yKg0.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: rSYsgRim3M5YCzGnR78v4Mm1.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: LiMUMFNfqgHoXxfy9KUypTg9.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: MWbupbq1lCIXYvylS8lGgBPD.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: LKiziaTKHXhXmsyq7iSl6Znq.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: guekS5iP2Ex1XPBodoRkDEP3.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: nYogaRAZxPLuvJnrVaN7fjAe.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: zcKoLXDqvdAUIOoGZ6SAU0N3.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: hoIRHCmbfleOimlEQBUf6Nsu.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: Slo3nPYDYKdAC0gOANfeI09y.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: Ktf4CHbIF92R4VV827YiDPbm.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: phZoEhmPHJEnryk70uKpl9zQ.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: XIBzivlqsIPRfzklN9g3VnQx.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: EGZvqStEuOZgeHhVMxPhyZjZ.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: lpOXM8pg9J4cVKMm0aJJw34A.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: tkxNqRBruO0TCZ7E4aLz1RHH.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: 7yvJjVKbdq1WHJrfxFmH3872.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: lLVPG0Pkhk3MeRMVuEfaKb2V.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: s2A2nVFap842S1hTJXF9l5R8.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: SN1mrhiBAGt5YdpSiR94ouLj.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: XgRMsEcdNLhAV5ZMS6q0eNdc.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: nvMOfQgAbNYiBrdqNEHby9rc.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: aUJQGrpjjWYYDUiVfYPZvQ7q.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: VF98zhY4QVhDxJpNtAE2TU6d.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: b1uZ67lknMP13RedpY9EzGAj.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: w9PVG5CKOJz2PxNYSzlQtvrS.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970
Source: UIlVvmdU1KS1YgdCPOj7XPRB.exe.4.dr	Static PE information: Resource name: RT_VERSION type: ARMv7 Thumb COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

Source: 3SqWYf8qFi.exe

Static PE information: No import functions for PE file found

Source: 3SqWYf8qFi.exe, 00000000.00000000.1621550370.0000028B2B932000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenameNewWorldOrderIsComingSoon.exeT vs 3SqWYf8qFi.exe

Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: propsys.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: oleacc.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: shfolder.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: wldp.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: wininet.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: profapi.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: netutils.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Section loaded: winsta.dll
Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Section loaded: sxs.dll
Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Section loaded: amsi.dll
Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Section loaded: profapi.dll
Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: secur32.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: wininet.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: propsys.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: wldp.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: profapi.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: netutils.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: schannel.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe	Section loaded: winsta.dll
Source: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe	Section loaded: sxs.dll
Source: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe	Section loaded: amsi.dll
Source: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe	Section loaded: profapi.dll
Source: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Section loaded: winsta.dll
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Section loaded: sxs.dll
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Section loaded: amsi.dll
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Section loaded: profapi.dll
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Section loaded: winsta.dll
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Section loaded: sxs.dll
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Section loaded: amsi.dll
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Section loaded: profapi.dll
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe	Section loaded: propsys.dll
Source: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe	Section loaded: oleacc.dll
Source: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe	Section loaded: shfolder.dll
Source: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe	Section loaded: wldp.dll
Source: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: secur32.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: wininet.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: propsys.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: wldp.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: profapi.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: netutils.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: schannel.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe	Section loaded: propsys.dll
Source: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe	Section loaded: oleacc.dll
Source: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe	Section loaded: shfolder.dll
Source: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe	Section loaded: wldp.dll
Source: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: colorui.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: mscms.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: coloradapterclient.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: compstui.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: inetres.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Section loaded: oleacc.dll
Source: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe	Section loaded: propsys.dll
Source: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe	Section loaded: oleacc.dll
Source: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe	Section loaded: shfolder.dll
Source: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe	Section loaded: wldp.dll
Source: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe	Section loaded: winsta.dll
Source: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe	Section loaded: sxs.dll
Source: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe	Section loaded: amsi.dll
Source: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe	Section loaded: profapi.dll
Source: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe	Section loaded: winsta.dll
Source: C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe	Section loaded: wbemcomn.dll

Source: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000000F.00000002.2877662329.0000000000833000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winEXE@132/420@0/100

Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe

Code function: 31_1_001A16B0 VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,FindResourceW,LoadResource,SizeofResource,LockResource,FreeLibrary,GetLastError,GetLastError,FreeLibrary,DeleteFileW,DeleteFileW,GetLastError,GetProcAddress,FreeLibrary,DeleteFileW,MessageBoxW,FreeLibrary,FreeLibrary,DeleteFileW,FreeLibrary,GetLastError,MessageBoxW,FormatMessageA,

31_1_001A16B0

Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe

Code function: 10_2_00405C44 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,GetDiskFreeSpaceA,MulDiv,

10_2_00405C44

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

Code function: 15_2_00415D00 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

15_2_00415D00

Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe

Code function: 10_2_00402988 CoCreateInstance,MultiByteToWideChar,

10_2_00402988

Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe

31_1_001A16B0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:14804:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3664:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6908

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pexq1oom.qsz.ps1

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\Task.bat" "

Source: 3SqWYf8qFi.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: 3SqWYf8qFi.exe

Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 49.88%

Source: C:\Users\user\Desktop\3SqWYf8qFi.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\3SqWYf8qFi.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: syncUpd.exe, 0000000F.00000002.3094793528.000000001AD84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: syncUpd.exe, 0000000F.00000002.3094793528.000000001AD84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: syncUpd.exe, 0000000F.00000002.3094793528.000000001AD84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: syncUpd.exe, 0000000F.00000002.3094793528.000000001AD84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: syncUpd.exe, 0000000F.00000002.3094793528.000000001AD84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: syncUpd.exe, 0000000F.00000002.3094793528.000000001AD84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: syncUpd.exe, 0000000F.00000002.3094793528.000000001AD84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: syncUpd.exe, 0000000F.00000003.2280398421.00000000008DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: syncUpd.exe, 0000000F.00000002.3094793528.000000001AD84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: syncUpd.exe, 0000000F.00000002.3094793528.000000001AD84000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: 3SqWYf8qFi.exe	ReversingLabs: Detection: 18%
Source: 3SqWYf8qFi.exe	Virustotal: Detection: 25%

Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: opera-startpage-special
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: run-at-startup
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: replace-addons-extensions-with-gx-store-substitutes
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: run-at-startup-default
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: video-on-start-page
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: yat-emoji-addresses
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: installer-bypass-launcher
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: Local\%ls/Installer/UI_lock
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: Global\Opera/Installer/
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: When enabled, https://addons.opera.com/en/extensions/details/dify-cashback/ extension will be added to the user's extensions
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: OperaInstaller/InstallationInterrupted
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: enable-installer-stats
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: launchopera-on-os-start
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: master-copy-installation
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: show-eula-window-on-start
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: test-pre-installed-extensions-dir
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: post-elevated-install-tasks
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: all-installer-experiments
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: ran-launcher
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4f
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: opera-startpage-special
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: replace-addons-extensions-with-gx-store-substitutes
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: run-at-startup
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: run-at-startup-default
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: video-on-start-page
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: yat-emoji-addresses
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: Local\%ls/Installer/UI_lock
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: installer-bypass-launcher
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: Global\Opera/Installer/
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: When enabled, https://addons.opera.com/en/extensions/details/dify-cashback/ extension will be added to the user's extensions
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: OperaInstaller/InstallationInterrupted
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: enable-installer-stats
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: test-pre-installed-extensions-dir
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: launchopera-on-os-start
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: master-copy-installation
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: show-eula-window-on-start
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: post-elevated-install-tasks
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: all-installer-experiments
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: ran-launcher
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4f
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: &Re-install
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: Global\Opera/Installer/
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: Installatie&pad#Installeer voor alle gebruikers in:%Installeer voor huidige gebruiker in: Standalone-installatie (USB) in:
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: OperaInstaller/InstallationInterrupted
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: enable-installer-stats
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: launchopera-on-os-start
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: master-copy-installation
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: show-eula-window-on-start
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: run-at-startup
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: test-pre-installed-extensions-dir
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: post-elevated-install-tasks
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: gendQ$1 kann nicht zustzlich zu einer bestehenden $2-Installation installiert werden. Laufwerk $1 ($2 MB erforderlich)-Wird herun
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: Path sa &pag-install#I-install para sa lahat ng user sa:'I-install para sa kasalukuyang user sa:&Stand-alone na pag-i-install (USB
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: all-installer-experiments
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: &Baguhin!Di-balido ang path sa pag-install$Gawing &default na browser ang Opera>&Mag-import ng mga bookmark at data mula sa defaul
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: Een andere instantie van het Opera-installatieprogramma werkt al in deze map. Je kan de installatie annuleren, of over een paar mi
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: Ini-install
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: +Ini-install para sa kasalukuyang user ($1)
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: y mawawala. Gusto mo bang ipagpatuloy?bHindi natapos sa Opera ang pag-install. Sigurado ka bang hindi mo na ipagpatuloy ang instal
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: Ini-install ang Opera na may mga settin ng shortcut at rehistro para sa lahat ng user na nasa system. Kinakailangan ng mga prebile
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: Ini-install lamang ang mga setting ng shortcut at rehistro para sa kaslukuyang user. Hindi kinakailangan ng mga prebilehiyo ng sys
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: Ini-install ang lahat sa iisang folder, lokal man o sa panlabas na media, tulad ng USB drive, nang hindi ginagalaw ang rehistro o
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: Nabigong i-download ang Opera.(Hindi nagawa ang pag-extract ng package.;Nagkaroon ng error habang sinusubukang i-install ang Opera
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4f
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: May isa pang pagkakataon ng installer ng Opera ang gumagawa na sa folder na ito. Alinman ay maaari mong kanselahin ang pag-install
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: Hindi malikha ang folder na $1.JWalang sapat na mga privilege para sa pag-install sa ninanais na lokasyon.@Nabigong makakuha ng ad
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: Hindi ma-install ang Opera.exe. Naka-lock ang ilang file sa folder ng pag-install. I-restart ang computer o i-unblock ang mga file
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: XHindi na-reinstall ang Opera.exe. Siguraduhing hindi gumagana ang Opera at subukan ulit.QHindi ma-update ang Opera. Siguraduhing
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: pangunahin mong dahilan sa pag-uninstall ng Opera?ZWala namang problema. Magre-reinstall o mag-a-update lang ako sa isang mas bag
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: Piliin ang path ng pag-install
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: s Breakpad server URL, only if uploads are enabled for the database --help display this help and exit --version output version information and exit
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: s Breakpad server URL, only if uploads are enabled for the database --help display this help and exit --version output version information and exit
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: opera-startpage-special
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: replace-addons-extensions-with-gx-store-substitutes
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: run-at-startup-default
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: video-on-start-page
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: yat-emoji-addresses
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: installer-bypass-launcher
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: Local\%ls/Installer/UI_lock
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: When enabled, https://addons.opera.com/en/extensions/details/dify-cashback/ extension will be added to the user's extensions
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: partition_alloc/address_space
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: ran-launcher
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe	String found in binary or memory: Opera-installeringsprogrammInstallationsfilen ser ud til at vre beskadiget. G til <a href="tos">www.opera.com</a>, og hent Opera
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: opera-startpage-special
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: replace-addons-extensions-with-gx-store-substitutes
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: run-at-startup
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: run-at-startup-default
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: video-on-start-page
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: yat-emoji-addresses
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: Local\%ls/Installer/UI_lock
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: installer-bypass-launcher
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: Global\Opera/Installer/
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: When enabled, https://addons.opera.com/en/extensions/details/dify-cashback/ extension will be added to the user's extensions
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: OperaInstaller/InstallationInterrupted
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: enable-installer-stats
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: test-pre-installed-extensions-dir
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: launchopera-on-os-start
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: master-copy-installation
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: show-eula-window-on-start
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: post-elevated-install-tasks
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: all-installer-experiments
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: ran-launcher
Source: Rfsq67IamA4rPpnX6LHMDFkm.exe	String found in binary or memory: https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4f
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: opera-startpage-special
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: run-at-startup
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: replace-addons-extensions-with-gx-store-substitutes
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: run-at-startup-default
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: video-on-start-page
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: yat-emoji-addresses
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: installer-bypass-launcher
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: Local\%ls/Installer/UI_lock
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: Global\Opera/Installer/
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: When enabled, https://addons.opera.com/en/extensions/details/dify-cashback/ extension will be added to the user's extensions
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: OperaInstaller/InstallationInterrupted
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: enable-installer-stats
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: launchopera-on-os-start
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: master-copy-installation
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: show-eula-window-on-start
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: test-pre-installed-extensions-dir
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: post-elevated-install-tasks
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: Try '%ls --help' for more information.
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: all-installer-experiments
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: ran-launcher
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe	String found in binary or memory: https://addons.opera.com/extensions/download/be76331b95dfc399cd776d2fc68021e0db03cc4f

Source: unknown	Process created: C:\Users\user\Desktop\3SqWYf8qFi.exe C:\Users\user\Desktop\3SqWYf8qFi.exe
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3SqWYf8qFi.exe" -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6908 -s 56832
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe "C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe "C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe "C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe" --silent --allusers=0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe "C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe "C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe"
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Process created: C:\Users\user\AppData\Local\Temp\syncUpd.exe C:\Users\user\AppData\Local\Temp\syncUpd.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe "C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe "C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe "C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe" --silent --allusers=0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe "C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe"
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Process created: C:\Users\user\AppData\Local\Temp\BroomSetup.exe C:\Users\user\AppData\Local\Temp\BroomSetup.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe "C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe "C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe "C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\dZhcoTSgym1JGRiEQOUqAdeo.exe "C:\Users\user\Pictures\dZhcoTSgym1JGRiEQOUqAdeo.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\rfKusEcfqkKKVyx19jVITYlO.exe "C:\Users\user\Pictures\rfKusEcfqkKKVyx19jVITYlO.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe "C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe" --silent --allusers=0
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Process created: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6c4b21c8,0x6c4b21d4,0x6c4b21e0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe "C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe" --silent --allusers=0
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Process created: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2d4,0x300,0x6b8021c8,0x6b8021d4,0x6b8021e0
Source: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe	Process created: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2c4,0x304,0x6bd721c8,0x6bd721d4,0x6bd721e0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\mxmsi31bOIKdEb9VIHBYJshQ.exe "C:\Users\user\Pictures\mxmsi31bOIKdEb9VIHBYJshQ.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe "C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe" --silent --allusers=0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe "C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe" --silent --allusers=0
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\Task.bat" "
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\jLh2jXNiKaCQ93A91IuQMDiC.exe "C:\Users\user\Pictures\jLh2jXNiKaCQ93A91IuQMDiC.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\VF98zhY4QVhDxJpNtAE2TU6d.exe "C:\Users\user\Pictures\VF98zhY4QVhDxJpNtAE2TU6d.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe	Process created: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6ae821c8,0x6ae821d4,0x6ae821e0
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\rMuSSyE2z14xNxfrVLVv1kvs.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\rMuSSyE2z14xNxfrVLVv1kvs.exe" --version
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe	Process created: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6a9c21c8,0x6a9c21d4,0x6a9c21e0
Source: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe	Process created: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6a5021c8,0x6a5021d4,0x6a5021e0
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3SqWYf8qFi.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe "C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe "C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe "C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe" --silent --allusers=0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe "C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe "C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe "C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe "C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe "C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe" --silent --allusers=0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe "C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe "C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe "C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe "C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\dZhcoTSgym1JGRiEQOUqAdeo.exe "C:\Users\user\Pictures\dZhcoTSgym1JGRiEQOUqAdeo.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\rfKusEcfqkKKVyx19jVITYlO.exe "C:\Users\user\Pictures\rfKusEcfqkKKVyx19jVITYlO.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe "C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe" --silent --allusers=0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe "C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe" --silent --allusers=0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\mxmsi31bOIKdEb9VIHBYJshQ.exe "C:\Users\user\Pictures\mxmsi31bOIKdEb9VIHBYJshQ.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe "C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe" --silent --allusers=0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe "C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe" --silent --allusers=0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\jLh2jXNiKaCQ93A91IuQMDiC.exe "C:\Users\user\Pictures\jLh2jXNiKaCQ93A91IuQMDiC.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\VF98zhY4QVhDxJpNtAE2TU6d.exe "C:\Users\user\Pictures\VF98zhY4QVhDxJpNtAE2TU6d.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Process created: C:\Users\user\AppData\Local\Temp\syncUpd.exe C:\Users\user\AppData\Local\Temp\syncUpd.exe
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Process created: C:\Users\user\AppData\Local\Temp\BroomSetup.exe C:\Users\user\AppData\Local\Temp\BroomSetup.exe
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Process created: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6c4b21c8,0x6c4b21d4,0x6c4b21e0
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Process created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\rMuSSyE2z14xNxfrVLVv1kvs.exe "C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\rMuSSyE2z14xNxfrVLVv1kvs.exe" --version
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Process created: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2d4,0x300,0x6b8021c8,0x6b8021d4,0x6b8021e0
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\Task.bat" "
Source: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe	Process created: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2c4,0x304,0x6bd721c8,0x6bd721d4,0x6bd721e0
Source: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe	Process created: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6ae821c8,0x6ae821d4,0x6ae821e0
Source: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe	Process created: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6a9c21c8,0x6a9c21d4,0x6a9c21e0
Source: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe	Process created: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6a5021c8,0x6a5021d4,0x6a5021e0
Source: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\3SqWYf8qFi.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe

Window found: window name: TButton

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\3SqWYf8qFi.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 3SqWYf8qFi.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: 3SqWYf8qFi.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: 3SqWYf8qFi.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: Loader.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer.exe.pdb source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CA1000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.00000000001F1000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000091000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.0000000000021000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.00000000001F1000.00000040.00000001.01000000.00000029.sdmp
Source:	Binary string: Unrecognized pdb formatThis error indicates attempting to access a .pdb file with source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: A connection with the server could not be establishedAn extended error was returned from the WinHttp serverThe .pdb file is probably no longer indexed in the symbol server share location. source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: `K_lib.dll.pdb@+ source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000000.1862298101.00000000011A7000.00000080.00000001.01000000.0000000C.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000000.1946950834.0000000000407000.00000080.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000000.1943633581.0000000000F07000.00000080.00000001.01000000.00000018.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000001C.00000000.1976024041.00000000011A7000.00000080.00000001.01000000.0000000C.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000000.1948656923.0000000000AA7000.00000080.00000001.01000000.0000001D.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000000.2012097688.0000000000407000.00000080.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000000.2054392398.0000000000F07000.00000080.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000000.2058242868.0000000000457000.00000080.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000000.2064487479.00000000002F7000.00000080.00000001.01000000.00000028.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 00000028.00000000.2058335131.0000000000AA7000.00000080.00000001.01000000.0000001D.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000000.2084551332.0000000000287000.00000080.00000001.01000000.0000002C.sdmp
Source:	Binary string: Age does not matchThe module age and .pdb age do not match. source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: symsrv.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003F08000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .exe.pdb source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000000.1862298101.00000000011A7000.00000080.00000001.01000000.0000000C.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000000.1946950834.0000000000407000.00000080.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000000.1943633581.0000000000F07000.00000080.00000001.01000000.00000018.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000001C.00000000.1976024041.00000000011A7000.00000080.00000001.01000000.0000000C.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000000.1948656923.0000000000AA7000.00000080.00000001.01000000.0000001D.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000000.2012097688.0000000000407000.00000080.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000000.2054392398.0000000000F07000.00000080.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000000.2058242868.0000000000457000.00000080.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000000.2064487479.00000000002F7000.00000080.00000001.01000000.00000028.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 00000028.00000000.2058335131.0000000000AA7000.00000080.00000001.01000000.0000001D.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000000.2084551332.0000000000287000.00000080.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000000.2090220336.0000000000457000.00000080.00000001.01000000.00000029.sdmp
Source:	Binary string: Cvinfo is corruptThe .pdb file contains a corrupted debug codeview information. source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Downloading symbols for [%s] %ssrvsymsrvhttp://https://_bad_pdb_file.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: The symbol server has never indexed any version of this symbol fileNo version of the .pdb file with the given name has ever been registered. source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: PDB not foundUnable to locate the .pdb file in any of the symbol search path locations. source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer_lib.dll.pdb source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer_lib.dll.pdb@+ source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\Release\Winmon.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\vbox\branch\w64-1.6\out\win.amd64\release\obj\src\VBox\HostDrivers\VBoxDrv\VBoxDrv.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\Users\Admin\documents\visual studio 2015\Projects\Winmon\x64\Release\Winmon.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Drive not readyThis error indicates a .pdb file related failure. source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: `K_lib.dll.pdb source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000000.1862298101.00000000011A7000.00000080.00000001.01000000.0000000C.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000000.1946950834.0000000000407000.00000080.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000000.1943633581.0000000000F07000.00000080.00000001.01000000.00000018.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000001C.00000000.1976024041.00000000011A7000.00000080.00000001.01000000.0000000C.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000000.1948656923.0000000000AA7000.00000080.00000001.01000000.0000001D.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000000.2012097688.0000000000407000.00000080.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000000.2054392398.0000000000F07000.00000080.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000000.2058242868.0000000000457000.00000080.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000000.2064487479.00000000002F7000.00000080.00000001.01000000.00000028.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 00000028.00000000.2058335131.0000000000AA7000.00000080.00000001.01000000.0000001D.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000000.2084551332.0000000000287000.00000080.00000001.01000000.0000002C.sdmp
Source:	Binary string: Error while loading symbolsUnable to locate the .pdb file in any of the symbol search source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: zzz_AsmCodeRange_*FrameDatainvalid string positionstring too long.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Pdb read access deniedYou may be attempting to access a .pdb file with read-only attributes source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: Unable to locate the .pdb file in this location source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\x64\Release\WinmonFS.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: The module signature does not match with .pdb signature. source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .pdb.dbg source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: '(EfiGuardDxe.pdbx source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: symsrv.pdbGCTL source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003F08000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\Release\WinmonProcessMonitor.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Admin\documents\visual studio 2015\Projects\WinmonFS\Release\WinmonFS.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: or you do not have access permission to the .pdb location. source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: An Exception happened while downloading the module .pdbPlease open a bug if this is a consistent repro. source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\admin\source\repos\driver-process-monitor-master\x64\Release\WinmonProcessMonitor.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: EfiGuardDxe.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .exe.pdb@ source: rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000000.1862298101.00000000011A7000.00000080.00000001.01000000.0000000C.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000000.1946950834.0000000000407000.00000080.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000000.1943633581.0000000000F07000.00000080.00000001.01000000.00000018.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000001C.00000000.1976024041.00000000011A7000.00000080.00000001.01000000.0000000C.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000000.1948656923.0000000000AA7000.00000080.00000001.01000000.0000001D.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000000.2012097688.0000000000407000.00000080.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000000.2054392398.0000000000F07000.00000080.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000000.2058242868.0000000000457000.00000080.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000000.2064487479.00000000002F7000.00000080.00000001.01000000.00000028.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 00000028.00000000.2058335131.0000000000AA7000.00000080.00000001.01000000.0000001D.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000000.2084551332.0000000000287000.00000080.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000000.2090220336.0000000000457000.00000080.00000001.01000000.00000029.sdmp
Source:	Binary string: Signature does not matchThe module signature does not match with .pdb signature source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\srv\slave\workdir\repos\opera\chromium\src\out\Release\installer.exe.pdb@ source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000CA1000.00000040.00000001.01000000.00000018.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CA1000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.00000000001F1000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000091000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.0000000000021000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.00000000001F1000.00000040.00000001.01000000.00000029.sdmp
Source:	Binary string: dbghelp.pdb source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: dbghelp.pdbGCTL source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

Unpacked PE file: 15.2.syncUpd.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

Unpacked PE file: 15.2.syncUpd.exe.400000.0.unpack

Source: 3SqWYf8qFi.exe

Static PE information: 0xAF428149 [Tue Mar 6 01:47:53 2063 UTC]

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

Code function: 15_2_00416240 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

15_2_00416240

Source: jLh2jXNiKaCQ93A91IuQMDiC.exe.4.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x211d62
Source: LKiziaTKHXhXmsyq7iSl6Znq.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x42280e
Source: rSYsgRim3M5YCzGnR78v4Mm1.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x42280e
Source: zcKoLXDqvdAUIOoGZ6SAU0N3.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x41f73d
Source: hoIRHCmbfleOimlEQBUf6Nsu.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x41f73d
Source: tlmCvYWISSwVWnUxg9w0yKg0.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x42280e
Source: 4cq2SZqMHS3XYqkYi9qoDSje.exe.4.dr	Static PE information: real checksum: 0x2de4aa should be: 0x2d5f4f
Source: j1XOgROBJfvz0cRzU7rPw7NS.exe.4.dr	Static PE information: real checksum: 0x2da789 should be: 0x2e222d
Source: EGZvqStEuOZgeHhVMxPhyZjZ.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x42280e
Source: SN1mrhiBAGt5YdpSiR94ouLj.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x41f73d
Source: leLskzRZPIglQflslvTIwLTy.exe.4.dr	Static PE information: real checksum: 0x2d9b65 should be: 0x2e1609
Source: Lp5WnTgHCMiSZVksHSRp5zyx.exe.4.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x211d62
Source: UIlVvmdU1KS1YgdCPOj7XPRB.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x42280e
Source: C2ytbpXjpVGZQltGJ6eXiuhX.exe.4.dr	Static PE information: real checksum: 0x2e0097 should be: 0x2d7b3c
Source: Slo3nPYDYKdAC0gOANfeI09y.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x42280e
Source: 9pxDWajsJYwYwL1brTzHEdek.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x41f73d
Source: sP3BgFXaLWMMa0a6kgrVZ5A3.exe.4.dr	Static PE information: real checksum: 0x2d9b65 should be: 0x2e1609
Source: 03VPbfdR0v0eUJbl3BY2yvWa.exe.4.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x211d62
Source: HN7tYbFl9xu8SJ0TV9kPnV6R.exe.4.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x211d62
Source: S58tmyihHBD6BmCz1ZODtpm0.exe.4.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x211d62
Source: qLEG52WWxIWvDwEETVieoeBU.exe.4.dr	Static PE information: real checksum: 0x2de329 should be: 0x2d5dce
Source: 4F7ctSfTyUiwf5E5Jj8ISwxp.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x42280e
Source: tkxNqRBruO0TCZ7E4aLz1RHH.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x42280e
Source: fDVyGnt4qkfC1RQX2yjdlha8.exe.4.dr	Static PE information: real checksum: 0x2d3429 should be: 0x2daecd
Source: aUJQGrpjjWYYDUiVfYPZvQ7q.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x41f73d
Source: XIBzivlqsIPRfzklN9g3VnQx.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x41f73d
Source: 7yvJjVKbdq1WHJrfxFmH3872.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x42280e
Source: l4uKqmU2WFXWkMNLmByrfqyU.exe.4.dr	Static PE information: real checksum: 0x2d783f should be: 0x2df2e3
Source: b1uZ67lknMP13RedpY9EzGAj.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x42280e
Source: LulQEAYQpS9lk1qZLpImyHK7.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x42280e
Source: lLVPG0Pkhk3MeRMVuEfaKb2V.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x41f73d
Source: Ktf4CHbIF92R4VV827YiDPbm.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x41f73d
Source: UI7LDXaAp2RaeFVHf9g6LwB6.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x41f73d
Source: nvMOfQgAbNYiBrdqNEHby9rc.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x42280e
Source: UrT5ltGRxob1yeMhM5Nnnzax.exe.4.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x211d62
Source: NUsC1LZWtdLvV2hVDgycM5e6.exe.4.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x211d62
Source: MW0Q5IkKXdDw9nrX6CojJx9n.exe.4.dr	Static PE information: real checksum: 0x2d7104 should be: 0x2deba8
Source: nrklq6P1CNvXZbzoZhiYO66H.exe.4.dr	Static PE information: real checksum: 0x2d3429 should be: 0x2daecd
Source: B8Lqzc0h0CXWQep40oCdtIvu.exe.4.dr	Static PE information: real checksum: 0x2de4aa should be: 0x2d5f4f
Source: nYogaRAZxPLuvJnrVaN7fjAe.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x41f73d
Source: lpOXM8pg9J4cVKMm0aJJw34A.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x42280e
Source: 5pdwJpq902hXA5VnaRygPeAf.exe.4.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x211d62
Source: DOHofbJiGO0ppvf8BnLjEcOT.exe.4.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x211d62
Source: cNYL5IyksZKthNvEJoyBw8Ag.exe.4.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x211d62
Source: HFiFGl6AR63OLnORhPPDiWeA.exe.4.dr	Static PE information: real checksum: 0x2d7104 should be: 0x2deba8
Source: s2A2nVFap842S1hTJXF9l5R8.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x41f73d
Source: aFkMZIYV0H3vyPVwOnL9WjBJ.exe.4.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x211d62
Source: VF98zhY4QVhDxJpNtAE2TU6d.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x42280e
Source: 0IFrK3aRWk7G6YUjUT8ew0OK.exe.4.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x211d62
Source: guekS5iP2Ex1XPBodoRkDEP3.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x41f73d
Source: MWbupbq1lCIXYvylS8lGgBPD.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x41f73d
Source: B9mSYpwKkVgW9jJSaxBMcATu.exe.4.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x211d62
Source: gC6HQHcPvsALd84vdJXhjM8b.exe.4.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x211d62
Source: jx4EXQWaWISJJqVjnXD4Dqaz.exe.4.dr	Static PE information: real checksum: 0x2d783f should be: 0x2df2e3
Source: 2xlrDVEKDyhTNLHkwA8DqN66.exe.4.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x211d62
Source: 2n6aZsnLKtKXJNMzWvG8Ou1L.exe.4.dr	Static PE information: real checksum: 0x2de329 should be: 0x2d5dce
Source: LiMUMFNfqgHoXxfy9KUypTg9.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x42280e
Source: EwzOUe6vEjttYfeygpeUfeHd.exe.4.dr	Static PE information: real checksum: 0x2e0097 should be: 0x2d7b3c
Source: IGVy70B2MbWqfodclXqYMOZv.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x42280e
Source: phZoEhmPHJEnryk70uKpl9zQ.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x41f73d
Source: w9PVG5CKOJz2PxNYSzlQtvrS.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x41f73d
Source: 06nVIZvE4iGjgzg643uXiijC.exe.4.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x211d62
Source: QRVPcUOZwKQgBVL5bWKd8sH5.exe.4.dr	Static PE information: real checksum: 0x1eaa5 should be: 0x211d62
Source: XgRMsEcdNLhAV5ZMS6q0eNdc.exe.4.dr	Static PE information: real checksum: 0x42386a should be: 0x41f73d

Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_00402E4B push ebx; mov dword ptr [esp], 00413040h	10_2_00402EF6
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_00401860 push eax; mov dword ptr [esp], ebx	10_2_0040192D
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_00402613 push ecx; mov dword ptr [esp], ebx	10_2_00402634
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_0040183B push ecx; mov dword ptr [esp], eax	10_2_0040184E
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_004060FD push eax; mov dword ptr [esp], ebx	10_2_004062A3
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_004060FD push ebx; mov dword ptr [esp], 00434400h	10_2_004062BE
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_004060FD push eax; mov dword ptr [esp], 0040B410h	10_2_00406446
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_004060FD push esi; mov dword ptr [esp], 00000001h	10_2_00406505
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_004042BC push eax; mov dword ptr [esp], 00435400h	10_2_004042CF
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_004042BC push eax; mov dword ptr [esp], 00435400h	10_2_004042F1
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_00403141 push edx; mov dword ptr [esp], eax	10_2_00403156
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_0040815B push ebx; mov dword ptr [esp], 0042AF40h	10_2_00408178
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_0040815B push eax; mov dword ptr [esp], 0042AF40h	10_2_004081F0
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_00403164 push edi; mov dword ptr [esp], eax	10_2_00403177
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_00404375 push ecx; mov dword ptr [esp], ebx	10_2_004043C9
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_00404375 push ebx; mov dword ptr [esp], 0000000Bh	10_2_004043E6
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_00404375 push eax; mov dword ptr [esp], 00000000h	10_2_00404471
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_00404375 push edx; mov dword ptr [esp], eax	10_2_004044AE
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_00404375 push eax; mov dword ptr [esp], ebx	10_2_00404590
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_00404375 push eax; mov dword ptr [esp], 00435400h	10_2_004046E6
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_00404375 push ecx; mov dword ptr [esp], 00427D20h	10_2_0040475B
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_00404375 push eax; mov dword ptr [esp], 00427D20h	10_2_004047C0
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_00404375 push ebx; mov dword ptr [esp], 00000002h	10_2_00404838
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_00401B06 push edx; mov dword ptr [esp], eax	10_2_00401B53
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_00401B06 push edi; mov dword ptr [esp], 00412840h	10_2_00401B6A
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_00401DB0 push edi; mov dword ptr [esp], eax	10_2_00401E18
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_004085B8 push eax; mov dword ptr [esp], ebx	10_2_00408671
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_004085B8 push eax; mov dword ptr [esp], ebx	10_2_0040873D
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_004085B8 push eax; mov dword ptr [esp], ebx	10_2_00408763
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_004085B8 push ecx; mov dword ptr [esp], ebx	10_2_004087E3
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_004085B8 push esi; mov dword ptr [esp], ebx	10_2_004087EC

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\4oOqWbJEImqDRLxD75xKRNjm.exe	Jump to dropped file
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Opera_108.0.5067.24_Autoupdate_x64[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\S58tmyihHBD6BmCz1ZODtpm0.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\GzgoX5V54ke4dVGjS16ex045.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\enc9JdewSUMVCRcBLY1bLbUT.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Ledger-Live[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\nnZpB7DttFEiMoRHhyjsMIGz.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\nNtGSwumkPliSKVeAx7Sx8Gp.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\lLVPG0Pkhk3MeRMVuEfaKb2V.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\fDVyGnt4qkfC1RQX2yjdlha8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\rMuSSyE2z14xNxfrVLVv1kvs.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043944414548.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\sP3BgFXaLWMMa0a6kgrVZ5A3.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\C2ytbpXjpVGZQltGJ6eXiuhX.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\b1uZ67lknMP13RedpY9EzGAj.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File created: C:\Users\user\AppData\Local\Temp\IIEHCFIDHI.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\DOHofbJiGO0ppvf8BnLjEcOT.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\Tux8yeqUanpZipvXA8WXqYc0.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\97vQigClUgXPlHCQsrK19F5k.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\f92wGKeu5LyIAhCs4NxRkLxR.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\oL06QqFgQZZETtHJ8qOWjQhV.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\phZoEhmPHJEnryk70uKpl9zQ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\6z1e79d9YW0aNxV6xEjP29XG.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\dghB8AfRudM2FLzl5fgKHzMA.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\4F7ctSfTyUiwf5E5Jj8ISwxp.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\X25zuvF7asVSMm12uFSrccNg.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\HHCsqXDqpAXkK1qXCMPkWTES.exe	Jump to dropped file
Source: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043401411604.dll	Jump to dropped file
Source: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043820413232.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\S9FRoySbKySnaEAuJOzqToi9.exe	Jump to dropped file
Source: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\zKY9gVt7bugdAVV29pfHDO1J.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\ro486V1Z7P66nNToWTrVxquk.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\kujNjTMPu36kPLMvqPBbpIku.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\XcDOAu7dcqSLvLgCVhDWG4DS.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\VF98zhY4QVhDxJpNtAE2TU6d.exe	Jump to dropped file
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043017611524.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\7SwW0NDNOzD4bm2fh2mMH4aC.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\B8Lqzc0h0CXWQep40oCdtIvu.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\nvMOfQgAbNYiBrdqNEHby9rc.exe	Jump to dropped file
Source: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211045859715840.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\zcKoLXDqvdAUIOoGZ6SAU0N3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\5pdwJpq902hXA5VnaRygPeAf.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\LAJLX2OtZ85vzPOftAYRcEsi.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\w9PVG5CKOJz2PxNYSzlQtvrS.exe	Jump to dropped file
Source: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043726914020.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\WmGZEzN2y17TSARkq7CMs3oI.exe	Jump to dropped file
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043920313116.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\KV7xIiMtLy0kJUjIxAoYbPAI.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\94dy1QqwzgyoJs6C4qGbaLjk.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\C9Df3LuwbD9ycdo5E8aI5Wc6.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\1OQjrbwH6I3sd8vA3ha6k08p.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\Slo3nPYDYKdAC0gOANfeI09y.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\0IFrK3aRWk7G6YUjUT8ew0OK.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\PgyoyDyjTaeBIiR0ZncnFz3x.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\aFkMZIYV0H3vyPVwOnL9WjBJ.exe	Jump to dropped file
Source: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403121204471\opera_package	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\alBY3v35R74xONR13b2VtkYE.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\PRVOgEotbjGXE8sD4i3FyhZT.exe	Jump to dropped file
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	File created: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\zF1fl3LOa2LapjgwxbfBCS0k.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\YpqMAvbWtKvsPXvu1AiMGUgE.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\7yvJjVKbdq1WHJrfxFmH3872.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\QRVPcUOZwKQgBVL5bWKd8sH5.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\VgDhRl17mSZEAyX0ktrL58w3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\NUsC1LZWtdLvV2hVDgycM5e6.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\BtncwRtgPRnpujyKznLGy9d8.exe	Jump to dropped file
Source: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211044129216532.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\QIllRQrcYueLdSshRqLTqOvP.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\WtNveQ4d78dApFTRjzeseQ67.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\tkHy6gygmfOPY9aBah1pIwua.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\MWbupbq1lCIXYvylS8lGgBPD.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\i0DLgyxTLlkFBSXC6EtBlR3o.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\nYogaRAZxPLuvJnrVaN7fjAe.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043773814148.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\9pxDWajsJYwYwL1brTzHEdek.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\rvy2oX9wb6hdfWfPiYtPw60n.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\hoIRHCmbfleOimlEQBUf6Nsu.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\cNYL5IyksZKthNvEJoyBw8Ag.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\EGZvqStEuOZgeHhVMxPhyZjZ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\aUJQGrpjjWYYDUiVfYPZvQ7q.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\nDHXe5EkxWeixtBE9998831S.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\LKiziaTKHXhXmsyq7iSl6Znq.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\MLm2a0TiwOQvrEuSm0y6Hlo4.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\jLh2jXNiKaCQ93A91IuQMDiC.exe	Jump to dropped file
Source: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Opera_108.0.5067.24_Autoupdate_x64[3].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\LulQEAYQpS9lk1qZLpImyHK7.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\tkxNqRBruO0TCZ7E4aLz1RHH.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\5QpyioUXq8ASWQahMvzU4ahz.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\DG5NfvChXpdFrpWmBrnRWaQb.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\xwluxp5OZq2fzKcnUhKN90Gy.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\EfWbusCUqNvTcQMtFkj7YUGY.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\GfRX4UT2Opv4sOsHjzHHVCjf.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe	Jump to dropped file
Source: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211042526911280.dll	Jump to dropped file
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	File created: C:\Users\user\AppData\Local\Temp\nsvA4F1.tmp\INetC.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\jWtlFlrLdXdhBLj1fOltMT9i.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\dnobo8kquxthKYPbiVKNkBHX.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\eqwQ4v4W79HQtYChIL8CXQJj.exe	Jump to dropped file
Source: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403121205051\opera_package	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\tlmCvYWISSwVWnUxg9w0yKg0.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\7mP2uTTqqwYXFx3CixL6JUmx.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\HFiFGl6AR63OLnORhPPDiWeA.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\DY8D6dQbgIgJO1SaVNqhiZOW.exe	Jump to dropped file
Source: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043867714488.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\rfKusEcfqkKKVyx19jVITYlO.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\06nVIZvE4iGjgzg643uXiijC.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\UIlVvmdU1KS1YgdCPOj7XPRB.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\qLEG52WWxIWvDwEETVieoeBU.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\rSYsgRim3M5YCzGnR78v4Mm1.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\u118vbhgpAsB1DCQ91pKfLua.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\mxmsi31bOIKdEb9VIHBYJshQ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\jx4EXQWaWISJJqVjnXD4Dqaz.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\QXOXdXIs2CDsFYBPsa07tHNX.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\UrT5ltGRxob1yeMhM5Nnnzax.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\KFfdFQJ0GFXA36ymuAOaK0ZR.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\g8ZqhZX4Hv3yrSl3yliJsZDM.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\UI7LDXaAp2RaeFVHf9g6LwB6.exe	Jump to dropped file
Source: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Opera_108.0.5067.24_Autoupdate_x64[2].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\s2A2nVFap842S1hTJXF9l5R8.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\XIBzivlqsIPRfzklN9g3VnQx.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\leLskzRZPIglQflslvTIwLTy.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\n3Yk1EJMr8upEtxmsPsGJQY9.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\HN7tYbFl9xu8SJ0TV9kPnV6R.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\03VPbfdR0v0eUJbl3BY2yvWa.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\XBfbSv4es0kCeAv5VfvvgpQ7.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\rNWlWD0ZgXMhzWvOuALV5nXl.exe	Jump to dropped file
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	File created: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\kbk5zLOtlX5KBIypEMa7wHhL.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe	Jump to dropped file
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_2403121104234259124.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\SgphKg63629U7dMJ7gswdhRB.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\a3F2iXIaBwCbhUUvTA3BBuOE.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\IGVy70B2MbWqfodclXqYMOZv.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\aUOQyBDQWpOtJeSIFm10c61i.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\c0Si5Ocs5Hjqmkw7zPRBLU4J.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\lPSfsxgFucUyDCrXpMn2ucYq.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\4cq2SZqMHS3XYqkYi9qoDSje.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\pN2O0fDFwQyZhLFu32KEUc8D.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\2xlrDVEKDyhTNLHkwA8DqN66.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\nU8NHI9fYTvNPbiYhk76Vc0l.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\y4lq5SHqKAOV4kY1xCRGbtJI.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\dZhcoTSgym1JGRiEQOUqAdeo.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\lpOXM8pg9J4cVKMm0aJJw34A.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\MW0Q5IkKXdDw9nrX6CojJx9n.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\Lx8QrL0pgGPlzgQWZQW3XR1F.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\XgRMsEcdNLhAV5ZMS6q0eNdc.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\HfRmesToGDAxeXrQ5sUnZbvw.exe	Jump to dropped file
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\rMuSSyE2z14xNxfrVLVv1kvs.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\LiMUMFNfqgHoXxfy9KUypTg9.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\B9mSYpwKkVgW9jJSaxBMcATu.exe	Jump to dropped file
Source: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\2n6aZsnLKtKXJNMzWvG8Ou1L.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\Lp5WnTgHCMiSZVksHSRp5zyx.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\Ge2xGCQPLJT2DzNk3YNjEyuZ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\quqghK17OnNCuj9KAvNZQsIX.exe	Jump to dropped file
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	File created: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211042869310536.dll	Jump to dropped file
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\et1UzaJspSJuRyCxNxPGYCVV.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\Ktf4CHbIF92R4VV827YiDPbm.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\OHK6a4WIJ0F6rlhWGJwMYrRP.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\nrklq6P1CNvXZbzoZhiYO66H.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\SN1mrhiBAGt5YdpSiR94ouLj.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\9HGEbLH7EssqmLwFcrlZYSWT.exe	Jump to dropped file
Source: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\Rfsq67IamA4rPpnX6LHMDFkm.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\CmAp0DxyhTEj5GF5fAGFiA38.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\Nq9MYb4uPnSDV9cCg1KHXQbW.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\HKhPqHszLj6gz3A9XYe5jsNS.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\vC3Q85PP4k1yZfTFObCtFF23.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\ShUBAVvG4N04pgkRyyhwlthp.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\k6s7peRuTySdHXpiWwpUH9mL.exe	Jump to dropped file
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403121204571\opera_package	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\guekS5iP2Ex1XPBodoRkDEP3.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\l4uKqmU2WFXWkMNLmByrfqyU.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\EwzOUe6vEjttYfeygpeUfeHd.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\Jshk17Bukhv7AlOodjXBVX2B.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\gC6HQHcPvsALd84vdJXhjM8b.exe	Jump to dropped file
Source: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\j1XOgROBJfvz0cRzU7rPw7NS.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Local\TgGBhjAUKSjQAdgyfPvaMx0f.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403121204571\opera_package	Jump to dropped file
Source: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403121204471\opera_package	Jump to dropped file
Source: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403121205051\opera_package	Jump to dropped file

Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240312120432506.log
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240312120451640.log
Source: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240312120439871.log
Source: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240312120440744.log
Source: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240312120500215.log
Source: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe	File created: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240312120451637.log

Boot Survival

Drops script or batch files to the startup folder

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GqtFjA5wUyMdLuRfwskrpVTo.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jSlH1NDdwZ5sVvpJLaRGlUg3.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cu7dRoXaHj4ykdzix5wPfjXx.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mJLmefrCsgE5krwk9Oci0Bbw.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y3v4PLQ2XJADPLe8uTGKTGBj.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JzQd2zNS2LuiFZIBJg0WYcl0.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IVOq1djrOaeTxLiPySq6sN5l.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8jCBtnWc1Ir4FhlXpfJLJwbt.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\64W1FeA5ZnvYwrYyuSLeSK0I.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pY628AxjApG4YTXlrhGV8yw3.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KrG1uWAeN2xCX4UgIRWXMrz7.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NSz8C5FjEwzY7lc1l5tTf7Zu.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lWyBM6xzEYH8af3JtrgoGLji.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GDW6oyyvh1Tx5s2LyRfh47Sr.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qbR2nxvU5YfBQ02xmUe4NkXt.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ygAJfFrum1FZrl8um8F1ktaM.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZxCxof6FGyd7qDqEPzShgVDy.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bLqhYt9ogAh97MPkvppQVF9X.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\45euY0tWMStjkWwOBWZtGnI0.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\g36Pj4OeQfT5fsEy942pjuLB.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JttcrlpAPl4aOfhp8XC7VBXP.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VUJ1APavr4g9GBy9emLR2vwj.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\i8HshVgTCpXiQf6L29fDdtf2.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Me7XLDxydOOLg6FSpuWpJFuG.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2QWycgsKSAUaWcb234VluyVy.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XCcXtVNwlBCqsuRQM07uv7xU.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pY0QVnYhBROLQVS5oQrN5o7m.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fYZb9ShA44FqrsrhTi1y1tTz.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KfGswAZKZMHpZo4ArOFGPkJi.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gR0lGfIoDtFYzlUhRusWoKhW.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NAr5maBkVhXrAaU2xNYDG0Ni.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\H4NVC7ZwPA7tQJGraaH0GriF.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IHa5q36o0oDSI0oxRh2AwjiE.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rAqJNKgRVbKovSMY9qDHSj7d.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6isJJ7wloEiUNIFQIZCrGgvi.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ybfKR4xYXNZBwVs19w5NxNCx.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sg2B0JnlYsjOOp9PXVd15s2q.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d1fRvP84Ga9Br7ODiQTXn4vQ.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MMUVZxTIvuJIWYs0euk86qxA.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lDqIZHzEh5aA9T958bHHuayh.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4gIAsw31EaIKBtzY8UpjYqHc.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eWOYF1zwQp5lzVxU2fjmQUeK.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vNxTxhnF1jLDF3c3IhQ0ugBn.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t0VeReiJ2D1H7tlhX86CFX2V.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lN6EZkNxV3rXX2qxPicAYE9F.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MCYmcBRyIU8ux2QHjbZuxfqz.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ghLXR4xqE410iKbU3cBOmlGw.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CjdCWP2sC37ZrV3R6LwCpexO.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DAPdCitNhM6K85idSxzFsn9c.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\s1E2hy8nTgTiq969cqnOj6it.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f8MQunt0M68AqAW4zdwcL0Ui.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\79J3LANQWKbJF2lR4gqU68ES.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mmqKP8XD0uGxtV9TJKNqEzH1.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xYZ8ltMxDtErLgr3Gr6hsDwB.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\beH9MpS951FkEDtYIMOxB9PT.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xff4reuwezkTHOPHNgaOdMxG.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\J8yKUFyiGbt768ehGRwDyrcp.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nkgJlCpXnklvIZptbofXvweb.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\g3wuBpjd4YSwE1PpTVWpnQ2U.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OyeiCH3bPxPVxTNeTi5EUshF.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oheY3Go4pZ1wm0vIDukxGCTy.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0vVJWHdlOpVUJxV1xztDPHUw.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wO2nme35VyCy2jM8Jkkrv3aB.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XxBWkAwnJl3TYI8aDIgt8atT.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6EJHjgRIzjgBosA7d8ecDUNh.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\V3AtsmKWfYlu7Eug1wlWAH9h.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mVUYVq6R7ZMOQMgpxdxZp1O4.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RikxgyHSlngyCNkLljOoIea.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0J09ro90wH7cLZwlpWjZz8T8.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TrzJY4SdW5VqRT3oUgzb9jSd.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1txDsrfHbBgBylWpI2XKTXX2.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sCaMNwrALXlwWpSshXrS6cdu.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pSM2nuIFwq1STBoginT3tgcm.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K5EbMQs6xVELU0vVhpEDrOBd.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hJyo6w6bfQfja88teforIKdz.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9WqUvEngz5tu4Jus6UqDSeAH.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HcKDjXDeVjoAYG9oEwfQ5r7W.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xjfzmzWD1uQBqZzTdHA0H8BM.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OgJTlumfhkuuRPLFvr1On9vQ.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\viVdM1bZfxrDUfNurqYFq5oQ.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f6dPjqM04FFhKPYuWUTKufeU.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WHOE8wVBsC06cG3PMXZ41tA4.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hQMzrTDrEmEhlXEwSqkI11ka.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bmpPREy9jpg9Y5dahXR78j0C.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ly0vAWTAcIU5cged5BZiiVcK.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qCOpGIKJ0lXq2cvfLssuk720.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\562IOAurui1iMq5ZnURlELqJ.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tyRpv4Ym9bfSQFq5y44ZesRX.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\U1hx9WBnTHOidubdRJPbHA8j.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WFLbR91U37oILGhK1Q5GQNWV.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ugc0V90naF7CA7jLJhXrOwzq.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MXHxg7qBXVuJrgcu6doi4FNe.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kAkbE0p9XJOYqRS1e4Gf5Dm5.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TtdffhNnzdGUOw1Q6n3IszxI.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gN85yFjd6Vx1mOqdlrX804mt.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9EVhyPbJZWDMphgwa1d2iYKJ.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\E0t808UD5wPZCrXfVGxoO4mM.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l2ChmrDmSS97MQITbBWwabW2.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hDjwSDfdU2qJ2iM65plUxEZr.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zZ1vzBEdn1hKBDBvQgosimyo.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ikpPsIJMpIzBG9ZiRh1WNm6b.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qFVilIfcpozbs3MkwKHcvv8j.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JHyB8AKI6HCE6tGU3bnuI5r6.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zmt1Uz6FR5q2VJqcLQpvqgxZ.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKmDph5LIywjCE77xYaea19T.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0WOLhTTA42JINQ9Omh8xrRDx.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\26JlZQCiOjvgSz9otdXlHJBB.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oNve74NBPpA58KkAy4un9IhP.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uHxI55dS46eMPxqmwl14Uvsb.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7d8IogXL4FtHFodng5T2yNKJ.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\u3cUq3l4BLwzorw3WojT8R94.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BVuucCXc4ipTOaEN9UbIG06h.bat	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MCYmcBRyIU8ux2QHjbZuxfqz.bat

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MCYmcBRyIU8ux2QHjbZuxfqz.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ghLXR4xqE410iKbU3cBOmlGw.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CjdCWP2sC37ZrV3R6LwCpexO.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nkgJlCpXnklvIZptbofXvweb.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RikxgyHSlngyCNkLljOoIea.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mVUYVq6R7ZMOQMgpxdxZp1O4.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0J09ro90wH7cLZwlpWjZz8T8.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1txDsrfHbBgBylWpI2XKTXX2.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sCaMNwrALXlwWpSshXrS6cdu.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TrzJY4SdW5VqRT3oUgzb9jSd.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bmpPREy9jpg9Y5dahXR78j0C.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kAkbE0p9XJOYqRS1e4Gf5Dm5.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TtdffhNnzdGUOw1Q6n3IszxI.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gN85yFjd6Vx1mOqdlrX804mt.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\E0t808UD5wPZCrXfVGxoO4mM.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l2ChmrDmSS97MQITbBWwabW2.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hDjwSDfdU2qJ2iM65plUxEZr.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zZ1vzBEdn1hKBDBvQgosimyo.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKmDph5LIywjCE77xYaea19T.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0WOLhTTA42JINQ9Omh8xrRDx.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uHxI55dS46eMPxqmwl14Uvsb.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7d8IogXL4FtHFodng5T2yNKJ.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\u3cUq3l4BLwzorw3WojT8R94.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BVuucCXc4ipTOaEN9UbIG06h.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KfGswAZKZMHpZo4ArOFGPkJi.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NAr5maBkVhXrAaU2xNYDG0Ni.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6isJJ7wloEiUNIFQIZCrGgvi.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MMUVZxTIvuJIWYs0euk86qxA.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\79J3LANQWKbJF2lR4gqU68ES.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\beH9MpS951FkEDtYIMOxB9PT.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OyeiCH3bPxPVxTNeTi5EUshF.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\J8yKUFyiGbt768ehGRwDyrcp.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XxBWkAwnJl3TYI8aDIgt8atT.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\V3AtsmKWfYlu7Eug1wlWAH9h.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hJyo6w6bfQfja88teforIKdz.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OgJTlumfhkuuRPLFvr1On9vQ.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\562IOAurui1iMq5ZnURlELqJ.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ugc0V90naF7CA7jLJhXrOwzq.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JHyB8AKI6HCE6tGU3bnuI5r6.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\26JlZQCiOjvgSz9otdXlHJBB.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oNve74NBPpA58KkAy4un9IhP.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JttcrlpAPl4aOfhp8XC7VBXP.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\i8HshVgTCpXiQf6L29fDdtf2.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Me7XLDxydOOLg6FSpuWpJFuG.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pY0QVnYhBROLQVS5oQrN5o7m.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IHa5q36o0oDSI0oxRh2AwjiE.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gR0lGfIoDtFYzlUhRusWoKhW.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ybfKR4xYXNZBwVs19w5NxNCx.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lDqIZHzEh5aA9T958bHHuayh.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sg2B0JnlYsjOOp9PXVd15s2q.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vNxTxhnF1jLDF3c3IhQ0ugBn.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lN6EZkNxV3rXX2qxPicAYE9F.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\s1E2hy8nTgTiq969cqnOj6it.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mmqKP8XD0uGxtV9TJKNqEzH1.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xff4reuwezkTHOPHNgaOdMxG.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oheY3Go4pZ1wm0vIDukxGCTy.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0vVJWHdlOpVUJxV1xztDPHUw.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9WqUvEngz5tu4Jus6UqDSeAH.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HcKDjXDeVjoAYG9oEwfQ5r7W.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\viVdM1bZfxrDUfNurqYFq5oQ.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f6dPjqM04FFhKPYuWUTKufeU.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ly0vAWTAcIU5cged5BZiiVcK.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hQMzrTDrEmEhlXEwSqkI11ka.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tyRpv4Ym9bfSQFq5y44ZesRX.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MXHxg7qBXVuJrgcu6doi4FNe.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9EVhyPbJZWDMphgwa1d2iYKJ.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ikpPsIJMpIzBG9ZiRh1WNm6b.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qFVilIfcpozbs3MkwKHcvv8j.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zmt1Uz6FR5q2VJqcLQpvqgxZ.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pY628AxjApG4YTXlrhGV8yw3.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NSz8C5FjEwzY7lc1l5tTf7Zu.bat
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GDW6oyyvh1Tx5s2LyRfh47Sr.bat

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

15_2_00416240

Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\BroomSetup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\dZhcoTSgym1JGRiEQOUqAdeo.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Pictures\dZhcoTSgym1JGRiEQOUqAdeo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\dZhcoTSgym1JGRiEQOUqAdeo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\dZhcoTSgym1JGRiEQOUqAdeo.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\rfKusEcfqkKKVyx19jVITYlO.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Pictures\rfKusEcfqkKKVyx19jVITYlO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\rfKusEcfqkKKVyx19jVITYlO.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\rfKusEcfqkKKVyx19jVITYlO.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\mxmsi31bOIKdEb9VIHBYJshQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\jLh2jXNiKaCQ93A91IuQMDiC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\VF98zhY4QVhDxJpNtAE2TU6d.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\Pictures\VF98zhY4QVhDxJpNtAE2TU6d.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\VF98zhY4QVhDxJpNtAE2TU6d.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\VF98zhY4QVhDxJpNtAE2TU6d.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_15-23384

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003690000.00000004.00001000.00020000.00000000.sdmp, VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: RTP.EXESYSTEMROOT=SETFILETIMESIGNWRITINGSOFT_DOTTEDSYSTEMDRIVETTL EXPIREDUNINSTALLERVBOXSERVICEVMUSRVC.EXEVARIANTINITVIRTUALFREEVIRTUALLOCKWSARECVFROMWARANG_CITIWHITE_SPACEWINDEFENDER[:^XDIGIT:]\DSEFIX.EXEADDITIONALSALARM CLOCKAPPLICATIONASSISTQUEUEAUTHORITIESBAD ADDRESSBAD ARGSIZEBAD M VALUEBAD MESSAGEBAD TIMEDIVBITCOINS.SKBROKEN PIPECAMPAIGN_IDCGOCALL NILCLOBBERFREECLOSESOCKETCOMBASE.DLLCREATED BY CRYPT32.DLLE2.KEFF.ORGEMBEDDED/%SEXTERNAL IPFILE EXISTSFINAL TOKENFLOAT32NAN2FLOAT64NAN1FLOAT64NAN2FLOAT64NAN3GCCHECKMARKGENERALIZEDGET CDN: %WGETPEERNAMEGETSOCKNAMEGLOBALALLOCHTTP2CLIENTHTTP2SERVERHTTPS_PROXYI/O TIMEOUTLOCAL ERRORMSPANMANUALMETHODARGS(MINTRIGGER=MOVE %S: %WMSWSOCK.DLLNETPOLLINITNEXT SERVERNIL CONTEXTOPERA-PROXYORANNIS.COMOUT OF SYNCPARSE ERRORPROCESS: %SREFLECT.SETREFLECTOFFSRETRY-AFTERRUNTIME: P RUNTIME: G RUNTIME: P SCHEDDETAILSECHOST.DLLSECUR32.DLLSERVICE: %SSHELL32.DLLSHORT WRITESTACK TRACESTART PROXYTASKMGR.EXETLS: ALERT(TRACEALLOC(TRAFFIC UPDUNREACHABLEUSERENV.DLLVERSION.DLLVERSION=195WININET.DLLWUP_PROCESS (SENSITIVE) B (
Source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003690000.00000004.00001000.00020000.00000000.sdmp, VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: TOO MANY LINKSTOO MANY USERSTORRC FILENAMEUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERUSERARENASTATEVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WINDOW CREATEDWORK.FULL != 0XENSERVICE.EXEZERO PARAMETER WITH GC PROG
Source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003690000.00000004.00001000.00020000.00000000.sdmp, VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: ... OMITTING ACCEPT-CHARSETAFTER EFIGUARDALLOCFREETRACEBAD ALLOCCOUNTBAD RECORD MACBAD RESTART PCBAD SPAN STATEBTC.USEBSV.COMCERT INSTALLEDCHECKSUM ERRORCONTENT-LENGTHCOULDN'T PATCHDATA TRUNCATEDDISTRIBUTOR_IDDRIVER REMOVEDERROR RESPONSEFILE TOO LARGEFINALIZER WAITGCSTOPTHEWORLDGET UPTIME: %WGETPROTOBYNAMEGOT SYSTEM PIDINITIAL SERVERINTERNAL ERRORINVALID SYNTAXIS A DIRECTORYKEY SIZE WRONGLEVEL 2 HALTEDLEVEL 3 HALTEDMEMPROFILERATEMULTIPARTFILESNEED MORE DATANIL ELEM TYPE!NO MODULE DATANO SUCH DEVICEOPEN EVENT: %WPARSE CERT: %WPROTOCOL ERRORREAD CERTS: %WREAD_FRAME_EOFREFLECT.VALUE.REMOVE APP: %WRUNTIME: FULL=RUNTIME: WANT=S.ALLOCCOUNT= SEMAROOT QUEUESERVER.VERSIONSTACK OVERFLOWSTART TASK: %WSTOPM SPINNINGSTORE64 FAILEDSYNC.COND.WAITTEXT FILE BUSYTIME.LOCATION(TIMEENDPERIODTOO MANY LINKSTOO MANY USERSTORRC FILENAMEUNEXPECTED EOFUNKNOWN CODE: UNKNOWN ERROR UNKNOWN METHODUNKNOWN MODE: UNREACHABLE: UNSAFE.POINTERUSERARENASTATEVIRTUALBOX: %WVMWARETRAY.EXEVMWAREUSER.EXEWII LIBNUP/1.0WINAPI ERROR #WINDOW CREATEDWORK.FULL != 0XENSERVICE.EXEZERO PARAMETER WITH GC PROG

Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Memory allocated: 28B2BC60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Memory allocated: 28B45530000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 2960000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 2E30000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 4E30000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 7370000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 8370000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 84F0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 94F0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 97F0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: A7F0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 84F0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: BBF0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: CBF0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 7BF0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 81F0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 91F0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: A1F0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: B9F0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: C9F0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Memory allocated: 91F0000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599502
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599375
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599265
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598995
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598839
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598592
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598476
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598374
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597779
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597642
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597422
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596866
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596766
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596537
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596232
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596086
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595682
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595533
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 300000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 592828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 592485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 592156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 591688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 591266
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 590672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 590141
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 589750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 589219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 588781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 588438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 588031
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 587563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 587156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 586172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 583953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 583391
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 582825
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 582422
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 582063
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 581641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 581063
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 580656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 580357
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 580046
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 579654
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 579054
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 578632
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 578387
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 578054
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 577765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 577421
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 577124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 576655
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 576258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 575885
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 575374
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 574921
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 574499
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 573876
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 573459
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 572938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 572429
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 571816
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 571261
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 570870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 570276
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 569410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 564751
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 562369
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 560882
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 558422
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 558189
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 557608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 556800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 555955
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 554792
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 554433
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 553979
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 553729
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 553605
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 553450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 553172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 552969
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 552797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 552668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 552539
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 552365
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 552239
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 552108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 551996
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 551880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 551690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 551525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 551403
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 548777
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 548456
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 548126
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 547981
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 547797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 547653
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 547490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 547364
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 547243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 547095
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 546949
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 546767
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 546640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 546505
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 546332
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 546122
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 545952
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 545754
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 545562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 545388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 545190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 545018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 544854
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 544662
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 544469
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 544286
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 543968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 543770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 543564
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 543330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 543192
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 542998
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 542820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 542630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 542438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 542283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 542104
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 541899
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 541642
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 541445
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 541218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 541044
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 540831
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 540694
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 540373
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 540169
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 539984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 539798
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 539496
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 539241
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 538992
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 538769
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 538484
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 538215
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 537992
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 537800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 537671
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 537418
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 537185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 537002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 536740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 536488
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 536280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 536094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 535874
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 535699
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 535494
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 535258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 535102
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 534938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 534779
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 534622
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 534408
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 534220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 534049
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 533620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 532975
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 532682
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 532455
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 532291
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 532103
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 531902
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 531741
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 531583
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 531370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 531188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 530852
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 530712
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 530587
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 530460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 530343
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 530178
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 529975
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 529801
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 529679
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 529543
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 529424
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 529202
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 528954
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 528777
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 528594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 528448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 528137
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 527981
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 527839
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 527683
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 527493
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 527349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 527224
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 527058
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 526890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 526668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 526471
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 526343
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 526148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 525994
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 525485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 525184
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 524983
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 524410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 524168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 523772
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 523393
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 523111
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 522738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 522181
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 521737
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 521386
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 521042
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 520685
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 520366
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 519734
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 519248
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 518358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 517845
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 516778
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 516037
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 515112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 514403
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 514075
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 513519
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 512975
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 512395
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 511840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 511386
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 510854
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 510465
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 510120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 509761
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 509368
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 509037
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 508726
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 508388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 507953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 507585
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 507249
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 506926
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 506566
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 506374
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 506160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 505995
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 505868
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 505760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 505620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 505422
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 505275
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 505162
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 504939
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 504794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 504679
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 504499
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 504386
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 504250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 504124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 504013
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 503903
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 503763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 503649
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 503494
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 503364
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 503244
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 503133
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 503014
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 502889
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 502769
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 502591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 502472
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 502346
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 502133
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 502025
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 501851
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 501738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 501609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 501501
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 501375
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 501173
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 500880

Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Window / User API: threadDelayed 505	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Window / User API: threadDelayed 4808	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6429	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Window / User API: threadDelayed 7478

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\4cq2SZqMHS3XYqkYi9qoDSje.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\4oOqWbJEImqDRLxD75xKRNjm.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Opera_108.0.5067.24_Autoupdate_x64[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\nU8NHI9fYTvNPbiYhk76Vc0l.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\y4lq5SHqKAOV4kY1xCRGbtJI.exe	Jump to dropped file
Source: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211042526911280.dll	Jump to dropped file
Source: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043726914020.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\GzgoX5V54ke4dVGjS16ex045.exe	Jump to dropped file
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsvA4F1.tmp\INetC.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\MW0Q5IkKXdDw9nrX6CojJx9n.exe	Jump to dropped file
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043920313116.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Ledger-Live[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\eqwQ4v4W79HQtYChIL8CXQJj.exe	Jump to dropped file
Source: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403121205051\opera_package	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\7mP2uTTqqwYXFx3CixL6JUmx.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\fDVyGnt4qkfC1RQX2yjdlha8.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\HFiFGl6AR63OLnORhPPDiWeA.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\rMuSSyE2z14xNxfrVLVv1kvs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043944414548.dll	Jump to dropped file
Source: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403121204471\opera_package	Jump to dropped file
Source: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043867714488.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\C2ytbpXjpVGZQltGJ6eXiuhX.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\sP3BgFXaLWMMa0a6kgrVZ5A3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\IIEHCFIDHI.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\u118vbhgpAsB1DCQ91pKfLua.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Ge2xGCQPLJT2DzNk3YNjEyuZ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211042869310536.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\jx4EXQWaWISJJqVjnXD4Dqaz.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211044129216532.dll	Jump to dropped file
Source: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Opera_108.0.5067.24_Autoupdate_x64[2].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\OHK6a4WIJ0F6rlhWGJwMYrRP.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\leLskzRZPIglQflslvTIwLTy.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\dghB8AfRudM2FLzl5fgKHzMA.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\nrklq6P1CNvXZbzoZhiYO66H.exe	Jump to dropped file
Source: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043773814148.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\CmAp0DxyhTEj5GF5fAGFiA38.exe	Jump to dropped file
Source: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043401411604.dll	Jump to dropped file
Source: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043820413232.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\S9FRoySbKySnaEAuJOzqToi9.exe	Jump to dropped file
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403121204571\opera_package	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\l4uKqmU2WFXWkMNLmByrfqyU.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\kujNjTMPu36kPLMvqPBbpIku.exe	Jump to dropped file
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_2403121104234259124.dll	Jump to dropped file
Source: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Opera_108.0.5067.24_Autoupdate_x64[3].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\EwzOUe6vEjttYfeygpeUfeHd.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\SgphKg63629U7dMJ7gswdhRB.exe	Jump to dropped file
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043017611524.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\lPSfsxgFucUyDCrXpMn2ucYq.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\B8Lqzc0h0CXWQep40oCdtIvu.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\xwluxp5OZq2fzKcnUhKN90Gy.exe	Jump to dropped file
Source: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Opera_installer_24031211045859715840.dll	Jump to dropped file

Source: C:\Users\user\Desktop\3SqWYf8qFi.exe TID: 7228	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe TID: 7228	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe TID: 7228	Thread sleep time: -99871s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe TID: 7228	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe TID: 7228	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe TID: 7228	Thread sleep time: -99546s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe TID: 7228	Thread sleep time: -99435s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe TID: 7228	Thread sleep time: -99316s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe TID: 7228	Thread sleep time: -99078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe TID: 7228	Thread sleep time: -98953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe TID: 7228	Thread sleep time: -98839s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe TID: 7228	Thread sleep time: -98727s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe TID: 7228	Thread sleep time: -98609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe TID: 7228	Thread sleep time: -98448s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe TID: 7228	Thread sleep time: -98326s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe TID: 7228	Thread sleep time: -98218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe TID: 7228	Thread sleep time: -98078s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8104	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7384	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 43984	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8360	Thread sleep count: 7478 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -599781s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -599640s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -599502s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -599375s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -599265s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -599154s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -598995s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -598839s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -598719s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -598592s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -598476s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -598374s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -598280s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -598094s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -597938s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -597779s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -597642s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -597422s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -597219s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -597000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -596866s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -596766s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -596537s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -596360s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -596232s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -596086s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -595891s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -595682s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -595533s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -595297s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -594953s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 43984	Thread sleep time: -1800000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -594610s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -594188s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -593828s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -593485s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -593156s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -592828s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -592485s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -592156s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -591688s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -591266s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -590672s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -590141s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -589750s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -589219s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -588781s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -588438s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -588031s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -587563s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -587156s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -586172s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -583953s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -583391s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -582825s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -582422s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -582063s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -581641s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -581063s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -580656s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -580357s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -580046s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -579654s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -579054s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -578632s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -578387s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -578054s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -577765s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -577421s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -577124s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -576655s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -576258s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -575885s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -575374s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -574921s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -574499s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -573876s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -573459s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -572938s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -572429s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -571816s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -571261s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -570870s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -570276s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -569410s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -564751s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -562369s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -560882s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -558422s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -558189s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -557608s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -556800s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -555955s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -554792s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -554433s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -553979s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -553729s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -553605s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -553450s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -553172s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -552969s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -552797s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -552668s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -552539s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -552365s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -552239s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -552108s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -551996s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -551880s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -551690s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -551525s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -551403s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -548777s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -548456s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -548126s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -547981s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -547797s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -547653s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -547490s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -547364s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -547243s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -547095s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -546949s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -546767s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -546640s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -546505s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -546332s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -546122s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -545952s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -545754s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -545562s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -545388s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -545190s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -545018s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -544854s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -544662s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -544469s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -544286s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -543968s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -543770s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -543564s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -543330s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -543192s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -542998s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -542820s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -542630s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -542438s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -542283s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -542104s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -541899s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -541642s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -541445s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -541218s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -541044s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -540831s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -540694s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -540373s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -540169s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -539984s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -539798s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -539496s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -539241s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -538992s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -538769s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -538484s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -538215s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -537992s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -537800s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -537671s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -537418s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -537185s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -537002s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -536740s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -536488s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -536280s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -536094s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -535874s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -535699s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -535494s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -535258s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -535102s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -534938s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -534779s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -534622s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -534408s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -534220s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -534049s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -533620s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -532975s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -532682s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -532455s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -532291s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -532103s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -531902s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -531741s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -531583s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -531370s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -531188s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -530852s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -530712s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -530587s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -530460s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -530343s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -530178s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -529975s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -529801s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -529679s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -529543s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -529424s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -529202s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -528954s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -528777s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -528594s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -528448s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -528137s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -527981s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -527839s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -527683s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -527493s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -527349s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -527224s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -527058s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -526890s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -526668s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -526471s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -526343s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -526148s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -525994s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -525485s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -525184s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -524983s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -524410s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -524168s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -523772s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -523393s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -523111s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -522738s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -522181s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -521737s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -521386s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -521042s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -520685s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -520366s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -519734s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -519248s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -518358s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -517845s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -516778s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -516037s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -515112s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -514403s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -514075s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -513519s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -512975s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -512395s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -511840s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -511386s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -510854s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -510465s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -510120s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -509761s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -509368s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -509037s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -508726s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -508388s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -507953s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -507585s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -507249s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -506926s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -506566s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -506374s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -506160s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -505995s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -505868s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -505760s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -505620s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -505422s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -505275s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -505162s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -504939s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -504794s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -504679s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -504499s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -504386s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -504250s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -504124s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -504013s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -503903s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -503763s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -503649s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -503494s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -503364s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -503244s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -503133s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -503014s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -502889s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -502769s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -502591s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -502472s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -502346s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -502133s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -502025s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -501851s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -501738s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -501609s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -501501s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -501375s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -501173s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe TID: 8092	Thread sleep time: -500880s >= -30000s

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Last function: Thread delayed

Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	File Volume queried: C:\Users\user\Desktop FullSizeInformation
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	File Volume queried: C:\Users\user\Desktop FullSizeInformation
Source: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe	File Volume queried: C:\Users\user\Desktop FullSizeInformation
Source: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe	File Volume queried: C:\Users\user\Desktop FullSizeInformation
Source: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe	File Volume queried: C:\Users\user\Desktop FullSizeInformation
Source: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe	File Volume queried: C:\Users\user\Desktop FullSizeInformation

Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_00408123 FindFirstFileA,FindClose,	10_2_00408123
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_004085B8 DeleteFileA,DeleteFileA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	10_2_004085B8
Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe	Code function: 10_2_0040342B FindFirstFileA,	10_2_0040342B
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00412570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_00412570
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_0040D1C0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	15_2_0040D1C0
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_004015C0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_004015C0
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00411650 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	15_2_00411650
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_0040B610 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	15_2_0040B610
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_0040DB60 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	15_2_0040DB60
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00411B80 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	15_2_00411B80
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_0040D540 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_0040D540
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_004121F0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	15_2_004121F0
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006AB877 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	15_2_006AB877
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006B2457 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	15_2_006B2457
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006A1827 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_006A1827
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006AD427 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	15_2_006AD427
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006B18B7 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	15_2_006B18B7
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006B1DE7 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	15_2_006B1DE7
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006ADDC7 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	15_2_006ADDC7
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006B27D7 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_006B27D7
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006AD7A7 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	15_2_006AD7A7
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: 31_1_001CCF22 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	31_1_001CCF22

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

Code function: 15_2_00401120 GetSystemInfo,ExitProcess,

15_2_00401120

Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Thread delayed: delay time: 99871	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Thread delayed: delay time: 99546	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Thread delayed: delay time: 99435	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Thread delayed: delay time: 99316	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Thread delayed: delay time: 99078	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Thread delayed: delay time: 98953	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Thread delayed: delay time: 98839	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Thread delayed: delay time: 98727	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Thread delayed: delay time: 98609	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Thread delayed: delay time: 98448	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Thread delayed: delay time: 98326	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Thread delayed: delay time: 98218	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Thread delayed: delay time: 98078	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599502
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599375
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599265
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 599154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598995
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598839
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598592
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598476
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598374
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 598094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597779
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597642
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597422
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 597000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596866
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596766
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596537
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596360
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596232
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 596086
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595891
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595682
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595533
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 595297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 300000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 594188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 593156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 592828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 592485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 592156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 591688
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 591266
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 590672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 590141
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 589750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 589219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 588781
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 588438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 588031
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 587563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 587156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 586172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 583953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 583391
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 582825
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 582422
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 582063
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 581641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 581063
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 580656
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 580357
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 580046
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 579654
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 579054
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 578632
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 578387
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 578054
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 577765
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 577421
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 577124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 576655
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 576258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 575885
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 575374
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 574921
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 574499
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 573876
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 573459
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 572938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 572429
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 571816
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 571261
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 570870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 570276
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 569410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 564751
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 562369
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 560882
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 558422
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 558189
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 557608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 556800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 555955
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 554792
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 554433
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 553979
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 553729
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 553605
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 553450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 553172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 552969
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 552797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 552668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 552539
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 552365
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 552239
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 552108
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 551996
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 551880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 551690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 551525
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 551403
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 548777
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 548456
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 548126
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 547981
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 547797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 547653
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 547490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 547364
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 547243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 547095
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 546949
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 546767
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 546640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 546505
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 546332
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 546122
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 545952
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 545754
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 545562
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 545388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 545190
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 545018
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 544854
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 544662
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 544469
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 544286
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 543968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 543770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 543564
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 543330
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 543192
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 542998
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 542820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 542630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 542438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 542283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 542104
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 541899
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 541642
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 541445
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 541218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 541044
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 540831
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 540694
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 540373
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 540169
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 539984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 539798
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 539496
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 539241
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 538992
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 538769
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 538484
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 538215
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 537992
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 537800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 537671
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 537418
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 537185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 537002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 536740
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 536488
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 536280
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 536094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 535874
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 535699
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 535494
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 535258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 535102
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 534938
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 534779
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 534622
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 534408
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 534220
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 534049
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 533620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 532975
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 532682
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 532455
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 532291
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 532103
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 531902
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 531741
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 531583
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 531370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 531188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 530852
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 530712
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 530587
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 530460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 530343
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 530178
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 529975
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 529801
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 529679
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 529543
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 529424
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 529202
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 528954
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 528777
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 528594
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 528448
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 528137
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 527981
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 527839
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 527683
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 527493
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 527349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 527224
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 527058
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 526890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 526668
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 526471
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 526343
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 526148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 525994
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 525485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 525184
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 524983
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 524410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 524168
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 523772
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 523393
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 523111
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 522738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 522181
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 521737
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 521386
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 521042
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 520685
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 520366
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 519734
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 519248
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 518358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 517845
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 516778
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 516037
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 515112
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 514403
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 514075
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 513519
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 512975
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 512395
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 511840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 511386
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 510854
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 510465
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 510120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 509761
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 509368
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 509037
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 508726
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 508388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 507953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 507585
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 507249
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 506926
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 506566
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 506374
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 506160
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 505995
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 505868
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 505760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 505620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 505422
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 505275
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 505162
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 504939
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 504794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 504679
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 504499
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 504386
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 504250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 504124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 504013
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 503903
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 503763
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 503649
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 503494
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 503364
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 503244
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 503133
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 503014
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 502889
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 502769
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 502591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 502472
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 502346
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 502133
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 502025
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 501851
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 501738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 501609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 501501
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 501375
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 501173
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Thread delayed: delay time: 500880

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: ... omitting accept-charsetafter EfiGuardallocfreetracebad allocCountbad record MACbad restart PCbad span statebtc.usebsv.comcert installedchecksum errorcontent-lengthcouldn't patchdata truncateddistributor_iddriver removederror responsefile too largefinalizer waitgcstoptheworldget uptime: %wgetprotobynamegot system PIDinitial serverinternal errorinvalid syntaxis a directorykey size wronglevel 2 haltedlevel 3 haltedmemprofileratemultipartfilesneed more datanil elem type!no module datano such deviceopen event: %wparse cert: %wprotocol errorread certs: %wread_frame_eofreflect.Value.remove app: %wruntime: full=runtime: want=s.allocCount= semaRoot queueserver.versionstack overflowstart task: %wstopm spinningstore64 failedsync.Cond.Waittext file busytime.Location(timeEndPeriodtoo many linkstoo many userstorrc filenameunexpected EOFunknown code: unknown error unknown methodunknown mode: unreachable: unsafe.PointeruserArenaStatevirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #window createdwork.full != 0xenservice.exezero parameter with GC prog
Source: VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: RTP.exeSYSTEMROOT=SetFileTimeSignWritingSoft_DottedSystemDriveTTL expiredUninstallerVBoxServiceVMUSrvc.exeVariantInitVirtualFreeVirtualLockWSARecvFromWarang_CitiWhite_SpaceWinDefender[:^xdigit:]\dsefix.exeadditionalsalarm clockapplicationassistQueueauthoritiesbad addressbad argSizebad m valuebad messagebad timedivbitcoins.skbroken pipecampaign_idcgocall nilclobberfreeclosesocketcombase.dllcreated by crypt32.dlle2.keff.orgembedded/%sexternal IPfile existsfinal tokenfloat32nan2float64nan1float64nan2float64nan3gccheckmarkgeneralizedget CDN: %wgetpeernamegetsocknameglobalAllochttp2clienthttp2serverhttps_proxyi/o timeoutlocal errormSpanManualmethodargs(minTrigger=move %s: %wmswsock.dllnetpollInitnext servernil contextopera-proxyorannis.comout of syncparse errorprocess: %sreflect.SetreflectOffsretry-afterruntime: P runtime: g runtime: p scheddetailsechost.dllsecur32.dllservice: %sshell32.dllshort writestack tracestart proxytaskmgr.exetls: alert(tracealloc(traffic updunreachableuserenv.dllversion.dllversion=195wininet.dllwup_process (sensitive) B (
Source: VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: entersyscallexit status failed to %wfound av: %sgcBitsArenasgcpacertracegetaddrinfowgot TI tokenguid_machineharddecommithost is downhttp2debug=1http2debug=2illegal seekinjector.exeinstall_dateinvalid baseinvalid pathinvalid portinvalid slotiphlpapi.dllkernel32.dllmachine_guidmadvdontneedmax-forwardsmheapSpecialmsftedit.dllmspanSpecialnetapi32.dllno such hostnon-existentnot pollableoleaut32.dllout of rangeparse PE: %wproxyconnectrandautoseedrecv_goaway_reflect.Copyreleasep: m=remote errorremoving appruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptsetupapi.dllshort bufferspanSetSpinesweepWaiterstraceStringstraffic/readtransmitfileulrichard.chunexpected )unknown portunknown typevmacthlp.exevmtoolsd.exewatchdog.exewinlogon.exewintrust.dllwirep: p->m=worker mode wtsapi32.dll != sweepgen (default %q) (default %v) MB globals, MB) workers= called from flushedWork idlethreads= in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= %s/rawaddr/%s%s\%s\drivers, gp->status=, not pointer-bind-address-byte block (3814697265625: unknown pc Accept-RangesAuthorizationCLIENT_RANDOMCONNECTION-IDCONNECT_ERRORCache-ControlCertOpenStoreCoTaskMemFreeConnectServerContent-RangeDONT-FRAGMENTDeleteServiceDestroyWindowDistributorIDECDSAWithSHA1EnumProcessesExitWindowsExFQDN too longFindFirstFileFindNextFileWFindResourceWFreeAddrInfoWGC sweep waitGeoIPFile %s
Source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003690000.00000004.00001000.00020000.00000000.sdmp, VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: DnsRecordListFreeENHANCE_YOUR_CALMEnumThreadWindowsFLE Standard TimeFailed DependencyGC assist markingGMT Standard TimeGTB Standard TimeGetCurrentProcessGetShortPathNameWHEADER_TABLE_SIZEHKEY_CLASSES_ROOTHKEY_CURRENT_USERHTTP_1_1_REQUIREDIf-Modified-SinceIsTokenRestrictedLookupAccountSidWMESSAGE-INTEGRITYMoved PermanentlyOld_North_ArabianOld_South_ArabianOther_ID_ContinuePython-urllib/2.5QueryWorkingSetExRESERVATION-TOKENReadProcessMemoryRegLoadMUIStringWRtlGetCurrentPebSafeArrayCopyDataSafeArrayCreateExSentence_TerminalSysAllocStringLenSystemFunction036Too Many RequestsTransfer-EncodingUnexpected escapeUnified_IdeographUnknown AttributeVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseWrong CredentialsX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDN
Source: VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: IP addressIsValidSidKeep-AliveKharoshthiLocalAllocLockFileExLogonUserWManichaeanMessage-IdNo ContentOld_ItalicOld_PermicOld_TurkicOpenEventWOpenMutexWOpenThreadOther_MathPOSTALCODEParseAddr(ParseFloatPhoenicianProcessingPulseEventRIPEMD-160RST_STREAMResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSecureBootSet-CookieShowWindowTor uptimeUser-AgentVMSrvc.exeWSACleanupWSASocketWWSAStartupWget/1.9.1Windows 10Windows 11[:^alnum:][:^alpha:][:^ascii:][:^blank:][:^cntrl:][:^digit:][:^graph:][:^lower:][:^print:][:^punct:][:^space:][:^upper:][:xdigit:]\\.\WinMon\patch.exe^{[\w-]+}$app_%d.txtatomicand8attr%d=%s cmd is nilcomplex128connectiondebug calldnsapi.dlldsefix.exedwmapi.dlle.keff.orgexecerrdotexitThreadexp masterfloat32nanfloat64nangetsockoptgoroutine http_proxyimage/avifimage/jpegimage/webpimpossibleindicationinvalid IPinvalidptrkeep-alivemSpanInUsemyhostnameno resultsnot a boolnot signednotifyListowner diedpowershellprl_cc.exeprofInsertres binderres masterresumptionrune <nil>runtime: gs.state = schedtracesemacquiresend stateset-cookiesetsockoptskipping: socks bindstackLarget.Kind == terminatedtext/plaintime.Date(time.Localtracefree(tracegc()
Source: VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: GetActiveObjectGetAdaptersInfoGetCommTimeoutsGetCommandLineWGetFirmwareTypeGetProcessTimesGetSecurityInfoGetStartupInfoWGlobal\qtxp9g8wHanifi_RohingyaICE-CONTROLLINGIdempotency-KeyImpersonateSelfInstall failureIsWindowUnicodeIsWindowVisibleIsWow64Process2Length RequiredLoadLibraryExALoadLibraryExWNot ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512Partial ContentPostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockScheduledUpdateSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUnescaped quoteUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
Source: 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2423165911.0000000000C17000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2382378174.0000000000C17000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2391593565.0000000000C17000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2363415183.0000000000C17000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW{
Source: VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: acceptactivechan<-closedcookiedirectdomainefenceempty exec: expectfamilygeoip6gopherhangupheaderinternip+netkilledlistenminutenetdnsnumberobjectoriginpopcntrdtscpreadatreasonremoverenamereturnrun-v3rune1 secondselectsendtoserversocketsocks socks5statusstringstructsweep sysmontelnettimersuint16uint32uint64unuseduptimevmhgfsvmxnetvpc-s3wup_hsxennetxensvcxenvdb %v=%v, (conn) (scan (scan) MB in Value> allocs dying= flags= len=%d locks= m->g0= nmsys= pad1= pad2= s=nil
Source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003690000.00000004.00001000.00020000.00000000.sdmp, VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: SafeArrayCopyDataSafeArrayCreateExSentence_TerminalSysAllocStringLenSystemFunction036Too Many RequestsTransfer-EncodingUnexpected escapeUnified_IdeographUnknown AttributeVGAuthService.exeWSAEnumProtocolsWWTSQueryUserTokenWrite after CloseWrong CredentialsX-Idempotency-Key\System32\drivers\\.\VBoxMiniRdrDN
Source: VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: (MISSING)(unknown), newval=, oldval=, size = , tail = -07:00:00/api/cdn?/api/poll127.0.0.1244140625: status=AuthorityBassa_VahBhaiksukiClassINETCuneiformDiacriticEVEN-PORTExecQueryFindCloseForbiddenGetDIBitsHex_DigitInheritedInstMatchInstRune1InterfaceKhudawadiLocalFreeMalayalamMongolianMoveFileWNabataeanNot FoundOP_RETURNOSCaptionPalmyreneParseUintPatchTimePublisherReleaseDCRemoveAllSTUN addrSamaritanSee OtherSeptemberSundaneseSysnativeToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUse ProxyVBoxGuestVBoxMouseVBoxVideoWSASendToWednesdayWindows 7WriteFileZ07:00:00[%v = %d][:^word:][:alnum:][:alpha:][:ascii:][:blank:][:cntrl:][:digit:][:graph:][:lower:][:print:][:punct:][:space:][:upper:]_outboundatomicor8attributeb.ooze.ccbad indirbus errorchallengechan sendcomplex64connectexcopystackcsrss.exectxt != 0d.nx != 0dns,filesecdsa.netempty urlfiles,dnsfn.48.orgfodhelperfork/execfuncargs(gdi32.dllhchanLeafimage/gifimage/pnginittraceinterfaceinterruptinvalid nipv6-icmplocalhostmSpanDeadnew tokennil errorntdll.dllole32.dllomitemptyop_returnpanicwaitpatch.exepclmulqdqpreemptedprintableprofBlockprotocol proxy.exepsapi.dllquestionsreboot inrecover: reflect: rwxrwxrwxscavtracestackpoolsucceededtask %+v
Source: VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: VirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dll
Source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003690000.00000004.00001000.00020000.00000000.sdmp, VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: ><'\'') = ) m=+Inf-Inf.bat.cmd.com.css.exe.gif.htm.jpg.mjs.pdf.png.svg.sys.xml0x%x1.1110803125: p=ACDTACSTAEDTAESTAKDTAKSTAWSTAhomAtoiCDN=CESTChamDATADashDataDateEESTEULAEtagFromGOGCGoneHostJulyJuneLEAFLisuMiaoModiNZDTNZSTNameNewaPINGPOSTPathQEMUROOTSASTSTARSendStatTempThaiTypeUUID"%s"\rss\smb\u00
Source: zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2379585399.00000000010A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWVE
Source: vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000003.1920722672.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp, syncUpd.exe, 0000000F.00000002.2877720615.000000000086E000.00000004.00000020.00020000.00000000.sdmp, syncUpd.exe, 0000000F.00000003.2281435291.000000000089F000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2387931999.0000000000F11000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410615687.0000000000E48000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410715389.0000000000F11000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2364591268.0000000000F11000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001666000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: too many linkstoo many userstorrc filenameunexpected EOFunknown code: unknown error unknown methodunknown mode: unreachable: unsafe.PointeruserArenaStatevirtualbox: %wvmwaretray.exevmwareuser.exewii libnup/1.0winapi error #window createdwork.full != 0xenservice.exezero parameter with GC prog
Source: vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: tracebackunderflowunhandleduninstallunzip Torunzip: %wurn:uuid:w3m/0.5.1wbufSpanswebsocketxenevtchn} stack=[ netGo = MB goal, flushGen for type gfreecnt= heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= stream=%d sweepgen sweepgen= targetpc= throwing= until pc=%!(NOVERB)%!Weekday(%s.uuid.%s%s\|%s%s\|%s(BADINDEX), bound = , limit = -noprofile-uninstall.localhost/dev/stdin/etc/hosts/show-eula12207031256103515625: parsing :authorityAdditionalBad varintCampaignIDCancelIoExChorasmianClassCHAOSClassCSNETConnectionContent-IdCreateFileCreatePipeDSA-SHA256DeprecatedDevanagariDnsQuery_WECDSA-SHA1END_STREAMERROR-CODEException GC forced
Source: VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: Not ImplementedNtSuspendThreadOpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512Partial ContentPostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWRegCreateKeyExWRegDeleteValueWRequest TimeoutRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockScheduledUpdateSetCommTimeoutsSetSecurityInfoSetVolumeLabelWShellExecuteExWStringFromCLSIDStringFromGUID2TerminateThreadUnescaped quoteUninstallStringUnmapViewOfFileVBoxService.exeVPS.hsmiths.comWinsta0\DefaultX-Forwarded-For\\.\VBoxTrayIPC]
Source: VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000843000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: main.isRunningInsideVMWare
Source: VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: VirtualUnlockWINDOW_UPDATEWTSFreeMemoryWriteConsoleW[FrameHeader \\.\VBoxGuestaccept-rangesaccess deniedadvapi32.dllauthorizationbad flushGen bad map statebtc.cihar.combtc.xskyx.netcache-controlcontent-rangecouldn't polldalTLDpSugct?data is emptydouble unlockemail addressempty integerexchange fullfatal error: gethostbynamegetservbynamegzip, deflateif-none-matchignoring fileimage/svg+xmlinvalid ASN.1invalid UTF-8invalid base kernel32.dllkey expansionlame referrallast-modifiedlevel 3 resetload64 failedmaster secretmin too largename is emptynil stackbasenot a Float32open file: %wout of memoryparallels: %wparsing time powrprof.dllprl_tools.exeprofMemActiveprofMemFutureread EULA: %wrebooting nowruntime: seq=runtime: val=service stateset event: %wsigner is nilsocks connectsrmount errortimer expiredtraceStackTabtrailing dataunimplementedunsupported: user canceledvalue method virtualpc: %wxadd64 failedxchg64 failed}
Source: VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: unixpacketunknown pcuser-agentuser32.dllvmusbmousevmware: %wws2_32.dll of size (targetpc= , plugin: ErrCode=%v KiB work, bytes ...
Source: syncUpd.exe, 0000000F.00000002.2877720615.0000000000848000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: VersionVirtualWSARecvWSASend"%s" %stypes value=abortedalt -> answersany -> booleancharsetchunkedcmd.execonnectconsolecpu: %scpuprofderiveddriversexpiresfloat32float64forcegcgctracehead = http://invalidlog.txtlookup messageminpc= nil keynop -> number pacer: panic: readdirrefererrefreshrequestrunningserial:server=signal svc_versyscalltor.exetraileruintptrunknownupgradeversionvmmousevpcuhubwaitingwindowswsarecvwsasendwup_verxen: %wxennet6 bytes, data=%q etypes incr=%v is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= ping=%q pointer stack=[ status %!Month(%02d%02d%s %s:%d%s: 0x%x-cleanup2.5.4.102.5.4.112.5.4.1748828125?4#?'1#0AcceptExAcceptedAllocateAltitudeArmenianBAD RANKBalineseBopomofoBugineseCancelIoCherokeeClassANYConflictContinueCurveID(CyrillicDNS nameDSA-SHA1DecemberDefenderDeleteDCDuployanEULA.txtEqualSidEthiopicExtenderFebruaryFirewallFullPathGeorgianGetOEMCPGoStringGujaratiGurmukhiHTTP/1.1HTTP/2.0HiraganaInstFailInstRuneIsWindowJavaneseKatakanaKayah_LiLIFETIMELinear_ALinear_BLocationLsaCloseMD5+SHA1MahajaniNO_ERRORNO_PROXYNovemberOl_ChikiPRIORITYPROGRESSParseIntPersoconPhags_PaQuestionReadFileReceivedSETTINGSSHA1-RSASHA3-224SHA3-256SHA3-384SHA3-512SOFTWARESaturdaySetEventSystem32TagbanwaTai_ThamTai_VietThursdayTifinaghTypeAAAATypeAXFRUSERHASHUSERNAMEUgariticVBoxWddmWSAIoctlWinmonFSWmiPrvSE[::1]:53[:word:][signal \\.\HGFS\\.\vmcistack=[_NewEnum_gatewayacceptexaddress bad instcgocheckcontinuecs deadlockdefault:dial: %wdnsquerydurationeax ebp ebx ecx edi edx eflags eip embeddedesi esp execwaitexporterf is nilfinishedfs gs hijackedhttp/1.1https://if-matchif-rangeinfinityinjectorinvalid linkpathlocationmac_addrmountvolmsvmmoufno anodeno-cacheno_proxypollDescreadfromrecvfromreflect.runnableruntime.rwmutexRrwmutexWscavengeshutdownstrconv.taskkilltor_modetraceBuftrigger=unixgramunknown(usernamevmmemctlvmx_svgawalk: %wwsaioctlwuauservx509sha1yuio.top (forced) B exp.) B work ( blocked= in use)
Source: VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: m=] = ] n=allgallparchasn1avx2basebindbitsbmi1bmi2boolcallcap cas1cas2cas3cas4cas5cas6chandatedeaddialdoneermsetagethmfailfileflagfromftpsfuncgziphosthourhttpicmpidleigmpint8itabjsonkindlinkmdnsnullopenpathpipepop3quitreadrootsbrkseeksid=sizesmtpsse3tag:tcp4texttruetypeudp4uintunixuuidvaryvmcixn-- -%s (at ...
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2387931999.0000000000F11000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410715389.0000000000F11000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2364591268.0000000000F11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWJ
Source: VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: , i = , not , val -BEFV--DYOR--FMLD--FZTA--IRXC--JFQI--JQGP--JSKV--JZUF--KGQJ--KSFO--MKND--MOHU--NSFS--PFQJ--PLND--RTMD--VRSM--XQVL-.local.onion/%d-%s370000390625:31461<-chanAcceptAnswerArabicAugustBUTTONBasic BitBltBrahmiCANCELCONIN$CancelCarianChakmaCommonCookieCopticExpectFltMgrFormatFridayGOAWAYGetACPGothicHangulHatranHebrewHyphenKaithiKhojkiLengthLepchaLockedLycianLydianMondayPADDEDPcaSvcPragmaRejangSCHED STREETServerStringSundaySyriacTai_LeTangutTeluguThaanaTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11VBoxSFWINDIRWanchoWinMonWinmonX25519Yezidi[]byte\??\%s\csrss\ufffd
Source: VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: and got= max= ms, ptr tab= top=%s %q%s %s%s%d%s/%s%s:%d%s=%s"'&+0330+0430+0530+0545+0630+0845+1030+1245+1345, fp:-0930.avif.html.jpeg.json.wasm.webp1.4.2156253.2.250001500025000350004500055000650512560015600278125:**@:path<nil>AdlamAprilBamumBatakBuhidCall ClassCountDograECDSAErrorFlagsFoundGetDCGreekHTTP/KhmerLatinLimbuLocalLstatMarchNONCENushuOghamOriyaOsageP-224P-256P-384P-521PGDSEREALMRangeRealmRunicSHA-1STermTakriTamilTypeAUSTARUUID=\u202] = (allowarrayatimebad nchdirchmodclosecsrssctimedeferfalsefaultfilesfloatgcinggeoipgnamegscanhchanhostshttpsimap2imap3imapsinit int16int32int64matchmheapmkdirmonthmtimentohspanicparsepgdsepop3sproxyrangermdirrouterune scav schedsdsetsleepslicesockssse41sse42ssse3sudogsweeptext/tls: torrctotaltraceuint8unameusageuser=utf-8valuevmusbvmx86write B -> Value addr= alloc base code= ctxt: curg= free goid jobs= list= m->p= max= min= next= p->m= prev= span=% util%s.exe%s.sys%s: %s(...)
Source: f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003690000.00000004.00001000.00020000.00000000.sdmp, VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	Binary or memory string: 100-continue127.0.0.1:%d127.0.0.1:53152587890625762939453125AUTHENTICATEBidi_ControlCIDR addressCONTINUATIONCfgMgr32.dllCoCreateGuidCoInitializeContent TypeContent-TypeCookie.ValueCreateEventWCreateMutexWDeleteObjectECDSA-SHA256ECDSA-SHA384ECDSA-SHA512ErrUnknownPCFindNextFileGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetProcessIdGetStdHandleGetTempPathWGetUserGeoIDGlobalUnlockGlobal\csrssI'm a teapotInstAltMatchJoin_ControlLittleEndianLoadLibraryWLoadResourceLockResourceMax-ForwardsMeetei_MayekMime-VersionMulti-StatusNot ExtendedNot ModifiedNtCreateFileOpenServiceWPUSH_PROMISEPahawh_HmongRCodeRefusedRCodeSuccessReadConsoleWReleaseMutexReportEventWResumeThreadRevertToSelfRoInitializeS-1-5-32-544SERIALNUMBERSelectObjectServer ErrorSetEndOfFileSetErrorModeSetStdHandleSora_SompengSyloti_NagriSysStringLenThread32NextTor mode setTransmitFileUnauthorizedUnlockFileExVBoxTray.exeVariantClearVirtualAllocVirtualQueryWinmon32.sysWinmon64.sysWintrust.dllX-ImforwardsX-Powered-By[[:^ascii:]]\/(\d+)-(.*)\\.\WinMonFSabi mismatchadvapi32.dllaltmatch -> anynotnl -> bad flushGenbad g statusbad g0 stackbad recoverybad value %dbootmgfw.efibuild_numberc ap trafficc hs trafficcaller errorcan't happencas64 failedcdn is emptychan receiveclose notifycontent-typecontext.TODOcountry_codedse disableddumping heapend tracegc

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	API call chain: ExitProcess graph end node	graph_15-24405
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	API call chain: ExitProcess graph end node	graph_15-23369
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	API call chain: ExitProcess graph end node	graph_15-23391
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	API call chain: ExitProcess graph end node	graph_15-23372
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	API call chain: ExitProcess graph end node	graph_15-23390
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	API call chain: ExitProcess graph end node	graph_15-23383
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	API call chain: ExitProcess graph end node	graph_15-23212
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	API call chain: ExitProcess graph end node	graph_15-23413

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

Code function: 15_2_00417B4E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

15_2_00417B4E

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

15_2_00416240

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00415DC0 mov eax, dword ptr fs:[00000030h]	15_2_00415DC0
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006A092B mov eax, dword ptr fs:[00000030h]	15_2_006A092B
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006B6027 mov eax, dword ptr fs:[00000030h]	15_2_006B6027
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006A0D90 mov eax, dword ptr fs:[00000030h]	15_2_006A0D90
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00833643 push dword ptr fs:[00000030h]	15_2_00833643

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

Code function: 15_2_00404C70 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

15_2_00404C70

Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00419DC7 SetUnhandledExceptionFilter,	15_2_00419DC7
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00417B4E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_00417B4E
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_004173DD memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_004173DD
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006BA02E SetUnhandledExceptionFilter,	15_2_006BA02E
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006B7DB5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_006B7DB5
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006B7644 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_006B7644
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: 31_1_001B205C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	31_1_001B205C
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: 31_1_001B1ACE IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_1_001B1ACE
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: 31_1_001C8F26 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_1_001C8F26

Source: C:\Users\user\Desktop\3SqWYf8qFi.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3SqWYf8qFi.exe" -Force
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3SqWYf8qFi.exe" -Force			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\3SqWYf8qFi.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000 value starts with: 4D5A

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\3SqWYf8qFi.exe

Section unmapped: unknown base address: 400000

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_00415D00 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		15_2_00415D00
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: 15_2_006B5F67 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		15_2_006B5F67

Writes to foreign memory regions

Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 404000	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: 406000	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe base: AAF008	Jump to behavior

Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3SqWYf8qFi.exe" -Force	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe "C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe "C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe "C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe" --silent --allusers=0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe "C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe "C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe "C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe "C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe "C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe" --silent --allusers=0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe "C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe "C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe "C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe "C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\dZhcoTSgym1JGRiEQOUqAdeo.exe "C:\Users\user\Pictures\dZhcoTSgym1JGRiEQOUqAdeo.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\rfKusEcfqkKKVyx19jVITYlO.exe "C:\Users\user\Pictures\rfKusEcfqkKKVyx19jVITYlO.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe "C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe" --silent --allusers=0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe "C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe" --silent --allusers=0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\mxmsi31bOIKdEb9VIHBYJshQ.exe "C:\Users\user\Pictures\mxmsi31bOIKdEb9VIHBYJshQ.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe "C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe" --silent --allusers=0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe "C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe" --silent --allusers=0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\jLh2jXNiKaCQ93A91IuQMDiC.exe "C:\Users\user\Pictures\jLh2jXNiKaCQ93A91IuQMDiC.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: C:\Users\user\Pictures\VF98zhY4QVhDxJpNtAE2TU6d.exe "C:\Users\user\Pictures\VF98zhY4QVhDxJpNtAE2TU6d.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Process created: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6c4b21c8,0x6c4b21d4,0x6c4b21e0
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Process created: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2d4,0x300,0x6b8021c8,0x6b8021d4,0x6b8021e0
Source: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe	Process created: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2c4,0x304,0x6bd721c8,0x6bd721d4,0x6bd721e0
Source: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe	Process created: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6ae821c8,0x6ae821d4,0x6ae821e0
Source: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe	Process created: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6a9c21c8,0x6a9c21d4,0x6a9c21e0
Source: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe	Process created: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6a5021c8,0x6a5021d4,0x6a5021e0
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: unknown unknown

Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Process created: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe c:\users\user\pictures\rmussye2z14xnxfrvlvv1kvs.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6c4b21c8,0x6c4b21d4,0x6c4b21e0
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Process created: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe c:\users\user\pictures\upwyhcua3tbsx6l2qc9szcbh.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2d4,0x300,0x6b8021c8,0x6b8021d4,0x6b8021e0
Source: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe	Process created: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe c:\users\user\pictures\rfsq67iama4rppnx6lhmdfkm.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2c4,0x304,0x6bd721c8,0x6bd721d4,0x6bd721e0
Source: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe	Process created: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe c:\users\user\pictures\zky9gvt7bugdavv29pfhdo1j.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6ae821c8,0x6ae821d4,0x6ae821e0
Source: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe	Process created: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe c:\users\user\pictures\j1xogrobjfvz0crzu7rpw7ns.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6a9c21c8,0x6a9c21d4,0x6a9c21e0
Source: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe	Process created: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe c:\users\user\pictures\2n6azsnlktkxjnmzwvg8ou1l.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6a5021c8,0x6a5021d4,0x6a5021e0
Source: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe	Process created: C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe c:\users\user\pictures\rmussye2z14xnxfrvlvv1kvs.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6c4b21c8,0x6c4b21d4,0x6c4b21e0
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Process created: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe c:\users\user\pictures\upwyhcua3tbsx6l2qc9szcbh.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2d4,0x300,0x6b8021c8,0x6b8021d4,0x6b8021e0
Source: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe	Process created: C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe c:\users\user\pictures\rfsq67iama4rppnx6lhmdfkm.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2c4,0x304,0x6bd721c8,0x6bd721d4,0x6bd721e0
Source: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe	Process created: C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe c:\users\user\pictures\zky9gvt7bugdavv29pfhdo1j.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6ae821c8,0x6ae821d4,0x6ae821e0
Source: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe	Process created: C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe c:\users\user\pictures\j1xogrobjfvz0crzu7rpw7ns.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6a9c21c8,0x6a9c21d4,0x6a9c21e0
Source: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe	Process created: C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe c:\users\user\pictures\2n6azsnlktkxjnmzwvg8ou1l.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\roaming\opera software\opera stable\crash reports" "--crash-count-file=c:\users\user\appdata\roaming\opera software\opera stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=stable --annotation=plat=win32 --annotation=prod=operadesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6a5021c8,0x6a5021d4,0x6a5021e0

Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp	Binary or memory string: ..\..\opera\desktop\chrome_imports\chrome\browser\win\ui_automation_util.ccGetCachedBstrValue property is not a BSTR: GetCachedInt32Value property is not an I4: X64Cannot get the size of file version infoNo file version in the package\StringFileInfo\000004B0\ProductVersionNo product version value in the packageReceived an invalid version: \StringFileInfo\000004B0\ContinuousVersionReceived an invalid continuous build number: Cannot acquire internal version from the full version: \StringFileInfo\000004B0\StreamNo stream value in the packageCannot get exe output: version..\..\opera\desktop\windows\installer\common\file_version_utils_impl.ccInvalid version from exe: Cannot get exe output: streamCannot get app output Failed to run the elevated process: Failed wait for the elevated process: Unexpected result when waiting for elevated process: Shortcut element - no correct interface...\..\opera\desktop\windows\installer\common\pin_automator.ccDoneCannot get native menu handle.Cannot get desktop rect.Cannot find pin menu element.No rectangleCould not activate the menu item.ProgmanSysListView324
Source: UPwYHcUA3TbsX6l2qc9SZcBH.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe	Binary or memory string: Progman

Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe

Code function: 31_1_001B1C3F cpuid

31_1_001B1C3F

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	15_2_00414570
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,	15_2_006B47D7
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: GetLocaleInfoW,	31_1_001CC83D
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: EnumSystemLocalesW,	31_1_001CC912
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: GetLocaleInfoW,	31_1_001CC95D
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	31_1_001CCA04
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	31_1_001CC29F
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: GetLocaleInfoW,	31_1_001CCB0A
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: EnumSystemLocalesW,	31_1_001C832B
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: EnumSystemLocalesW,	31_1_001CC4F0
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	31_1_001CC58B
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: GetLocaleInfoW,	31_1_001C7DEB
Source: C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe	Code function: EnumSystemLocalesW,	31_1_001CC7DE

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Users\user\Desktop\3SqWYf8qFi.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\3SqWYf8qFi.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

Code function: 15_2_00414450 GetProcessHeap,HeapAlloc,GetLocalTime,wsprintfA,

15_2_00414450

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

Code function: 15_2_004143C0 GetProcessHeap,HeapAlloc,GetUserNameA,

15_2_004143C0

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

Code function: 15_2_004144B0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

15_2_004144B0

Source: C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe

10_2_00404375

Source: C:\Users\user\Desktop\3SqWYf8qFi.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disables UAC (registry)

Source: C:\Users\user\Desktop\3SqWYf8qFi.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System EnableLUA

Jump to behavior

Source: C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct
Source: C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT displayName FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Glupteba

Source: Yara match	File source: 38.1.VF98zhY4QVhDxJpNtAE2TU6d.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.f2CDTsUNlMadewChtQe3a8Da.exe.3690000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000026.00000001.2270329448.0000000000843000.00000040.00000001.01000000.0000002A.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: f2CDTsUNlMadewChtQe3a8Da.exe PID: 10968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VF98zhY4QVhDxJpNtAE2TU6d.exe PID: 14320, type: MEMORYSTR

Yara detected Mars stealer

Source: Yara match	File source: 15.2.syncUpd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.6a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.syncUpd.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.syncUpd.exe.7b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.6a0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000003.1947105334.00000000007B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0000000F.00000002.2877720615.0000000000848000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: syncUpd.exe PID: 9392, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: 15.2.syncUpd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.6a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.syncUpd.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.syncUpd.exe.7b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.6a0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000003.1947105334.00000000007B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: syncUpd.exe PID: 9392, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: MetaMask\|djclckkglechooblngghdinmeemkbgci\|1\|0\|0\|MetaMask\|ejbalbakoplchlghecdalmeeeajnimhm\|1\|0\|0\|MetaMask\|nkbihfbeogaeaoehlefnkodbefgpgknn\|1\|0\|0\|TronLink\|ibnejdfjmmkpcnlpebklmnkoeoihofec\|1\|0\|0\|Binance Wallet\|fhbohimaelbohpjbbldcngcnapndodjp\|1\|0\|0\|Yoroi\|ffnbelfdoeiohenkjibnmadjiehjhajb\|1\|0\|0\|Coinbase Wallet extension\|hnfanknocfeofbddgcijnmhnfnkdnaad\|1\|0\|1\|Guarda\|hpglfhgfnhbgpjdenjgmdgoeiappafln\|1\|0\|0\|Jaxx Liberty\|cjelfplplebdjjenllpjcblmjkfcffne\|1\|0\|0\|iWallet\|kncchdigobghenbbaddojjnnaogfppfj\|1\|0\|0\|MEW CX\|nlbmnnijcnlegkjjpcfjclmcfggfefdm\|1\|0\|0\|GuildWallet\|nanjmdknhkinifnkgdcggcfnhdaammmj\|1\|0\|0\|Ronin Wallet\|fnjhmkhhmkbjkkabndcnnogagogbneec\|1\|0\|0\|NeoLine\|cphhlgmgameodnhkjdmkpanlelnlohao\|1\|0\|0\|CLV Wallet\|nhnkbkgjikgcigadomkphalanndcapjk\|1\|0\|0\|Liquality Wallet\|kpfopkelmapcoipemfendmdcghnegimn\|1\|0\|0\|Terra Station Wallet\|aiifbnbfobpmeekipheeijimdpnlpgpp\|1\|0\|0\|Keplr\|dmkamcknogkgcdfhhbddcghachkejeap\|1\|0\|0\|Sollet\|fhmfendgdocmcbmfikdcogofphimnkno\|1\|0\|0\|Auro Wallet(Mina Protocol)\|cnmamaachppnkjgnildpdmkaakejnhae\|1\|0\|0\|Polymesh Wallet\|jojhfeoedkpkglbfimdfabpdfjaoolaf\|1\|0\|0\|ICONex\|flpiciilemghbmfalicajoolhkkenfel\|1\|0\|0\|Coin98 Wallet\|aeachknmefphepccionboohckonoeemg\|1\|0\|0\|EVER Wallet\|cgeeodpfagjceefieflmdfphplkenlfk\|1\|0\|0\|KardiaChain Wallet\|pdadjkfkgcafgbceimcpbkalnfnepbnk\|1\|0\|0\|Rabby\|acmacodkjbdgmoleebolmdjonilkdbch\|1\|0\|0\|Phantom\|bfnaelmomeimhlpmgjnjophhpkkoljpa\|1\|0\|0\|Brave Wallet\|odbfpeeihdkbihmopkbjmoonfanlbfcl\|1\|0\|0\|Oxygen\|fhilaheimglignddkjgofkcbgekhenbh\|1\|0\|0\|Pali Wallet\|mgffkfbidihjpoaomajlbgchddlicgpn\|1\|0\|0\|BOLT X\|aodkkagnadcbobfpggfnjeongemjbjca\|1\|0\|0\|XDEFI Wallet\|hmeobnfnfcmdkdcmlblgagmfpfboieaf\|1\|0\|0\|Nami\|lpfcbjknijpeeillifnkikgncikgfhdo\|1\|0\|0\|Maiar DeFi Wallet\|dngmlblcodfobpdpecaadgfbcggfjfnm\|1\|0\|0\|Keeper Wallet\|lpilbniiabackdjcionkobglmddfbcjo\|1\|0\|0\|Solflare Wallet\|bhhhlbepdkbapadjdnnojkbgioiodbic\|1\|0\|0\|Cyano Wallet\|dkdedlpgdmmkkfjabffeganieamfklkm\|1\|0\|0\|KHC\|hcflpincpppdclinealmandijcmnkbgn\|1\|0\|0\|TezBox\|mnfifefkajgofkcjkemidiaecocnkjeh\|1\|0\|0\|Temple\|ookjlbkiijinhpmnjffcofjonbfbgaoc\|1\|0\|0\|Goby\|jnkelfanjkeadonecabehalmbgpfodjm\|1\|0\|0\|Ronin Wallet\|kjmoohlgokccodicjjfebfomlbljgfhk\|1\|0\|0\|Byone\|nlgbhdfgdhgbiamfdfmbikcdghidoadd\|1\|0\|0\|OneKey\|jnmbobjmhlngoefaiojfljckilhhlhcj\|1\|0\|0\|DAppPlay\|lodccjjbdhfakaekdiahmedfbieldgik\|1\|0\|0\|SteemKeychain\|jhgnbkkipaallpehbohjmkbjofjdmeid\|1\|0\|0\|Braavos Wallet\|jnlgamecbpmbajjfhmmmlhejkemejdma\|1\|0\|0\|Enkrypt\|kkpllkodjeloidieedojogacfhpaihoh\|1\|1\|1\|OKX Wallet\|mcohilncbfahbmgdjkbpemcciiolgcge\|1\|0\|0\|Sender Wallet\|epapihdplajcdnnkdeiahlgigofloibg\|1\|0\|0\|Hashpack\|gjagmgiddbbciopjhllkdnddhcglnemk\|1\|0\|0\|Eternl\|kmhcihpebfmpgmihbkipmjlmmioameka\|1\|0\|0\|Pontem Aptos Wallet\|phkbamefinggmakgklpkljjmgibohnba\|1\|0\|0\|Petra Aptos Wallet\|ejjladinnckdgjemekebdpeokbikhfci\|1\|0\|0\|Martian Aptos Wallet\|efbglgofoippbgcjepnhiblaibcnclgk\|1\|0\|0\|Finnie\|cjmkndjhnagcfbpiemnkdpomccnjblmj\|1\|0\|0\|Leap Terra Wallet\|aijcbedoijmgnlmjeegjaglmepbmpkpi\|1\|0\|0\|Trezor Password Manager\|imloifkgjagghnncjkhggdhalmcnfklk\|1\|0\|0\|Authenticator\|bhghoamapcdpbohphigoooaddinpkbai\|1\|0\|0\|
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\syncUpd.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\

Source: Yara match

File source: Process Memory Space: syncUpd.exe PID: 9392, type: MEMORYSTR

Remote Access Functionality

Yara detected Glupteba

Source: Yara match	File source: 38.1.VF98zhY4QVhDxJpNtAE2TU6d.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.3.f2CDTsUNlMadewChtQe3a8Da.exe.3690000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000026.00000001.2270329448.0000000000843000.00000040.00000001.01000000.0000002A.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: f2CDTsUNlMadewChtQe3a8Da.exe PID: 10968, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: VF98zhY4QVhDxJpNtAE2TU6d.exe PID: 14320, type: MEMORYSTR

Yara detected Mars stealer

Source: Yara match	File source: 15.2.syncUpd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.6a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.syncUpd.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.syncUpd.exe.7b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.6a0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000003.1947105334.00000000007B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0000000F.00000002.2877720615.0000000000848000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: syncUpd.exe PID: 9392, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match	File source: 15.2.syncUpd.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.6a0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.syncUpd.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.syncUpd.exe.7b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.syncUpd.exe.6a0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000003.1947105334.00000000007B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: syncUpd.exe PID: 9392, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	1 Windows Management Instrumentation	11 Scripting	1 DLL Side-Loading	21 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	11 Native API	1 DLL Side-Loading	412 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Shared Modules	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	21 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Clipboard Data	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	12 Command and Scripting Interpreter	Login Hook	Login Hook	21 Software Packing	NTDS	147 System Information Discovery	Distributed Component Object Model	Input Capture	1 Proxy	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	131 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	131 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	131 Virtualization/Sandbox Evasion	Proc Filesystem	13 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3SqWYf8qFi.exe	18%	ReversingLabs	ByteCode-MSIL.Trojan.Zilla
3SqWYf8qFi.exe	25%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\DG5NfvChXpdFrpWmBrnRWaQb.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\9pxDWajsJYwYwL1brTzHEdek.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\9HGEbLH7EssqmLwFcrlZYSWT.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\5QpyioUXq8ASWQahMvzU4ahz.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal	Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal	Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal	Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal	Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	Virustotal	Browse
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	Virustotal	Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.172.128.145/3cd2b41cbde8fc9c.php	true
185.172.128.145/3cd2b41cbde8fc9c.php	true

URLs from Memory and Binaries

Name	Source	Malicious
https://desktop-netinstaller-sub.osp.opera.software/y	Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2381346872.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.0000000001666000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/chrome_newtab	syncUpd.exe, 0000000F.00000003.2281275820.00000000008F6000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/Security	rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2796662559.000000000165B000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/ac/?q=	syncUpd.exe, 0000000F.00000003.2281275820.00000000008F6000.00000004.00000020.00020000.00000000.sdmp	false
https://legal.opera.com/terms	UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.000000000024A000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.00000000000EA000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.000000000007A000.00000040.00000001.01000000.0000002C.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/t	UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410715389.0000000000F11000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.145/15f649199f40275b/freebl3.dll	syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/o	UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2364591268.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2387931999.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410715389.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp	false
https://help.opera.com/latest/	UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	false
https://download.opera.com/download/get/?id=65171&autoupdate=1&ni=10	2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2363415183.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/l	rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2796662559.000000000165B000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/k	Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001612000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	false
https://download.opera.com/download/get/?id=65171&autoupdate=1&ni=1E	j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2417221880.0000000045A9C000.00000004.00001000.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2417196433.0000000045A8C000.00000004.00001000.00020000.00000000.sdmp	false
https://policies.google.com/terms;	UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.000000000024A000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.00000000000EA000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.000000000007A000.00000040.00000001.01000000.0000002C.sdmp	false
https://download.opera.com/download/get/?id=65171&autoupdate=1&ni=1	UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2361773425.0000000000F32000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2444214649.000000003F6E0000.00000004.00001000.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2379241385.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2410307403.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2430979117.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2393171018.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2381346872.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2435436063.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2381346872.0000000001610000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.0000000001666000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442781384.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2436840383.000000003F734000.00000004.00001000.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2372910856.0000000000FAB000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2417196433.0000000045A8C000.00000004.00001000.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2408410558.0000000045B34000.00000004.00001000.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2425396629.00000000380E0000.00000004.00001000.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2363345584.0000000000C32000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2363415183.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp	false
http://autoupdate-staging.services.ams.osa/	UPwYHcUA3TbsX6l2qc9SZcBH.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe	false
http://185.172.128.187/ping.php?substr=two	vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.000000000067E000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/b	2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2401048572.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2423165911.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2391593565.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.187/Ledger-Live.exe3	syncUpd.exe, 0000000F.00000002.3205646166.0000000026F06000.00000004.00000020.00020000.00000000.sdmp	false
http://localhost:3001api/prefs/?product=$1&version=$2..	UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	false
https://crashpad.chromium.org/https://crashpad.chromium.org/bug/new	UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	false
https://www.opera.com/download/	UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	false
http://185.172.128.145/15f649199f40275b/vcruntime140.dllo	syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/X	zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/W	Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001612000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2381346872.0000000001610000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/V	2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2401048572.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2423165911.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2381790231.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2363415183.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2382378174.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2391593565.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.187/Ledger-Live.exe_	syncUpd.exe, 0000000F.00000002.3205646166.0000000026F06000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/U	j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2407930928.0000000000FBA000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2404639801.0000000000FBA000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414780293.0000000000FBA000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/v1/binaryera.software	2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2423730656.00000000034C0000.00000004.00000020.00020000.00000000.sdmp	false
https://autoupdate.geo.opera.com/v5/netinstaller/opera/Stable/windows/x64uh#	zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2379585399.00000000010A1000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2884161745.00000000010A1000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/v1/b	zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2379585399.00000000010A1000.00000004.00000020.00020000.00000000.sdmp	false
https://download3.operacdn.com/	rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2796662559.000000000165B000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2379585399.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2379585399.00000000010A1000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414111474.0000000000F77000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/E	j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414111474.0000000000F14000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.145/15f649199f40275b/mozglue.dll	syncUpd.exe, 0000000F.00000002.2877720615.000000000089F000.00000004.00000020.00020000.00000000.sdmp	false
https://turnitin.com/robot/crawlerinfo.html)cannot	f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003690000.00000004.00001000.00020000.00000000.sdmp, VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/A	rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2796662559.000000000165B000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.187/Ledger-Live.exeT	syncUpd.exe, 0000000F.00000002.3205646166.0000000026F06000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/?	Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001612000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.187/Ledger-Live.exeposition:	syncUpd.exe, 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmp	false
https://crashpad.chromium.org/	UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	false
https://addons.opera.com/en/extensions/details/dify-cashback/	j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/v1/binaryncO	2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2401048572.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2423165911.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2381790231.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2382378174.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2391593565.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp	false
https://download3.operacdn.com/$	j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414111474.0000000000F77000.00000004.00000020.00020000.00000000.sdmp	false
https://autoupdate.geo.opera.com/geolocation/	UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2422974806.0000000000B74000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2409772902.0000000000B74000.00000004.00000020.00020000.00000000.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	false
https://crashstats-collector.opera.com/collector/submit	j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2506090579.0000000001430000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2499037489.0000000001280000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2521237730.000000004CA5C000.00000004.00001000.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/v1/binaryera.software_	Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	syncUpd.exe, 0000000F.00000003.2281275820.00000000008F6000.00000004.00000020.00020000.00000000.sdmp	false
https://opera.com/privacy	UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	false
http://185.172.128.90/cpa/ping.php?substr=two&s=ab/SILENT/TOSTACK/NOCANCELgethttp://185.172.128.187/	vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.2057372935.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.000000000067E000.00000004.00000020.00020000.00000000.sdmp	false
https://autoupdate.geo.opera.com/v5/netinstaller/opera/Stable/windows/x648b	Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/v1/binaryUS)	2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2401048572.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2423165911.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2381790231.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2382378174.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2391593565.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	syncUpd.exe, 0000000F.00000003.2281275820.00000000008F6000.00000004.00000020.00020000.00000000.sdmp	false
https://gamemaker.io)	UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.000000000024A000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.00000000000EA000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.000000000007A000.00000040.00000001.01000000.0000002C.sdmp	false
http://autoupdate-staging.services.ams.osa/v4/v5/netinstaller///windows/x64v2/Fetching	UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	false
http://https://_bad_pdb_file.pdb	f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003D5B000.00000004.00001000.00020000.00000000.sdmp	false
http://185.172.128.187/	vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/v1/binaryur	rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2796662559.000000000165B000.00000004.00000020.00020000.00000000.sdmp	false
http://nsis.sf.net/NSIS_Error	vkIsjAzkgrOzUK7uj2IHc9JM.exe, vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000000.1843284935.000000000040B000.00000002.00000001.01000000.0000000A.sdmp, 3iX1J0J7PXcnIfnf5KGl849r.exe, 00000011.00000000.1859837097.000000000040B000.00000002.00000001.01000000.0000000B.sdmp, H1Mms5Gptfho9VyHt62sHSNN.exe, 00000014.00000000.1948458807.000000000040B000.00000002.00000001.01000000.0000001B.sdmp, VWhRbFHRqImCr0UdFf6QtJNt.exe, 00000016.00000000.1943621838.000000000040B000.00000002.00000001.01000000.00000014.sdmp, mxmsi31bOIKdEb9VIHBYJshQ.exe, 00000021.00000000.2047728912.000000000040B000.00000002.00000001.01000000.00000026.sdmp, jLh2jXNiKaCQ93A91IuQMDiC.exe, 00000025.00000000.2064292451.000000000040B000.00000002.00000001.01000000.00000027.sdmp	false
http://www.google.com/feedfetcher.html)HKLM	f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003690000.00000004.00001000.00020000.00000000.sdmp, VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	false
https://blockchain.infoindex	VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	false
https://gamemaker.io/en/get.	UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.000000000024A000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.00000000000EA000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.000000000007A000.00000040.00000001.01000000.0000002C.sdmp	false
https://gamemaker.io	UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.000000000024A000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.00000000000EA000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.000000000007A000.00000040.00000001.01000000.0000002C.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/v1/binaryCa	Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001612000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.90/cpa/ping.php?substr=two&s=ab	vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.00000000006BE000.00000004.00000020.00020000.00000000.sdmp, vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.2057372935.0000000002E3D000.00000004.00000020.00020000.00000000.sdmp, vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.000000000067E000.00000004.00000020.00020000.00000000.sdmp	false
https://redir.opera.com/www.opera.com/firstrun/?utm_campaign=767&utm_medium=apb&utm_source=mkt&http_	j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2416720122.0000000045A40000.00000004.00001000.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2408410558.0000000045B34000.00000004.00001000.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2425396629.00000000380E0000.00000004.00001000.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2363345584.0000000000C32000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2389660858.0000000038134000.00000004.00001000.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/P(s	UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2364591268.0000000000EAD000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2387931999.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410715389.0000000000EAF000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/r-sub.osp.opera.software/	rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2796662559.000000000165B000.00000004.00000020.00020000.00000000.sdmp	false
https://download3.operacdn.com/ftp/pub/opera/desktop/108.0.5067.24/win/Opera_108.0.5067.24_Autoupdat	j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414111474.0000000000F14000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2387931322.0000000000FB2000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414738796.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2404639801.0000000000FAE000.00000004.00000020.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000003.2388133805.0000000000FC7000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/v1/binarynt	Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001612000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2381346872.0000000001610000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/v1/binaryMt	2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2401048572.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2423165911.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2381790231.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2382378174.0000000000BAB000.00000004.00000020.00020000.00000000.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000003.2391593565.0000000000BA9000.00000004.00000020.00020000.00000000.sdmp	false
https://crashpad.chromium.org/bug/new	UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	false
http://185.172.128.145/15f649199f40275b/sqlite3.dlllLx	syncUpd.exe, 0000000F.00000003.2281435291.000000000089F000.00000004.00000020.00020000.00000000.sdmp	false
https://download.opera.com/download/get/?id=65199&autoupdate=1&ni=1&stream=stable&utm_campaign=767&u	rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2796662559.000000000164C000.00000004.00000020.00020000.00000000.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2820867767.0000000029B34000.00000004.00001000.00020000.00000000.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 0000000C.00000003.2356908534.0000000001653000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2407180517.000000002E134000.00000004.00001000.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2412352500.000000002E0E0000.00000004.00001000.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2364591268.0000000000F26000.00000004.00000020.00020000.00000000.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000003.2378402420.0000000000F26000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2444214649.000000003F6E0000.00000004.00001000.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2379241385.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2410307403.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2430979117.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2393171018.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2435436063.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442781384.0000000001676000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2436840383.000000003F734000.00000004.00001000.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2368162064.0000000001118000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010A5000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2379585399.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2379585399.00000000010A1000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2884161745.00000000010A1000.00000004.00000020.00020000.00000000.sdmp	false
https://autoupdate.geo.opera.com/9F	Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/v1/binaryetmsg.dll.mui	Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010FB000.00000004.00000020.00020000.00000000.sdmp	false
https://crashstats-collector.opera.com/collector/submitL	j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2515439121.000000004CA24000.00000004.00001000.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2521237730.000000004CA5C000.00000004.00001000.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/DllFuncName	Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001612000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2381346872.0000000001610000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.145/15f649199f40275b/sqlite3.dll	syncUpd.exe, 0000000F.00000003.2281435291.000000000089F000.00000004.00000020.00020000.00000000.sdmp	false
https://autoupdate.geo.opera.com/_Event_	Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	false
https://autoupdate.geo.opera.com/v5/netinstaller/opera/Stable/windows/x64Cb	Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	false
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	syncUpd.exe, 0000000F.00000003.2281275820.00000000008F6000.00000004.00000020.00020000.00000000.sdmp	false
https://download.opera.com/download/get/?id=65171&autoupdate=1&ni=19F	Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2381346872.0000000001610000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.187/v	vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.00000000006BE000.00000004.00000020.00020000.00000000.sdmp	false
http://search.msn.com/msnbot.htm)msnbot/1.1	f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003690000.00000004.00001000.00020000.00000000.sdmp, VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/ssContentHintDecodeExDllFuncNamew	Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2433684677.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2412912542.000000000161C000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000003.2395053147.0000000001612000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442648907.000000000161C000.00000004.00000020.00020000.00000000.sdmp	false
https://legal.opera.com/eula/computers	UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.000000000024A000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.00000000000EA000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.000000000007A000.00000040.00000001.01000000.0000002C.sdmp	false
https://crashstats-collector.opera.com/collector/submit--annotation=channel=Stable--annotation=plat=	Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2456981913.00000000006E8000.00000004.00000020.00020000.00000000.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2458031390.000000005C814000.00000004.00001000.00020000.00000000.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2514125929.000000004CA14000.00000004.00001000.00020000.00000000.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/v1/binaryera.softwarest	UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2410615687.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.145/3cd2b41cbde8fc9c.php0d62641a64885f84d53bf1676aabn	syncUpd.exe, 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmp	false
https://desktop-netinstaller-sub.osp.opera.software/v1/binary/B	Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442550747.00000000015B8000.00000004.00000020.00020000.00000000.sdmp	false
https://download.opera.com/-sub.osp.opera.software/y	zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2388431790.00000000010C0000.00000004.00000020.00020000.00000000.sdmp, zKY9gVt7bugdAVV29pfHDO1J.exe, 0000001D.00000003.2379585399.00000000010C0000.00000004.00000020.00020000.00000000.sdmp	false
https://www.opera.com..	UPwYHcUA3TbsX6l2qc9SZcBH.exe, 00000013.00000002.2409921940.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2441856398.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000002.2423332113.0000000000225000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000D25000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.0000000000275000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.0000000000115000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.00000000000A5000.00000040.00000001.01000000.0000002C.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, 0000002B.00000002.2436482211.0000000000275000.00000040.00000001.01000000.00000029.sdmp	false
http://185.172.128.187/T	vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000003.1920722672.00000000006EC000.00000004.00000020.00020000.00000000.sdmp, vkIsjAzkgrOzUK7uj2IHc9JM.exe, 0000000A.00000002.1999621262.00000000006E7000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.145/15f649199f40275b/softokn3.dlld	syncUpd.exe, 0000000F.00000002.2877720615.0000000000886000.00000004.00000020.00020000.00000000.sdmp	false
https://legal.opera.com/privacy.	UPwYHcUA3TbsX6l2qc9SZcBH.exe, UPwYHcUA3TbsX6l2qc9SZcBH.exe, 0000001F.00000001.2097354505.00000000001FA000.00000040.00000001.01000000.0000001A.sdmp, Rfsq67IamA4rPpnX6LHMDFkm.exe, Rfsq67IamA4rPpnX6LHMDFkm.exe, 00000020.00000002.2457163152.0000000000CFA000.00000040.00000001.01000000.00000018.sdmp, j1XOgROBJfvz0cRzU7rPw7NS.exe, j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2412165528.000000000024A000.00000040.00000001.01000000.00000029.sdmp, 2n6aZsnLKtKXJNMzWvG8Ou1L.exe, 00000023.00000002.2420796165.00000000000EA000.00000040.00000001.01000000.00000028.sdmp, rMuSSyE2z14xNxfrVLVv1kvs.exe, 00000029.00000001.2215014339.000000000007A000.00000040.00000001.01000000.0000002C.sdmp	false
https://autoupdate.geo.opera.com/geolocation/4	Rfsq67IamA4rPpnX6LHMDFkm.exe, 0000001B.00000002.2442550747.00000000015B8000.00000004.00000020.00020000.00000000.sdmp	false
http://invalidlog.txtlookup	f2CDTsUNlMadewChtQe3a8Da.exe, 00000017.00000003.2076235587.0000000003690000.00000004.00001000.00020000.00000000.sdmp, VF98zhY4QVhDxJpNtAE2TU6d.exe, 00000026.00000001.2270329448.0000000000400000.00000040.00000001.01000000.0000002A.sdmp	false
https://download.opera.com/	j1XOgROBJfvz0cRzU7rPw7NS.exe, 00000022.00000002.2414111474.0000000000F77000.00000004.00000020.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
93.171.243.253	unknown	Czech Republic	8870	OVDC-ASUA	false
212.110.188.202	unknown	United Kingdom	35425	BYTEMARK-ASGB	false
24.230.33.96	unknown	United States	11232	MIDCO-NETUS	false
64.157.16.43	unknown	United States	3064	AFFINITY-FTLUS	false
50.169.37.50	unknown	United States	7922	COMCAST-7922US	false
182.160.100.156	unknown	Bangladesh	24323	AAMRA-NETWORKS-AS-APaamranetworkslimitedBD	false
103.216.51.36	unknown	Cambodia	135375	TCC-AS-APTodayCommunicationCoLtdKH	false
78.90.252.7	unknown	Bulgaria	20911	NETSURF-AS-BG	false
182.253.172.111	unknown	Indonesia	17451	BIZNET-AS-APBIZNETNETWORKSID	false
51.15.139.15	unknown	France	12876	OnlineSASFR	false
181.78.11.217	unknown	Argentina	52468	UFINETPANAMASAPA	false
194.44.177.225	unknown	Ukraine	3255	UARNET-ASUARNetUA	false
89.168.121.175	unknown	United Kingdom	9105	TISCALI-UKTalkTalkCommunicationsLimitedGB	false
181.78.11.218	unknown	Argentina	52468	UFINETPANAMASAPA	false
85.113.47.102	unknown	Russian Federation	34533	ESAMARA-ASRU	false
85.237.62.189	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
41.155.190.214	unknown	Egypt	37069	MOBINILEG	false
13.234.24.116	unknown	United States	16509	AMAZON-02US	false
139.255.193.243	unknown	Indonesia	9905	LINKNET-ID-APLinknetASNID	false
159.65.0.189	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
103.81.196.125	unknown	Bangladesh	55492	DFN-BDDhakaFiberNetLimitedBD	false
180.178.104.110	unknown	Indonesia	38758	HYPERNET-AS-IDPTHIPERNETINDODATAID	false
31.43.63.70	unknown	Ukraine	50581	UTGUA	false
103.74.229.133	unknown	Bangladesh	131340	TAQWAIT-AS-APMdMozammelHoquetaTaqwaITBD	false
52.35.240.119	unknown	United States	16509	AMAZON-02US	false
45.172.177.253	unknown	Argentina	267791	INTERMEDIABUSINESSSOLUTIONSSRLAR	false
68.183.17.152	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
119.15.89.87	unknown	Cambodia	24492	IIT-WICAM-AS-APWiCAMCorporationLtdKH	false
103.25.210.102	unknown	Indonesia	132653	B-LINK-AS-IDPTTransdataSejahteraID	false
221.194.149.8	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
101.51.121.29	unknown	Thailand	23969	TOT-NETTOTPublicCompanyLimitedTH	false
146.19.106.42	unknown	France	7726	FITC-ASUS	false
51.81.89.146	unknown	United States	16276	OVHFR	false
114.129.2.82	unknown	Japan	7671	MCNETNTTSmartConnectCorporationJP	false
46.17.63.166	unknown	United Kingdom	39326	HSO-GROUPGB	false
51.79.248.215	unknown	Canada	16276	OVHFR	false
103.216.50.143	unknown	Cambodia	135375	TCC-AS-APTodayCommunicationCoLtdKH	false
62.171.131.101	unknown	United Kingdom	51167	CONTABODE	false
103.220.205.162	unknown	Bangladesh	59362	KSNETWORK-AS-APKSNetworkLimitedBD	false
103.47.93.250	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	false
183.164.254.8	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
194.9.80.1	unknown	unknown	206495	IR-SADRA-20180529IR	false
212.110.188.222	unknown	United Kingdom	35425	BYTEMARK-ASGB	false
103.47.93.248	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	false
201.163.73.93	unknown	Mexico	11172	AlestraSdeRLdeCVMX	false
202.162.105.202	unknown	Singapore	64050	BCPL-SGBGPNETGlobalASNSG	false
67.205.177.122	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
212.110.188.220	unknown	United Kingdom	35425	BYTEMARK-ASGB	false
94.182.26.44	unknown	Iran (ISLAMIC Republic Of)	31549	RASANAIR	false
50.233.240.87	unknown	United States	7922	COMCAST-7922US	false
38.253.88.242	unknown	United States	174	COGENT-174US	false
172.67.200.220	unknown	United States	13335	CLOUDFLARENETUS	false
13.59.156.167	unknown	United States	16509	AMAZON-02US	false
38.242.199.111	unknown	United States	36336	NATIXISUS	false
74.103.66.15	unknown	United States	701	UUNETUS	false
91.185.84.228	unknown	Russian Federation	49816	CMST-VOLGA-SIMBIRSKASRU	false
175.101.15.41	unknown	India	17754	EXCELL-ASExcellmediaIN	false
219.73.88.167	unknown	Hong Kong	4760	HKTIMS-APHKTLimitedHK	false
212.110.188.216	unknown	United Kingdom	35425	BYTEMARK-ASGB	false
212.110.188.211	unknown	United Kingdom	35425	BYTEMARK-ASGB	false
103.47.93.236	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	false
128.199.104.93	unknown	United Kingdom	14061	DIGITALOCEAN-ASNUS	false
212.110.188.213	unknown	United Kingdom	35425	BYTEMARK-ASGB	false
183.215.23.242	unknown	China	56047	CMNET-HUNAN-APChinaMobilecommunicationscorporationCN	false
35.207.123.94	unknown	United States	19527	GOOGLE-2US	false
103.189.96.98	unknown	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
162.144.32.209	unknown	United States	46606	UNIFIEDLAYER-AS-1US	false
45.249.79.190	unknown	India	18229	CTRLS-AS-INCtrlSDatacentersLtdIN	false
102.132.55.250	unknown	South Africa	327996	ACCELERITZA	false
148.72.23.56	unknown	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	false
188.40.44.95	unknown	Germany	24940	HETZNER-ASDE	false
188.163.170.130	unknown	Ukraine	15895	KSNET-ASUA	false
186.190.225.152	unknown	Colombia	262186	TVAZTECASUCURSALCOLOMBIACO	false
81.250.223.126	unknown	France	3215	FranceTelecom-OrangeFR	false
218.252.244.126	unknown	Hong Kong	9908	HKCABLE2-HK-APHKCableTVLtdHK	false
89.165.40.8	unknown	Iran (ISLAMIC Republic Of)	39501	NGSASIR	false
47.236.56.214	unknown	United States	20115	CHARTER-20115US	false
212.110.188.204	unknown	United Kingdom	35425	BYTEMARK-ASGB	false
191.101.1.116	unknown	Chile	61317	ASDETUKhttpwwwheficedcomGB	false
94.131.14.66	unknown	Ukraine	29632	NASSIST-ASGI	false
92.119.74.249	unknown	Slovenia	205715	AS-FITELNETWORKES	false
212.110.188.207	unknown	United Kingdom	35425	BYTEMARK-ASGB	false
1.55.241.4	unknown	Viet Nam	18403	FPT-AS-APTheCorporationforFinancingPromotingTechnolo	false
23.111.102.153	unknown	Russian Federation	7979	SERVERS-COMUS	false
103.47.93.223	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	false
113.74.26.114	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
104.17.9.114	unknown	United States	13335	CLOUDFLARENETUS	false
45.235.16.121	unknown	Brazil	267406	AGOBrasilInternetLtdaBR	false
168.227.11.135	unknown	Brazil	28201	CompanhiaItabiranaTelecomunicacoesLtdaBR	false
5.161.144.46	unknown	Germany	24940	HETZNER-ASDE	false
200.174.198.95	unknown	Brazil	4230	CLAROSABR	false
183.88.122.200	unknown	Thailand	45758	TRIPLETNET-AS-APTripleTInternetTripleTBroadbandTH	false
45.71.15.136	unknown	Brazil	267595	MILANINNETBR	false
180.104.0.161	unknown	China	137702	CHINATELECOM-JIANGSU-NANJING-IDCNanjingJiangsuProvince	false
124.106.228.30	unknown	Philippines	9299	IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH	false
104.236.0.129	unknown	United States	14061	DIGITALOCEAN-ASNUS	false
110.77.236.112	unknown	Thailand	131090	CAT-IDC-4BYTENET-AS-APCATTELECOMPublicCompanyLtdCATT	false
103.47.93.218	unknown	India	9830	SWIFTONLINE-AS-APSWIFTONLINEBORDERASIN	false
54.67.125.45	unknown	United States	16509	AMAZON-02US	false
14.232.235.13	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1407471
Start date and time:	2024-03-12 12:03:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 15m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	49
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3SqWYf8qFi.exe renamed because original name is a hash value
Original Sample Name:	27b3e45a81641d0e7d0dea29938774ae.exe
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winEXE@132/420@0/100
EGA Information:	Successful, ratio: 42.9%
HCA Information:	Successful, ratio: 75% Number of executed functions: 131 Number of non-executed functions: 155
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, WerFault.exe, SIHClient.exe, conhost.exe, svchost.exe
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Skipping network analysis since amount of network traffic is too extensive

Simulations

Behavior and APIs

Time	Type	Description
11:04:15	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0J09ro90wH7cLZwlpWjZz8T8.bat
11:04:32	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RikxgyHSlngyCNkLljOoIea.bat
11:04:49	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CjdCWP2sC37ZrV3R6LwCpexO.bat
11:05:01	Task Scheduler	Run new task: MalayamaraUpdate path: "C:\Users\user\AppData\Local\Temp\Updater.exe"
11:05:03	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ghLXR4xqE410iKbU3cBOmlGw.bat
11:05:13	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MCYmcBRyIU8ux2QHjbZuxfqz.bat
11:05:22	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mVUYVq6R7ZMOQMgpxdxZp1O4.bat
11:05:26	Task Scheduler	Run new task: Opera scheduled Autoupdate 1710241523 path: C:\Users\user\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe s>--scheduledtask --bypasslauncher $(Arg0)
11:05:46	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nkgJlCpXnklvIZptbofXvweb.bat
11:06:06	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0vVJWHdlOpVUJxV1xztDPHUw.bat
11:06:24	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0WOLhTTA42JINQ9Omh8xrRDx.bat
12:03:55	API Interceptor	95x Sleep call for process: 3SqWYf8qFi.exe modified
12:04:12	API Interceptor	500x Sleep call for process: CasPol.exe modified
12:04:12	API Interceptor	31x Sleep call for process: powershell.exe modified
12:04:40	API Interceptor	3x Sleep call for process: F3bLUEvvHahM06jSZWbJPDdX.exe modified
12:04:40	API Interceptor	3x Sleep call for process: jpm6qF5Qiq3f7hmREIabTmaO.exe modified
12:04:58	API Interceptor	3x Sleep call for process: dC7amCutZVjsSWxQ9FIlZYqw.exe modified
12:04:59	API Interceptor	2x Sleep call for process: f2CDTsUNlMadewChtQe3a8Da.exe modified
12:04:59	API Interceptor	2x Sleep call for process: wQ9dgKtBZDeIUddSVpW8BvEm.exe modified
12:05:00	API Interceptor	2x Sleep call for process: rfKusEcfqkKKVyx19jVITYlO.exe modified
12:05:04	API Interceptor	2x Sleep call for process: dZhcoTSgym1JGRiEQOUqAdeo.exe modified
12:05:04	API Interceptor	2x Sleep call for process: VF98zhY4QVhDxJpNtAE2TU6d.exe modified
12:05:04	API Interceptor	2x Sleep call for process: VySSnHhKNg09wrV9qkpgKtg9.exe modified

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.690067217069288
Encrypted:	false
SSDEEP:	12:wSQanHEC73FqjThUbJwuUn5qPyd2whRZfZOaH5KrqXzJI/y5bjbVMmRYAPL8fx7T:wHu73FWhUNwzqq2OfX82JdHRNPLcxdl
MD5:	4E32787C3D6F915D3CB360878174E142
SHA1:	57FF84FAEDF66015F2D79E1BE72A29D7B5643F47
SHA-256:	2BCD2A46D2DCED38DE96701E6D3477D8C9F4456FFAE5135C0605C8434BA60269
SHA-512:	CEC75D7CCFA70705732826C202D144A8AC913E7FCFE0D9B54F6A0D1EEC3253B6DEFFB91E551586DA15F56BA4DE8030AC23EE28B16BB80D1C5F1CB6BECF9C21BE
Malicious:	false
Reputation:	unknown
Preview:	AIXACVYBSBCZDJMZUDVNECMFSGJSAOAIXCJFDPHQJVUANUFFPQXVYJRUGYPJGKEJNXCBTXARAETAKFTJKVLIZEXLMOAPVEZRZZUIRDUKSPZRBPINNEKLCLXBHFZMBRJTUJZTRCGQGFRQCEVPUBAAPBHBTYYHDJZHHPMFAKXVJPQRQCRUFYPMNUCRRQOYXYEHXQEHWHFLZSBMLRRZFLLYUQLADTKEDXVDLKLPZTTCNAXMXPSTCHQKWMSRPNRZGULFHOTUOYUSIVJEHUYPRYGESSFFMBWDPFRMTVBZEHTJSPRMDJISAZPMEWNGPGIXXTDNHCOBSXAWEFWRZNECKZGORELWMEPSAPLSTZZPUKXURSKTFSUSFEZMXMAIMRJZNGCVKLOHPVMZEIXIISXVMQHQTSADYWZQSWYVJHHONOOSZPQVWIUFMVXBXYCJOMERCQSVXERFAOOENLKARQGTECAIXOXEZPFDFJHYFCKLADMCWYOMCITRHMECVVVNPNTSRXYGYRKZUTOFNBMHDZWYHPYLTWEIGWOIGBTHWYGIXBCUDYMZMTZNYQMZLMXKPNFZDUEXXQLFJZZZVOPBEZKTKTJCTNUPRCNNGCPTIHKPTGBJLGUENNUGTZVMZJGQGUVBRLOJZECBLINEKGSIRFWZPWMVYJNEPWGYIAHKMJRBZMRVIBPONMHBDQZYFBHDDMYBZZAFEPAQFFUPIGGYNSPVXUWNNCWAUZXAGCATPNHNNYICDCRMTKRODUCDDFZKHLISLVOIFZPDTOSIEREFHYEWUBJKJRWXMZUGCPUXCPEXUQPWTSKEYSDPEICDQMMKUKJLDNQEHQQCYKRMWOUSJVTVSZJTFZCDVNUMEIZFWDNWCNCSCHBYNKRUSXPVMRIHGXDUPKXMZUIELSRXMZAEUNCCYZTEYLUYYRNSFUTHFESJOLGKJVGGNVJKSFSETAIHYOMLBOPRYAHSCATJUXNTWVZPEMECBVVHKHDELQRTQBEBXPJJ

C:\ProgramData\BAEBFIIE

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BPMLNOBVSB.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Reputation:	unknown
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\ProgramData\BPMLNOBVSB.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702896917219035
Encrypted:	false
SSDEEP:	24:/PRNNS0CSvZqsz3phzXGrOVx0E5lpmo3ntC4hUh31nnrgy:/wQvwsz3phzWrOVxXnncRh31nrgy
MD5:	C68274AA8B7F713157BEBE2FCC2EA5D3
SHA1:	52A5A2D615A813B518DDAAC2A02095F1059DAAD5
SHA-256:	362C32AB7AEE8A211871A6045DADFEBF087D5EC2A3470FBEF42BC1C0E8CF0542
SHA-512:	BB653D9E0948C2BD3586BC7CABC777BCDA84F749B73B26E4FD667C22F9629D8A7EC4F94ADBCAAF679FC116CDDA1F0D55CB348CD50BD3B6A4484F48A203E32883
Malicious:	false
Reputation:	unknown
Preview:	BPMLNOBVSBRFPSKLKRJEVHBRVUUOUWMMDGAHEFTOXDSJSRQBDQADKRAAIMJBBXHJZSYGDGSBIJCBPDLCIPLGVURSSGYXQXCVEDYOHFVNTWOSWAODXQUYSQDZDKFJYMCQZOAAPCNEEITKKQAOZJLGLFTYOILWUOSTJMBMUSHEQYRRGRAOIGHQXDIXRMKPCYCIDORIRGMLSPAFIUBBOMPKCNUTVROXQQMRPPEYTVHGRIWJQZREOHPNIXFSPUEZGKVJWTNJVDHDCOMTLCENQMHDIOFNLZNLPFMCGQAWNZVHKKTCZJIHININWOCQTMBLXKYEUXUUKCZAKOINULOSSFHJSGRNIDZZLUKXSJKRQIPXODCNMCWZEQEGJHTKEBKCHWRCJJEITXLWRGJUOYWSWNFVRXXLTBNUBFYSNPVKHAJAOKQIGZUIREJCJKNRVWECUBFUQVUSSEVFZFGAGLZHTJIRXFGLLTHCDJRQSVBUTENMMECBKNQAOTCGUKCAUANZSSYPURGXINFDSJOSJXFPPQOKWUJNGLOACGPRELXIXQZZNXUEJPFZQRDXMWSGEPNTSQRNGFYRRORGOCRJKMCRFZPVDFDRDZCHPWYNXBAOHXICQPOHWXUVYMEAZUMLLNZQAOCCUKTGCMNZUMKUHEIUUYFGMSIEUWOKDVUTQHRMSVPQFKZILWLKZLKCAJHKFHZJFEJAIIZQWILLXMKWLUETDBWSKQOQQECLVCWJSIQXHNDZAYVIFNNYOZKGGFZMIYUCHYFNVXUHKZCOQBJAYWMEKPQVFWNVIJXYFYHWXFXSXDCSRYIODDWXNUTAYNOXAVMATSYETUSRJPYJEQCIEGHSXOOCALKHPRGXFNWHDUNNXCXELBKBUMKTJRNZBLLQWINSTBBGQYWIVUZENAMGRAYFSSGBXLPJXWYTCERBJXCYMHQMJPSVPWCDSLLUJZTWDDJDHIADYETBWZFZQTYTPWPBFDIVVSAOFDDHMUMYLEFUUIKC

C:\ProgramData\BXAJUJAOEO.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701111373123985
Encrypted:	false
SSDEEP:	24:wSplMoG/A1oXDoMwazZW6QAFWyGjkGKnEuDxOaV9YnF7U:walZG/A12L8MFYr8EuxTK9U
MD5:	CA5A3E2A0C2DDF92EABE165672425976
SHA1:	1933AC1A510945A766039E7E61D7DA4156E0F074
SHA-256:	4180C6A01C86C7D86A51B5C17957BAECF34EBB7FCB6C5968835A5DB64E3C9667
SHA-512:	64FC7B64CDAF57CF026C803A16036BDDC46CA86AC9C35A804FCE188AFA3056C324D62CCEBD45E7E607A53D11A1035CB6C38B24004D14F0DC17B11D8DFBD7DB6C
Malicious:	false
Reputation:	unknown
Preview:	BXAJUJAOEOZPYQVMPMMPXXMVCPSLTTLUOLYYQUQKLRMOQNFWEOCYDOLITPCVDLYSWYQACZEJIDILMNOOUVEVBOSWPXYLBOGFYWHZVFNHRJXYLODFWJLFJKMUXRMLQJAGMERGOWKSMBXUJUMRUBMROMDBISUWTFWPXBVVSTBYHRHUOKCJNGMCOLUFOVLKFFIUZHRPZUITDNNTTEJKTUSBPVEUSTDXHRMZNWZQSUEGRYELXBLVKZHEIVACMOHJWFJRPJKNIDOXZHIEUDGLSGKALGUCHSOBYGTVWDOVYUEMXJWYDCHTXKLWDJLIZFFBQOMRYKZVRXZYKIPKCJEYOVOQCGFXCUNQKHYBXFYRGYUQAUKMCSQKKDJIQWKZEWMJWHJDDENKZLPNJAJLVIEXHEGVFHRIOBAWGXOXLQJIISBHZZGJYZBYNUOKMCKTICSMRTMZVLKMZTCWKHOHWQBKEBGEASMMYEGDDSCGDTYEPANLCQSJIRCTCUHXIVGBREMBTULUXWAZISUYERUZPWQLRSPPVNCMSPDUHQTJKYNEEWYIFNUCJJSDFDNQJLWDBLURDBXKLJVMGWUBKEXPYFIJNWRSUNUJBZAWJQEZWEYFLNXWPKFJZFMVPYOJFFUYCTEUKFWSOFUOTKIGENNTAAXCAHPWQNKMKKGNWIOGZOBPOTDAQLZSIGMQTNQVGQJNNITTRMOHBPCHTGJANZTLZHNSTOQXJKIAZXWPQWIDJXZUURGYMTMZTWQNTRVEKAAWBRZQWZYVWKWEVAUTRSOXDHWSYIZYRJFVXSPNFOTDNAGHDFYSAEEFBXGQQGYMZHMQHZTDMNYXDQJKMLAXJWCBQUIKQFEPVZNRMOWEKGFDLUJLSXRKKJUIGCSCGZTXLHOWGMKDLSQHDWSPCYROUJEHKXBJSADOXSOMTTUGHDSOBTNUEDCBNWNIDSDBZKBGFCJHQNDVAAZTKEIMDCTKNOQUKPNHEQOBANQSCJQRQBRAIBBXRYTT

C:\ProgramData\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.705615236042988
Encrypted:	false
SSDEEP:	24:B65nSK3I37xD9qo21p9G7ILc3pkowOeuiyJRdt7fXzyxu3f7Lj8X2:B65SK3Xx1OXpkowOeMJR/fzeYX8X2
MD5:	159C7BA9D193731A3AAE589183A63B3F
SHA1:	81FDFC9C96C5B4F9C7730127B166B778092F114A
SHA-256:	1FD7067403DCC66C9C013C2F21001B91C2C6456762B05BDC5EDA2C9E7039F41D
SHA-512:	2BC7C0FCEB65E41380FE2E41AE8339D381C226D74C9B510512BD6D2BAFAEB7211FF489C270579804E9C36440F047B65AF1C315D6C20AC10E52147CE388ED858A
Malicious:	false
Reputation:	unknown
Preview:	DTBZGIOOSOGIXCBMGZZTWMBQXGHIBDIDBNCACFDFVBOXTDUUJMUMBAKZSHFEIWNQHEECYVTVTSOTORNQIPIDARMCQDPQAFMDPEUWMOYTBCDCAYVFJLXBCNSKBDWMSQYEQYRUTREAZDRNQIZYXPRJXUJXDYZYLJWOVPCEZSCSUSREYDMTRVOKIKSVPBPVQFMFFQNUDCCBDNGIIDGYMQHFPEMCFEOSEKVDEHVQZBXIBJURBZFVTYETURFSVIYLBMHJKBCAPGOAJJFKOTEXRMHREBNTBJGLLRAKZHXKTTSKEXODMEVVGUJOGNLYLFYGHQIBHAFRVYETMDPLEXBQXLVWYLIMFCJAKPFWSQSVSWYINAAOPMCAAVTIWDFRPKUBYLVKYRNUDCLWZJHLKSXWPDEXGEVUQVEJQWTUUYNTOIRLKQTXRWJHCSMGZWWPGPBFZQLOSDMHAPKSMVNNMIVJAORPRFUXPDROELZMLHAIBRVVWUMSDWFAHIBDVMGGFRISFYQZZSESXHMSUQCQPXBCPTAZBJXKKLRBWEZYGWRXBBTYWRRUXCBJIWCOYQKBQCGCZCPFVLGETTTZLEFZDQMQFHJVERUYLQUPVYRNXQJRLPUBWWQHPTYNORTRKKOMLWKAQZNHZQUJGTIYVIKGAWLHSALTZENHAAJKNKUBSQXDVFQRUFJLDFZAQUPCRNDOOEIALNCMGYLCEZSLPOPYEKIEYDRXSDONBFKQKQMAWBJULDADUHXOQGQLIDEPZRHMCBVTLCJUGOZRYCGXCXPEOJTGJORAEJKASXKARQEVOHMITSWHQEWOJXNOGSKWUQQTSOSWSCCMOUDMMHPYKEAJECJSGTBNPSFVWSGFBKGSKEHVLWONOMPOOJEJHDMKGRPCSBYWCZNHTWZCKQNEGEYABJZETYLVHROKZJAIGKJDHLJBRYOVDHNANLCJBHTDDRPXIXDIHNWDDQDHPSAKZRRXOFYYXZWQWZFESELWVMUIBHMCLVZP

C:\ProgramData\DTBZGIOOSO.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.705615236042988
Encrypted:	false
SSDEEP:	24:B65nSK3I37xD9qo21p9G7ILc3pkowOeuiyJRdt7fXzyxu3f7Lj8X2:B65SK3Xx1OXpkowOeMJR/fzeYX8X2
MD5:	159C7BA9D193731A3AAE589183A63B3F
SHA1:	81FDFC9C96C5B4F9C7730127B166B778092F114A
SHA-256:	1FD7067403DCC66C9C013C2F21001B91C2C6456762B05BDC5EDA2C9E7039F41D
SHA-512:	2BC7C0FCEB65E41380FE2E41AE8339D381C226D74C9B510512BD6D2BAFAEB7211FF489C270579804E9C36440F047B65AF1C315D6C20AC10E52147CE388ED858A
Malicious:	false
Reputation:	unknown
Preview:	DTBZGIOOSOGIXCBMGZZTWMBQXGHIBDIDBNCACFDFVBOXTDUUJMUMBAKZSHFEIWNQHEECYVTVTSOTORNQIPIDARMCQDPQAFMDPEUWMOYTBCDCAYVFJLXBCNSKBDWMSQYEQYRUTREAZDRNQIZYXPRJXUJXDYZYLJWOVPCEZSCSUSREYDMTRVOKIKSVPBPVQFMFFQNUDCCBDNGIIDGYMQHFPEMCFEOSEKVDEHVQZBXIBJURBZFVTYETURFSVIYLBMHJKBCAPGOAJJFKOTEXRMHREBNTBJGLLRAKZHXKTTSKEXODMEVVGUJOGNLYLFYGHQIBHAFRVYETMDPLEXBQXLVWYLIMFCJAKPFWSQSVSWYINAAOPMCAAVTIWDFRPKUBYLVKYRNUDCLWZJHLKSXWPDEXGEVUQVEJQWTUUYNTOIRLKQTXRWJHCSMGZWWPGPBFZQLOSDMHAPKSMVNNMIVJAORPRFUXPDROELZMLHAIBRVVWUMSDWFAHIBDVMGGFRISFYQZZSESXHMSUQCQPXBCPTAZBJXKKLRBWEZYGWRXBBTYWRRUXCBJIWCOYQKBQCGCZCPFVLGETTTZLEFZDQMQFHJVERUYLQUPVYRNXQJRLPUBWWQHPTYNORTRKKOMLWKAQZNHZQUJGTIYVIKGAWLHSALTZENHAAJKNKUBSQXDVFQRUFJLDFZAQUPCRNDOOEIALNCMGYLCEZSLPOPYEKIEYDRXSDONBFKQKQMAWBJULDADUHXOQGQLIDEPZRHMCBVTLCJUGOZRYCGXCXPEOJTGJORAEJKASXKARQEVOHMITSWHQEWOJXNOGSKWUQQTSOSWSCCMOUDMMHPYKEAJECJSGTBNPSFVWSGFBKGSKEHVLWONOMPOOJEJHDMKGRPCSBYWCZNHTWZCKQNEGEYABJZETYLVHROKZJAIGKJDHLJBRYOVDHNANLCJBHTDDRPXIXDIHNWDDQDHPSAKZRRXOFYYXZWQWZFESELWVMUIBHMCLVZP

C:\ProgramData\DVWHKMNFNN.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694985340190863
Encrypted:	false
SSDEEP:	24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
MD5:	C9386BC43BF8FA274422EB8AC6BAE1A9
SHA1:	2CBDE59ADA19F0389A4C482667EC370D68F51049
SHA-256:	F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
SHA-512:	7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
Malicious:	false
Reputation:	unknown
Preview:	DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

C:\ProgramData\EHDGIJJDGCBKFIDHIEBK

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHDHDHIECGCAEBFIIDHIDGIEBF

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJDGHIJD

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HTAGVDFUIE.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Reputation:	unknown
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\ProgramData\IIDAAFBGDBKJJJKFIIIJJJECAA

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEHCAFHIJECGCAKFCGDB

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKKKEHJKFCFCBFHIIDGDAKFHJJ

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MXPXCVPDVN.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698669844484375
Encrypted:	false
SSDEEP:	24:7mMbmx9UKbA2JHc6cqYGtPrmwXr33hecYrnpTGwrhq0Lf6iNXQp:JI68rJcqjPSwXzRecYhGKq0LLG
MD5:	4FCF725C73B93BE52C2E1CD48AC3A562
SHA1:	98118BDED7CC2397C19310A914C6CA6B39CC47DE
SHA-256:	3803B68C31F1D6091C8D35F7B737B363C99ABED15B65899869E2A5AFA443D2C4
SHA-512:	8EDB10C8C81284109073EAABDB337F2AF5428AC5A50DE4999B61792D434D099124DF2DB5B2F58E9FC6335EA2E6F474291F8726DEF293A409418CDE6E0D5D7CFC
Malicious:	false
Reputation:	unknown
Preview:	MXPXCVPDVNZDMRYXKAXPKZSKXQENMVJGASOKSKKVKMVTFWCKJVQUEHFJLYGAGVTAPSEFWLYDESGESNCQQMFQIJOIYCFNJODSXZOERROXNDWXBZRWZFOKQBPLORLXBDLECIGMCKVUGLWKNMZJBHPGARIQDCSYHCPUKBGABSYSPDCWIMLINBEYVYXKDRVQIRPITEAVGQTKEJGNRGJGNMXLAZZZEOVLCHVHUAHQLECFOLMZPDMGFZOZZRCUGUGQXZRQEEYVPMGAXSRCPXPOCBVPESPOAHTWHHDKCHMXTJCJJDRFYUOIUWGYDNCJXDYQFYCADMQIYTSLSIQVEMFCENTOHNQNWXMKIUOZDFCOFDXWRGCINHQCHYKQMLGTDJSTFEPKLURPPUWEFYLYEFPSNQGBKUZJQDAVMAFGFXHFNGMNUPXAYGABBOYSAPGCMGQZYDGMRINVJWRFASDKOFXOQBOCWTMIFSMCIGFJLECWNXSPKYYMZPZTTKDCIUUBZTJKBGNEDOBUUIKPGSXPUUDSIAYBARDMCGXUVFSTYNWEUHFOSOADWNJSVGVNYVPTFIEGPCWGLEJGVLKBVQHFEPYYRMGWPMKQWLBOAFFRZQRDMFIHCLMXYKGCSNXZKWIKKIILSRZRKNKBMQKPDNBOSZDCMCNAMVOVGTUYRVJHPAMTCIPJHQZLFPQNHPQQTDAETXQMKGTZQPDKQISDDHIQFGGWJPCMAAAGGRYLKNAQHJDFVXQSDDSPCOTQDHQLRMFKVLQAFIBPIEJVVBHAMXWNJDJUFWZAUYOGKLIJAKPXHFCOGJJVGZXSWYIBAKNZMMSVHMHLNHNJCCWYZMEJWSAERLVHQEHUTACSGGGRMLAWNQTJDBBGLANCZUNRXUOYFLZHFFWFLDWPBOZWIRWKAIWLBOQNNKCSLPLMPBIDNPIJQEDKYXMBPUFPZCWHQURUYJBENNRMTLHPICTOSJUUPWITJRCCXDXEHQQYLVPFNZKWXNGEGYNB

C:\ProgramData\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Reputation:	unknown
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\ProgramData\ONBQCLYSPU.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Reputation:	unknown
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\ProgramData\PWCCAWLGRE.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6969712158039245
Encrypted:	false
SSDEEP:	24:zDLHcjI8IQ6sNUYzo1jfRRMF6zzC3ZzNTWx7M00:zDL4ImUYzebRR66C3Z0JMR
MD5:	31CD00400A977C512B9F1AF51F2A5F90
SHA1:	3A6B9ED88BD73091D5685A51CB4C8870315C4A81
SHA-256:	E01ADE9C56AF2361A5ADC05ADE2F5727DF1B80311A0FDC6F15B2E0FFFACC9067
SHA-512:	0521ED245FA8F46DE9502CD53F5A50B01B4E83983CC6D9DE0CF02E54D2825C1C26A748CC27E24633DA1171CE0309323235ECF7EB536D4058214D7618794CF2FA
Malicious:	false
Reputation:	unknown
Preview:	PWCCAWLGRESZQJYMKOMIHTZVFVPFCSAZVTKGMPWIGSDMTLFZQLHJERDPYZCJGFCRLISWNBAMIMDXCWDVGVLWLRBEVYOOPHYWACKPZXSURGSIFWTFUJKLSAQNAJEWDLUIKFHXLUAMUDGRAVFMICAHEZBIIEGWGAVVJHMHSIBGNLEHYVSOKQMYABDYCPEBOGBMYUCIGVRGYYQRAYNYHAIBMHOTRIZLLYBECMXTCFUOVXXHSEMIUWSBDHOZIZZUXFTLKXXNEMXBKLCQDPKVZNOMDYUYJRWCVILZVJDNNBMPTNOFSKRQTILJRXTKDNUIYSQCAOPCQKTXYXPPGZDZOQYLGYFPFIWNBSQZXYABPTNBJQNBZEETJSFXZNHXBRWUHOMCZAGZQJLNPMZFALBBPHBIXZHLBTBJLTUHPUYVUDWDFJANSIIDJVMUYLPZPYGAJWMTOHGILQWHKJDQUWMTSWIBVVZGAHCNWIFZNGNERRKMSIVXWXEXRZZEWYASCIYJYCOOBWRTNZELPWKFVZKZIBGQBLGCTSTNAJSWPHYJCQSYZVFRYFSRAVVXJIOHQCNVEOIMWPEAVCJLBHRUKDHJWPFMXAKTZVQCOUKYCBZFWBREKKHOHZVNMMJZGWIZEYRAIKTHMJRCWVWKNMJNSZHSDRUZSQOJKCTOSNGKOKEAWUIQNIYHWKIIDHKQIJWCSGRRLEVUTENXSNNVDVYDJTIWYNCAZIEBXMIROLIBTLMGEUOCECFFWLENTJSVHFKQHKAPBXQAJJSUOUSFCBQTHCFYZGSVVAUPLQELRWLXRCZSUSFUBCORCWMJPUNHTEEYODSFGJFTDZLLXMQYMIHIZXOYGABIAWYSBWLAJSCKBWGJBVMMJKBKLUHULJIUHQXIXESAUTNVVZNKMIVIOHPPQAWTQSEHTQMIWNPRZRETXZHRGWOTGIEHCCSGIUCKCIFCQPTAJOFCIMYSMCOPGASEEYCNQLXCNRAPQUSQXTWPKPYCQXPE

C:\ProgramData\UMMBDNEQBN.xlsx

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Reputation:	unknown
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\ProgramData\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Reputation:	unknown
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\3SqWYf8qFi.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 69211 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	69211
Entropy (8bit):	7.995787876711886
Encrypted:	true
SSDEEP:	1536:4vHkVfDISE//aDY0WAXTF+0daIpyFQaqPZkatNjgkFOE4/JZZWnEn6:4vHKfMSeKFXdBcmnXkksE40E6
MD5:	753DF6889FD7410A2E9FE333DA83A429
SHA1:	3C425F16E8267186061DD48AC1C77C122962456E
SHA-256:	B42DC237E44CBC9A43400E7D3F9CBD406DBDEFD62BFE87328F8663897D69DF78
SHA-512:	9D56F79410AD0CF852C74C3EF9454E7AE86E80BDD6FF67773994B48CCAC71142BCF5C90635DA6A056E1406E81E64674DB9584928E867C55B77B59E2851CF6444
Malicious:	false
Reputation:	unknown
Preview:	MSCF....[.......,...................I..................WR. .authroot.stl..L...5..CK..<Tk...p.k:.]...k..-.o.d.}.N.F....!.....$t)K."..DE.....v..gr...}?>.<.s..<...{.t..\F.e.F...8&.<..>...t8....`dqM4.y..t8..t..3..1.`\.:+.<].F...3.~.M.B.....J....PR.+..UUUV.GY...8...._vl.....H}.s.Pq..r.<.0.lG.C..e(..oe........9..'8..m.......G8T......sR..&=.J....s.U......#...).j...x.....gq.+.N:.Wj...V.t...(J.;^..Mr~e..}.q....q....eo..O.....@.B.S.....66.\|!.(.........D!k..&.. /.....H~.....}.(..\|.S..~8..A..(.#..w.Y.....'.F...y&.8......f..49r..N...(zX.0;.....000.3c)Z.v.5N'.z...rNFw,E.NY..#ua.o.$..Y?.-.=....}d...]......x_<.W....ya.3.a..SQT.U..\|!.pyCA..-h..Y..>n......^.U.....H...EY.\.......}.-(....h..=xiV.O.W@p.=.r.i..c...c....S.x.;..GWf...=.:.....S.c/..v..3.iG<.&..%...8..=}.....+.n\?0"A.Y%<......+..O. .9..#..>.....5.2.j.1<.Z.>v..j...wr.i.:....!...;.N[.q..z9j..l.R.&,....$.V...k.j..Tc..m..D!%....".Y.#V."w.\|....L\| ..p........w.=..ck...<........{s..w..};../.=...k....YH.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\3SqWYf8qFi.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.112426117535576
Encrypted:	false
SSDEEP:	6:kKNCV/TN+SkQlPlEGYRMY9z+4KlDA3RUe1HEbpo:VCV/8kPlE99SNxAhUe1HEVo
MD5:	EEBE8CA68B5D3146E240E1BF4C97DD8C
SHA1:	AFCDECC8F59DC39F8E9DFAAF3C29B9CA6A30AAE5
SHA-256:	142D5EC120F635CDF149725EA74D5E8F7230947EA7B17E52F4B17FC7EA7AB0C0
SHA-512:	A0CA0DBDF4EBA264355E86AA371AB3B6334676FB5CD4675FDE5D21CF015778935977E585D4C864F7476180E4E1B725D8ACCE8CA17BF2B6B19C3CA62C6BFCBF1A
Malicious:	false
Reputation:	unknown
Preview:	p...... ............ot..(....................................................... .........;.i......(...........[...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".2.c.8.3.b.1.3.b.a.f.6.9.d.a.1.:.0."...

C:\Users\user\AppData\Local\03VPbfdR0v0eUJbl3BY2yvWa.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\06nVIZvE4iGjgzg643uXiijC.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\0MO04SVirwqcj6WPf5Zv7PoT.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.5934969142329205
Encrypted:	false
SSDEEP:	48:Q5vbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:8bGRTihhL6HXYc
MD5:	17C6CD9DE9C27B5D73EF66DDA5502048
SHA1:	A429590DB103BE394F18898AF0F1105BEE4348A6
SHA-256:	7413A6B06C091A78C59975AFCE0D2BE772A905F98BD852CCD6CE16BA5CA4580A
SHA-512:	FEA95677ADFEB687E81411BB056F581E435C82537A986FF9A6CD1172039DC9163F3F4FEB5F2DB2D8318514B6C9F6F2B85972315734783C018D2D955BB6C1055B
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="4NZx8mfjGRy08ENou6ZJ8IRywLXBeCla5jn3pdEI">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\0rPqVWXk4L1q7vaDqSSAYuOV.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.589477210560654
Encrypted:	false
SSDEEP:	48:QfvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:mbGRTihhL6HXYc
MD5:	9A01C47E6AF92F5487F55CA838C8C585
SHA1:	5FEC5CB0E6F79F5F09B97D7D1EC65AB8B3B26934
SHA-256:	AB3A393727A7964D54A455CF2A92A03A8B04B853F3DAC66C1734237C0BC00E8B
SHA-512:	3421BE4B574BA9D1AAA48EDB62FD5D9EB93212FB7C899083641B960403BA06367EA898CB9F2212F6BBCEF13578F4F50A55A2B4B6074A1F5C85EF9AB10F5AE763
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="b2nJBSbLEcDFuNBpYnZa6yvx1Zqf8p7Cv0rsFJDx">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\1IiLAoyBh4YnTxVttC3glecg.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.591178926763232
Encrypted:	false
SSDEEP:	48:QsA/vbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:lAXbGRTihhL6HXYc
MD5:	20D3F63E3FA30A0CF952459CAD05F218
SHA1:	0309C0C86A0226E80E7A42A2724E180719A4DF46
SHA-256:	2A90E0F98B01BA162D8140828126FD4D53CB9FE9C1493B6F4BC223AB1B426489
SHA-512:	694D2A26DF77E39752DEEE1C1EE80E510710E9673FEE390132E827FB6A068A129D485FD3F9F1EC8B47B7DE1011324353F0C5DE9F6CB7413D394DAF025B5AFDE4
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="Z0Y4lmnetww1Wlx4OWOy26iUwEKlCx9EEIPeD85W">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\2mVrLbuGc4HvqI1vBpAy5Z7r.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\2xlrDVEKDyhTNLHkwA8DqN66.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\5QpyioUXq8ASWQahMvzU4ahz.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\6z1e79d9YW0aNxV6xEjP29XG.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.7684744475228085
Encrypted:	false
SSDEEP:	49152:DnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHZ:uWqlkLESgCRE/vhOjb05efd6e/oXHZ
MD5:	9D6D8C23FE185D39AA9259B64543248E
SHA1:	C398864928A1C4A96DF40F0F249DF3FD86B00A2A
SHA-256:	885FC53BC83438AB500EB7FAC5A5A37D9BE824C65122BC731016540C31633389
SHA-512:	E7DBCCD4273034FC5F24719F2958B908998ECDB10EFE244A20685412921D267E13C16AC492A96590323121CDBB7D1CDF782F6BFA562FD0835C4568DE749FBF02
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S......-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\87JPMSplrYgzi5Cttm3Z375k.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.5944565456773026
Encrypted:	false
SSDEEP:	48:QNCvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:qGbGRTihhL6HXYc
MD5:	19FAF3E185160C000923046DFB83A54E
SHA1:	9E8582102E54A52A3E3AE15E18AA7E34C811288C
SHA-256:	A96B228C294474805C391BDB09EC70E162667EF96C505212A1689561FE50EEAF
SHA-512:	AAD64924C0AE35F7E71B405B9163AA293201D1ED5085759D1F7C1D2BDFC2620830A7BA4B420444517226A11795633FFCC050F9712E8910155A79957342D12906
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="uG72uopF2AYtkCBSPuDNGwEHTvYx5cQyL3vf0OMw">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\97vQigClUgXPlHCQsrK19F5k.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\9HGEbLH7EssqmLwFcrlZYSWT.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\9er3Js7GDifxgqZh2XipvtXh.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.5950357282118865
Encrypted:	false
SSDEEP:	48:Qc9vbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:jbGRTihhL6HXYc
MD5:	8C86009F112CCC03B42F85A4E9D00D7E
SHA1:	CE41C078EE160C1DD5597AAE9E5E354A6A9490D7
SHA-256:	8BE265E45535E7F92F7F7FD95897FEA44E2D457596491E53AC4EE881F2D1D1F3
SHA-512:	7222C01529CB5BEA77C5714F94C5ADBEA078ADFB33C5204E43F3B81440013FBE7294A1CDB39B722072852E965032972653AB4201E972FD0A2F8F212B556D9C47
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="Fn7iRFR5EaLZfC8IF7qQZVwnkDuXuc9KBmF0ri1q">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\9pxDWajsJYwYwL1brTzHEdek.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\B8Lqzc0h0CXWQep40oCdtIvu.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768477352100368
Encrypted:	false
SSDEEP:	49152:SnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHO:xWqlkLESgCRE/vhOjb05efd6e/oXHO
MD5:	AEC29038F28A2E108580AE0EEFF02CA1
SHA1:	37B3ADDFCD4B7363D183836AF69CF7B3439AB34F
SHA-256:	8E0B511B5C14173B2933BCF7B24C31CB4B1196E07C80AFC94A0762FC15F33AF2
SHA-512:	D1B799BC93CD0288DB17CC20D8397CF1164CF87B7A0CAA74C9D6F65BBC012933B48E3392BAB01DBE86238714743D186FB551F2DE0004F29FC8BC6F3439A6D5B2
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.......-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\B9mSYpwKkVgW9jJSaxBMcATu.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DG5NfvChXpdFrpWmBrnRWaQb.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DOHofbJiGO0ppvf8BnLjEcOT.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\EGZvqStEuOZgeHhVMxPhyZjZ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\EfWbusCUqNvTcQMtFkj7YUGY.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\EwzOUe6vEjttYfeygpeUfeHd.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.7684788886449265
Encrypted:	false
SSDEEP:	49152:AnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHD:DWqlkLESgCRE/vhOjb05efd6e/oXHD
MD5:	B45C1FA86E412EA2EF84700E4E5FDAA2
SHA1:	F30CFB4B6C1CF0AC7FC38560E206A501D86C98B6
SHA-256:	6F4A53B48E3A48A598CD4D8CFFC5A7E8CF1FBDB8E7E8AF435A835F8D2ACDA2FF
SHA-512:	597F9E23BE2A68D8B9551CFAA987A467126E1726F6C0C70B4E89F2EE5546B6864A2AA43D6EB37C72FC41C8D50D25CB7D2F85C948DC6ADCC56FD1A5F991119216
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S...........@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\Ge2xGCQPLJT2DzNk3YNjEyuZ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768474475729983
Encrypted:	false
SSDEEP:	49152:RnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHa:4WqlkLESgCRE/vhOjb05efd6e/oXHa
MD5:	1A962D068BAAA6EBDF686E99D21C8B1C
SHA1:	4A14CF4732149E362B20E7D764045E5868B19A1A
SHA-256:	5AE1502FFB9365AAD71C053BF21E868FB7B9E8ACA5B524A3BD84AA48D30B7F0D
SHA-512:	426550E1C10C742FE30CEE0EFF81BB3FA405D6FEE2ACA853E51D78E668ED8AD0CF9FF43D2213A4575F468D0133DE4AB296CB37AF76A0E871A99A086FB6ED9DD9
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S....."y-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\GfRX4UT2Opv4sOsHjzHHVCjf.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\GzgoX5V54ke4dVGjS16ex045.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768474603168777
Encrypted:	false
SSDEEP:	49152:cnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXH9:PWqlkLESgCRE/vhOjb05efd6e/oXH9
MD5:	08E95226386FC4EB5E6002A38F7C62CE
SHA1:	77CCFC55BBF395AD554070C7C4142F1615FE19ED
SHA-256:	92917B24FBA11EB44C77E063901C1D6E50C41A8454DF90A7F82E1FBF2E61BADB
SHA-512:	94C91E4636F4896A8128693B0B20868E621153B372B9680C9E6AC1094A7B8F278CFE4FE685E248078FD60D3494DB2D4B168D6DBCE7D267AE28B438168D4C4050
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.....B'....@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\HKhPqHszLj6gz3A9XYe5jsNS.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768476278129193
Encrypted:	false
SSDEEP:	49152:lnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXH0:8WqlkLESgCRE/vhOjb05efd6e/oXH0
MD5:	968B869AA841B0C675BF2C61DFEAA509
SHA1:	78DB97489F21B53BC7F580F107BD2D1B19D70864
SHA-256:	2249D665BDE0C3FB63E2D24EECA3FFC57DDC4E11C108BE6D23BCE4648B2241EC
SHA-512:	87C005BB51AA85B2C289271F925FDC0B7D02B06670A31C6B699956880F1B925E28333C9B9975B564B44C6C3C65E504269143A2874C38CD000ABEC0A75A2D5EEA
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.......-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\HfRmesToGDAxeXrQ5sUnZbvw.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\IC4DTPQmGTctezS5guL9vFLJ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.590320057990015
Encrypted:	false
SSDEEP:	48:QTmVvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:ndbGRTihhL6HXYc
MD5:	124D3780E1935118528A0A552818A614
SHA1:	054C37F4EB32FFDAD8236083A900D0D025F20C73
SHA-256:	B19A421026346DABFE3F82E4D773B052716EC5FD1568D5FC5E36D995330633F9
SHA-512:	4E90BE6F337895D30297B3D4BDF80C1A58B4E22122A15E728CEDE35CF8EA18173F42E3678493EC96F83CA0FF2790BCA55DB9A47A14968B0E499CE8718657F818
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="27HlViOL8qwizSs6Avgr46uwzrsVUNftxEzfpaDk">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\ICXg2Ke2vnpuobif1V7ZIlR7.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.587631067826824
Encrypted:	false
SSDEEP:	48:Q0vbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:RbGRTihhL6HXYc
MD5:	0B33AEE427F9E9D9A927128F0F787D05
SHA1:	0B079A9949FD95E0EA4B2CAC3297F0C13F8215CA
SHA-256:	83AB5E77FDF50ACBE15AE1BF6323E32FC7C8D95D357986B10661410B4BABC3D9
SHA-512:	E25FB7EF9D9579FDC47A938CF7BDCFC372181A2962C9165853FFE6745B1D9050C64EF0E5073FE3FC4BD49630D227473AF3BD87903923A883E48C177441B350E7
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="28rddVnKHdbl0f6S8oOnhmqoec0XbU5dG65NOGGE">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\IGVy70B2MbWqfodclXqYMOZv.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\J5gykLd70qOkxMaAyCwBf3AO.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.594796492064785
Encrypted:	false
SSDEEP:	48:QhYvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:LbGRTihhL6HXYc
MD5:	BB40AAC6F8024856A8C512BA3D3F6482
SHA1:	663C78256C81721031771ED0BDA556040CB5AD63
SHA-256:	BF049555FAA65A3B38AE190B9F47EF9E1E54A8A1C52363E89C9F634FFE3DEAB4
SHA-512:	AB524A0492358AC6FE09653E0D10FAFE5669CB402B942B89E71AC27EE54B448C91B8647180C367ACEFF43B3B73DC8266BBF78D7FDC60121287D4EE3C14F9AD8F
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="hJhShjx3YLxcWDxhE2dK9WLYa5FwYJAC93ogLKKU">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\JmFHdFFXnf32rCkwI8iKN74G.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\KFfdFQJ0GFXA36ymuAOaK0ZR.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768478933370879
Encrypted:	false
SSDEEP:	49152:CnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHg:BWqlkLESgCRE/vhOjb05efd6e/oXHg
MD5:	18A0C971C87F30E90DC78E5331D1643C
SHA1:	E76C6A0F9611032E9505FFD1AE175F754BA9656B
SHA-256:	8B2D66F20A317A29C73B8C127065F85F19C948075958E5136655FCF4F3C7BE5B
SHA-512:	4CF2FE3A995D2153FDC27208F0061C3981EFE5E0A3D0A8B8D7EB533969E180C224736C090BEC959FA8A2407FB7A372DF8B8BEE4B168602148AD1C07333AB6E0D
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.......-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\Ktf4CHbIF92R4VV827YiDPbm.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\LAJLX2OtZ85vzPOftAYRcEsi.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Lp5WnTgHCMiSZVksHSRp5zyx.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\LulQEAYQpS9lk1qZLpImyHK7.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Lx8QrL0pgGPlzgQWZQW3XR1F.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MLm2a0TiwOQvrEuSm0y6Hlo4.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\MW0Q5IkKXdDw9nrX6CojJx9n.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.7684784672148375
Encrypted:	false
SSDEEP:	49152:znSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHu:+WqlkLESgCRE/vhOjb05efd6e/oXHu
MD5:	E2DB55FB4F95CEA3A702E64BFD6FFDD7
SHA1:	EC2F8E7BA489AD5764F5B1ED1D3F065BFBCB102A
SHA-256:	BF53EBA11C956500EE629965DA5C23F3D589AFD3B0BD8191224372013EFEC81D
SHA-512:	8729AB9F745FE9DB0454C81AE7A441B8799749D2C3FBD75D3EA33E96D4704A25510BDBA28EDD5418DBD03057FFEDAC83708666FFB6BA06C9683BDE368DD5221C
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S......q-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ping[1].htm

Download File

Process:	C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Ledger-Live[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	103424
Entropy (8bit):	7.639291916844074
Encrypted:	false
SSDEEP:	1536:iyhXGdtNbMAxKOcuS11Phbiyn2TCdfGyJVGJkyrt517EwM+9hQ9xKOcuS11PhbiW:i8XG/NbMAsISnRGPJkGt74DsISnRF
MD5:	42B838CF8BDF67400525E128D917F6E0
SHA1:	A578F6FAEC738912DBA8C41E7ABE1502C46D0CAE
SHA-256:	0E4FFBA62CE9A464AA1B7FF9F1E55ACE8F51FF1E15102D856F801A81F8B4607D
SHA-512:	F64B39D885375251AB7DB72C57DC5B5095F0C6412169F1035D1F6A25B8415A2A01004D06BFA0267CF683EF7DEA7A9F969AD43FDE5A4376F1FCB65A57403433C0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0......v.......:... ...@....@.. ....................................`.................................J:..O....@.. s...........................9..8............................................ ............... ..H............text........ ...................... ..`.rsrc... s...@...t..................@..@.reloc..............................@..B................~:......H........,...-...........Z..(...........................................J.r...p.s....(....Js....%o....o....&..(....6.(.....(.....0..$........{....,...}....r+..p.s.......(...."..}......(.....~....-.r...p.....(....o....s.........~.....~............~......( ...Vs....(!...t...........{...."..}.......0..7.......s".....(.......+.......o#...&.. o$...&..X....i2..o%...R....2...}.....(.....0...........(P....sf...}.....r...psZ...}......{....sg...}.....s....}.....(`...}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Opera_108.0.5067.24_Autoupdate_x64[1].exe

Download File

Process:	C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	60341248
Entropy (8bit):	7.9999847430357836
Encrypted:	true
SSDEEP:	1572864:PQlb1K2VRNro3znhnh15oy4WHfGVu9tNn8XGGub0mHmQM:4lp1Rxozhh74YfT7MGdZS
MD5:	899BFC77D3084FEE474EB6D12AD09980
SHA1:	52B13F0DD078DFBC6F989EBA1355240B2A6DE004
SHA-256:	FB9C038C94050817310EBDAD7D9349630FB4E4474AAB23516090A85D30EADCC7
SHA-512:	FE860B5397F8DEC9532D7CE7BDCD6206D5FAA0F97FBF0A6EAA16F5BCBFB86DF0D97E2DB4F5934A41EBD4BE5DB41C9C1E492E27D7B19FD79CCA572A81589BE3EF
Malicious:	true
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@..........................................................................b...........................)...........................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.\|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J\|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...\|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.\|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.\|..6....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Opera_108.0.5067.24_Autoupdate_x64[2].exe

Download File

Process:	C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	64869376
Entropy (8bit):	7.9999865343961005
Encrypted:	true
SSDEEP:	1572864:PQlb1K2VRNro3znhnh15oy4WHfGVu9tNn8XGGub0mHmQ8hop:4lp1Rxozhh74YfT7MGdZr
MD5:	D4B17A451511DF665A8007BDABC8081B
SHA1:	F04076C52E65E8195DFCE7D8CBEC06469BB0EE4F
SHA-256:	2FE939A5E8A9B8CA1B001C79A45C89F00761E65F24369853F0CADD59278237C1
SHA-512:	661C6C4BC073ADF704B11E4F5105CB7FC5B312F4BD19EC13CD81FAC5CDAD31EAD6CEEDE7DE78AC57DB645EB2BE6782FEC40CB314937020B66CF0AE1348D51E78
Malicious:	true
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@..........................................................................b...........................)...........................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.\|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J\|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...\|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.\|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.\|..6....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Opera_108.0.5067.24_Autoupdate_x64[3].exe

Download File

Process:	C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	6.41359178857374
Encrypted:	false
SSDEEP:	384:HcuogPGiR1HUv+PcmfbDJMtcodq1v98sFD6tqLIo:HcuLPx/MICtcGqZTGtxo
MD5:	2F84B47F2146465C02A7B609F1D43A60
SHA1:	163090A9EB9FC7744C876114419708F549E84A38
SHA-256:	317639883C5D14108E5AC6245AFF5E5FCACA15D23A1FF6174AB8073A3B0DCA79
SHA-512:	3B8FC136658E5DFEB2FAD2D2B907B4091390E0DD6C3FEDB414F6CBC08E1007B34BBE29E247F6A4E44D8803D32BBCC6A3306E770090E4E365D2F18CB78229C63A
Malicious:	true
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@..........................................................................b...........................)...........................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.\|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J\|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...\|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.\|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.\|..6....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	19253
Entropy (8bit):	5.005213177851637
Encrypted:	false
SSDEEP:	384:JVib49PVoGIpN6KQkj2kkjh4iUxGhQw4h3OdB0NXp528vOjJwYo8YKib4o:JFPV3IpNBQkj2Nh4iUxGhl4h3OdB0NZf
MD5:	83CC0A063AE0CE6A770449E01B262D4C
SHA1:	C7CE3B64EDC6EE028A45E627CF26BF4FD53B71A1
SHA-256:	A9AEE05DF0FDCBF68D93BCDD148D152AA05DC301F6C7DA4E450C8D38AAF195AA
SHA-512:	BF95B77DBCDF81F4DE6D9D4CBCFDC286129CD413BE5C4196E22D9CDC8807FB9BC58C3F3F779157A85C9301EC4AC0EE12BB9E34F8B75AA6ED0C55DD80374D37A2
Malicious:	false
Reputation:	unknown
Preview:	PSMODULECACHE......e..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.............z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Reputation:	unknown
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Nq9MYb4uPnSDV9cCg1KHXQbW.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\OHK6a4WIJ0F6rlhWGJwMYrRP.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768474686252889
Encrypted:	false
SSDEEP:	49152:TnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHR:eWqlkLESgCRE/vhOjb05efd6e/oXHR
MD5:	E7B0996EC1DB9891291BCF610944BD08
SHA1:	296335E95A28B96C2625ECECA861B13F81344105
SHA-256:	20AF48449A47172E31F7ADC1A22A5AD2782A5B9BFD116C44C3E6EC1B12AE04B6
SHA-512:	C36D6C4D36453DF372E306A2A5BE28E2985CFA3E525814C149F4404AB33CED3E751B057668E70A4ACE2AAB430EBC089EC88DFF8923AB4C6846422D54862B294C
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.....Sd-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\PRVOgEotbjGXE8sD4i3FyhZT.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\PgyoyDyjTaeBIiR0ZncnFz3x.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.7684771284236795
Encrypted:	false
SSDEEP:	49152:5nSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHx:AWqlkLESgCRE/vhOjb05efd6e/oXHx
MD5:	9BFF769347ADF4195895A2AA8C977EFF
SHA1:	6FFFA44F2676944F8EF58FB5CFD95BFEA01C881E
SHA-256:	08C8D1F053816719D8F03C23C2FDB3AB6D6DBE21DCB17B513F109DAEE3FA8EA3
SHA-512:	70A39EE9C5A37F891EA01618DC3E3ACF1A78E73B7619FE75A275532A43946E834420EC7BC41B77626853918075865C8BC06B7FEC2FD81B5E54C506A59E6D1E8F
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S......+....@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\QRVPcUOZwKQgBVL5bWKd8sH5.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\QXOXdXIs2CDsFYBPsa07tHNX.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\S58tmyihHBD6BmCz1ZODtpm0.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SN1mrhiBAGt5YdpSiR94ouLj.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SgphKg63629U7dMJ7gswdhRB.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768475062916736
Encrypted:	false
SSDEEP:	49152:JnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHy:wWqlkLESgCRE/vhOjb05efd6e/oXHy
MD5:	5A5F1F5AC33EB04DA8C532DBA872AF5D
SHA1:	7128141687FFB1B0332F8F5BC99C93977E360215
SHA-256:	F4BAAD410FD3ABD0DCF086FE6F0AADFB5B20C833AE37A7162F5677541102C46A
SHA-512:	A5960BDBFA8F7632D60FD538901052C6EFD3CF1C9A0301D5AD735BC9256B280CE7684CEE76FEE9325532C39A6B37621C56BDA966C73BAE0678CB89ACC90F17F6
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.......-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\ShUBAVvG4N04pgkRyyhwlthp.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Slo3nPYDYKdAC0gOANfeI09y.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Sp4RC4Fzn9R3nxCm7XaceyVC.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\TdtQ1FE4bYO5ogxoTGdiEN38.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\2n6aZsnLKtKXJNMzWvG8Ou1L.exe

Download File

Process:	C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768476822870185
Encrypted:	false
SSDEEP:	49152:snSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHa:/WqlkLESgCRE/vhOjb05efd6e/oXHa
MD5:	3C982E3594F2F49BE9CB21C88EDA12D6
SHA1:	11E9A1EA3A396FF4C8E988AD18547BC32271BA8F
SHA-256:	1D9260EEC107FE58C47C5EC70F99C91739FBA13EC8C90C92D432BDCA6796C381
SHA-512:	14916A03F1D9229EBD91FF2E08788880100139DA3BCB9FD2601EF800F9A156A58E2DA5E27CE8A0CCE1FB39DC836DC4803B6ED8EB9E6FD8D9D98F4B046F5855F5
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.....).-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\Rfsq67IamA4rPpnX6LHMDFkm.exe

Download File

Process:	C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.7684771284236795
Encrypted:	false
SSDEEP:	49152:5nSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHx:AWqlkLESgCRE/vhOjb05efd6e/oXHx
MD5:	9BFF769347ADF4195895A2AA8C977EFF
SHA1:	6FFFA44F2676944F8EF58FB5CFD95BFEA01C881E
SHA-256:	08C8D1F053816719D8F03C23C2FDB3AB6D6DBE21DCB17B513F109DAEE3FA8EA3
SHA-512:	70A39EE9C5A37F891EA01618DC3E3ACF1A78E73B7619FE75A275532A43946E834420EC7BC41B77626853918075865C8BC06B7FEC2FD81B5E54C506A59E6D1E8F
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S......+....@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\UPwYHcUA3TbsX6l2qc9SZcBH.exe

Download File

Process:	C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768476278129193
Encrypted:	false
SSDEEP:	49152:lnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXH0:8WqlkLESgCRE/vhOjb05efd6e/oXH0
MD5:	968B869AA841B0C675BF2C61DFEAA509
SHA1:	78DB97489F21B53BC7F580F107BD2D1B19D70864
SHA-256:	2249D665BDE0C3FB63E2D24EECA3FFC57DDC4E11C108BE6D23BCE4648B2241EC
SHA-512:	87C005BB51AA85B2C289271F925FDC0B7D02B06670A31C6B699956880F1B925E28333C9B9975B564B44C6C3C65E504269143A2874C38CD000ABEC0A75A2D5EEA
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.......-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\j1XOgROBJfvz0cRzU7rPw7NS.exe

Download File

Process:	C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768475333252262
Encrypted:	false
SSDEEP:	49152:YnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHp:bWqlkLESgCRE/vhOjb05efd6e/oXHp
MD5:	6E7737F5251D3BC5CF1D0D75778589ED
SHA1:	FE773AF6E4847CC1893C73D7E0EE05142D3EDB9A
SHA-256:	C7C078AC18647609190584E1EA4522D4CE069FCD1469A65DE79D5AFD099E8765
SHA-512:	ADFE96E47CB427766B69824931D8C7A35DF1A9C4C2BB7D10298FA03D7021CE5DEDE5280A5723C92786A1C3C372F2D994EE9B43DE0908B95E6C95911B52B7419A
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.......-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403121204471\opera_package

Download File

Process:	C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	64868352
Entropy (8bit):	7.999986532509756
Encrypted:	true
SSDEEP:	1572864:PQlb1K2VRNro3znhnh15oy4WHfGVu9tNn8XGGub0mHmQ8hoB:4lp1Rxozhh74YfT7MGdZz
MD5:	8A1300CCA66383243E828B240A689261
SHA1:	9B2C4F18692D59A050B6CC860E2A4263BD90908C
SHA-256:	45EC0B5F30533D9B75890DBEEF6DE2AB8BADA9D82176B9B2A026E99C5FFC2AA6
SHA-512:	6FEEA18F2FED2538AB5419CC41628C83CAFB9FF2FA5F559034FF68E0A07CBBC1C375F81F6263D30BF2AD74047F55F2A83488BB261DDAC5864C1DE9DFD495C43D
Malicious:	true
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@..........................................................................b...........................)...........................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.\|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J\|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...\|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.\|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.\|..6....

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403121204571\opera_package

Download File

Process:	C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	60340224
Entropy (8bit):	7.999984739399925
Encrypted:	true
SSDEEP:	1572864:PQlb1K2VRNro3znhnh15oy4WHfGVu9tNn8XGGub0mHmQN:4lp1Rxozhh74YfT7MGdZb
MD5:	7F38492E101B02AB323B52C8AF9E7A0A
SHA1:	E59045C7029F7E5A3484B86B092640E8AB6B5A9B
SHA-256:	28873E6491E6269A15A3FD272745B5E7215746309FE95636DB55F79B41037348
SHA-512:	3D708AE35565A6833AE84083FD30199197A5920BEC123CE4E6CFFB4D5F41A260FCF51470F0F1599878830B6A10376D8F19C25A8F8F999AD9000872AC569F90D6
Malicious:	true
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@..........................................................................b...........................)...........................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.\|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J\|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...\|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.\|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.\|..6....

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202403121205051\opera_package

Download File

Process:	C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	6.41359178857374
Encrypted:	false
SSDEEP:	384:HcuogPGiR1HUv+PcmfbDJMtcodq1v98sFD6tqLIo:HcuLPx/MICtcGqZTGtxo
MD5:	2F84B47F2146465C02A7B609F1D43A60
SHA1:	163090A9EB9FC7744C876114419708F549E84A38
SHA-256:	317639883C5D14108E5AC6245AFF5E5FCACA15D23A1FF6174AB8073A3B0DCA79
SHA-512:	3B8FC136658E5DFEB2FAD2D2B907B4091390E0DD6C3FEDB414F6CBC08E1007B34BBE29E247F6A4E44D8803D32BBCC6A3306E770090E4E365D2F18CB78229C63A
Malicious:	true
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...'..P.................(...F.......-.......@....@..........................................................................b...........................)...........................................................@..d............................text....&.......(.................. ..`.rdata...5...@...6...*..............@..@.data....)...........`..............@....rsrc................h..............@..@........U..`.A.......S3.;.VWt.f9.b.A.t...`.A.P....P.\|..Y.nj'.v....u..v..=.BA..6P......P....9^..].v8.^..3......hhDA.P..........P......P..pAA..E..E....;F.r......P.J\|..Y.24..j...lAA...t$..D....3.9.H.A.t...@....9D$.t..t$.Ph.....5@.A....BA.3.....D$..`...\|$..u..@.....3.....t$..D$..t$...`.A......t$...P.Q..%`.A...D$...V...t...P.Q...^...VW.\|$.....t...W.P.....t...P.Q..>.._^....T$..L$....f..AABBf..u..L$.3.f9.t.@f.<A.u..S.\$.V..C;^.tLW3.j.Z...........Q.......3.9F.Y~.9F.~...f..Af..G@;F.\|..6....

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\rMuSSyE2z14xNxfrVLVv1kvs.exe

Download File

Process:	C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768478933370879
Encrypted:	false
SSDEEP:	49152:CnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHg:BWqlkLESgCRE/vhOjb05efd6e/oXHg
MD5:	18A0C971C87F30E90DC78E5331D1643C
SHA1:	E76C6A0F9611032E9505FFD1AE175F754BA9656B
SHA-256:	8B2D66F20A317A29C73B8C127065F85F19C948075958E5136655FCF4F3C7BE5B
SHA-512:	4CF2FE3A995D2153FDC27208F0061C3981EFE5E0A3D0A8B8D7EB533969E180C224736C090BEC959FA8A2407FB7A372DF8B8BEE4B168602148AD1C07333AB6E0D
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.......-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\zKY9gVt7bugdAVV29pfHDO1J.exe

Download File

Process:	C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.7684744475228085
Encrypted:	false
SSDEEP:	49152:DnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHZ:uWqlkLESgCRE/vhOjb05efd6e/oXHZ
MD5:	9D6D8C23FE185D39AA9259B64543248E
SHA1:	C398864928A1C4A96DF40F0F249DF3FD86B00A2A
SHA-256:	885FC53BC83438AB500EB7FAC5A5A37D9BE824C65122BC731016540C31633389
SHA-512:	E7DBCCD4273034FC5F24719F2958B908998ECDB10EFE244A20685412921D267E13C16AC492A96590323121CDBB7D1CDF782F6BFA562FD0835C4568DE749FBF02
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S......-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240312120439871.log

Download File

Process:	C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe
File Type:	ASCII text, with very long lines (521)
Category:	modified
Size (bytes):	4776
Entropy (8bit):	5.55080762210388
Encrypted:	false
SSDEEP:	96:VTYyx7ALJieh3X5glYjXLmX5glnZK0DX5gl/:VTYyt4EIn5gajXLS5gK0D5gV
MD5:	287E24DD8D34251F23E8608703D0BF20
SHA1:	036FC6F8C82E704F4EF30B01F47DEFF62EBC455F
SHA-256:	CA3E8720E6B2D292E202862DBBA0B26F8E32686CBC8256FAA72F432B565C299B
SHA-512:	3414E3310D65AE72C83B164F416EAC865922E7C3CC252A98EE3D08C1224CCCBCD0A271905ECF5B2BB4564965AAD9BAB4013D020E830B531FD749144C6A8E5B06
Malicious:	false
Reputation:	unknown
Preview:	[0312/120439.871:INFO:installer_main.cc(455)] Opera installer starting - version 108.0.5067.24 Stable.[0312/120439.871:INFO:installer_main.cc(458)] Command line: "C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe" --silent --allusers=0.[0312/120439.871:INFO:installer_main.cc(480)] Uninstall:0.[0312/120439.871:INFO:installer_main.cc(481)] Silent:1.[0312/120439.871:INFO:installer_main.cc(482)] Run Immediately0.[0312/120439.871:INFO:installer_main.cc(484)] Backend0.[0312/120439.871:INFO:installer_main.cc(485)] Inside package0.[0312/120439.871:INFO:installer_main.cc(486)] Autoupdate:0.[0312/120439.871:INFO:payload_manager_impl.cc(97)] Reading Payload.[0312/120439.871:INFO:installer_main.cc(636)] Tracking data: MTBiNzE4Yzk2ODdjMGFkZDk2OTQ2ZWUyOWNkZDE1ZWMxZjBjNjczYTQxMWJmNGNkYWU3ODUxN2FmN2Y2YzRlZTp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240312120451637.log

Download File

Process:	C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe
File Type:	ASCII text, with very long lines (521)
Category:	modified
Size (bytes):	3990
Entropy (8bit):	5.561389412173385
Encrypted:	false
SSDEEP:	48:6bqfKCbEiCbNCbd8CbsCbnCbiCb5Bs3/bMcVBYVPICSD33FZq77xdL3oPkA3cIGk:Cy0JxIJGhJeciX5gleKU2UFX5glI1
MD5:	D74F043F41FFDFF1545B5E9251E6BB40
SHA1:	53D722D9687FB58D4403CE5D53CD0E48B3A8AA44
SHA-256:	E19D354128B2F3E8D79AD59515B09360F80C111B5167C1019B3A3B4C3EBB27D5
SHA-512:	2F1C2F9106D5D349BEC155EEE30420D9B79C80A558AD484427418ADF32F38776C449EFCD11EDC8772BA5A4F59496A1A6506DC4CEED64E779D494C6AADC63712F
Malicious:	false
Reputation:	unknown
Preview:	[0312/120453.099:INFO:installer_main.cc(455)] Opera installer starting - version 108.0.5067.24 Stable.[0312/120453.099:INFO:installer_main.cc(458)] Command line: "C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe" --silent --allusers=0.[0312/120453.099:INFO:installer_main.cc(480)] Uninstall:0.[0312/120453.099:INFO:installer_main.cc(481)] Silent:1.[0312/120453.099:INFO:installer_main.cc(482)] Run Immediately0.[0312/120453.099:INFO:installer_main.cc(484)] Backend0.[0312/120453.099:INFO:installer_main.cc(485)] Inside package0.[0312/120453.099:INFO:installer_main.cc(486)] Autoupdate:0.[0312/120453.821:INFO:payload_manager_impl.cc(97)] Reading Payload.[0312/120453.892:INFO:installer_main.cc(636)] Tracking data: YjNlYWM0Y2IxOGE2Yzc3OWJkNDE1YmI2MmFjOWI1MTlhMjNmMzM5N2UzOGZjN2FkOGNiMmJkNjFmODQzMzc4MTp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240312120451640.log

Download File

Process:	C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe
File Type:	ASCII text, with very long lines (521)
Category:	modified
Size (bytes):	3990
Entropy (8bit):	5.5715901144696725
Encrypted:	false
SSDEEP:	48:TbqfK7bC7bN7bd87bs7bn7bi7b5ws3lbRcVBYVPx8Cykkr3YFCq67xdL3XP/3c/F:0X4xeFrHsdesPX5glF28dX5glA6
MD5:	DD3970E83586F031FDFA84C12B658563
SHA1:	0FA7A8DE2901F368E9453E4D7EE96E409E964446
SHA-256:	9543EDD35F04560AFAABF02088D7D67AD927136ACB7B112892F52B40C64DC06D
SHA-512:	3A43AA786CA588689630F682E738644B1572E9B24D44AC500D659D6FD2EC7C88CA5D8C715E627F30CF2540AB16288C8B091FF55E50E210A1720937B881A34B58
Malicious:	false
Reputation:	unknown
Preview:	[0312/120453.023:INFO:installer_main.cc(455)] Opera installer starting - version 108.0.5067.24 Stable.[0312/120453.023:INFO:installer_main.cc(458)] Command line: "C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe" --silent --allusers=0.[0312/120453.023:INFO:installer_main.cc(480)] Uninstall:0.[0312/120453.023:INFO:installer_main.cc(481)] Silent:1.[0312/120453.023:INFO:installer_main.cc(482)] Run Immediately0.[0312/120453.023:INFO:installer_main.cc(484)] Backend0.[0312/120453.023:INFO:installer_main.cc(485)] Inside package0.[0312/120453.023:INFO:installer_main.cc(486)] Autoupdate:0.[0312/120453.824:INFO:payload_manager_impl.cc(97)] Reading Payload.[0312/120453.894:INFO:installer_main.cc(636)] Tracking data: OWVlYTUzMjhlOWYxN2IzZDdjZDkxMjdhZDM3NTBjZmYyZjg4OTI3NGQxMmRkZmExOGI5ZDVhZDNjZjgwZWUwMDp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N

C:\Users\user\AppData\Local\Temp\.opera\Opera Installer\opera_installer_20240312120500215.log

Download File

Process:	C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe
File Type:	ASCII text, with very long lines (521)
Category:	modified
Size (bytes):	3957
Entropy (8bit):	5.575752782013909
Encrypted:	false
SSDEEP:	96:HPwkxa5QRgekX2eccX5glSENnFGX5glSVNn:vwkAwgxJ5gsENnFy5gsVl
MD5:	A6350D959829C1AD8C2C451FACB5372F
SHA1:	19F7EC89A77B409CDD676D7F2015C4DF05829B21
SHA-256:	9E0F782452EC55BF4CF711737CC0FA5AC499F9B56D7111184E844236DB5B71D0
SHA-512:	232623AA0944E43868DBA3E40E9DC261399E4B5C19234F133B2781188362B9332A08D7182022E8B38810006965D8FBCBFB85CC1EB21FE84C748D0A73150B9C66
Malicious:	false
Reputation:	unknown
Preview:	[0312/120500.260:INFO:installer_main.cc(455)] Opera installer starting - version 108.0.5067.24 Stable.[0312/120500.260:INFO:installer_main.cc(458)] Command line: "C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe" --silent --allusers=0.[0312/120500.260:INFO:installer_main.cc(480)] Uninstall:0.[0312/120500.260:INFO:installer_main.cc(481)] Silent:1.[0312/120500.260:INFO:installer_main.cc(482)] Run Immediately0.[0312/120500.260:INFO:installer_main.cc(484)] Backend0.[0312/120500.260:INFO:installer_main.cc(485)] Inside package0.[0312/120500.260:INFO:installer_main.cc(486)] Autoupdate:0.[0312/120500.578:INFO:payload_manager_impl.cc(97)] Reading Payload.[0312/120500.603:INFO:installer_main.cc(636)] Tracking data: NjBhOTRjNDcyODRjNWRmNDUzMDljY2U3OWFiY2NkYWM4ZjFhZWNkN2Y5ZGUwZDQ3MTA3NmIwYWIyNTMwY2M1Yjp7ImNvdW50cnkiOiJVUyIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijoib3BlcmEiLCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N

C:\Users\user\AppData\Local\Temp\BroomSetup.exe

Download File

Process:	C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	1828864
Entropy (8bit):	7.40381475947401
Encrypted:	false
SSDEEP:	49152:YUnaQiKJ8N+AadA6mICFhNGffVCPi9NUko6jE:ZwKa+u6mICFSwPKDK
MD5:	EEE5DDCFFBED16222CAC0A1B4E2E466E
SHA1:	28B40C88B8EA50B0782E2BCBB4CC0F411035F3D5
SHA-256:	2A40E5DCCC7526C4982334941C90F95374460E2A816E84E724E98C4D52AE8C54
SHA-512:	8F88901F3EBD425818DB09F268DF19CCF8A755603F04E9481BCF02B112A84393F8A900EAD77F8F971BFA33FD9FA5636B7494AAEE864A0FB04E3273911A4216DC
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...F..^.................P........7.@YN...7..`N...@...........................S..................@....................<.......R.@....`N......................................................[N...............................<.....................UPX0......7.............................UPX1.....P....7..L..................@....rsrc........`N......P..............@..............................................................................................................................................................................................................................................................................................................................................................................4.22.UPX!....

C:\Users\user\AppData\Local\Temp\IIEHCFIDHI.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	103424
Entropy (8bit):	7.639291916844074
Encrypted:	false
SSDEEP:	1536:iyhXGdtNbMAxKOcuS11Phbiyn2TCdfGyJVGJkyrt517EwM+9hQ9xKOcuS11PhbiW:i8XG/NbMAsISnRGPJkGt74DsISnRF
MD5:	42B838CF8BDF67400525E128D917F6E0
SHA1:	A578F6FAEC738912DBA8C41E7ABE1502C46D0CAE
SHA-256:	0E4FFBA62CE9A464AA1B7FF9F1E55ACE8F51FF1E15102D856F801A81F8B4607D
SHA-512:	F64B39D885375251AB7DB72C57DC5B5095F0C6412169F1035D1F6A25B8415A2A01004D06BFA0267CF683EF7DEA7A9F969AD43FDE5A4376F1FCB65A57403433C0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0......v.......:... ...@....@.. ....................................`.................................J:..O....@.. s...........................9..8............................................ ............... ..H............text........ ...................... ..`.rsrc... s...@...t..................@..@.reloc..............................@..B................~:......H........,...-...........Z..(...........................................J.r...p.s....(....Js....%o....o....&..(....6.(.....(.....0..$........{....,...}....r+..p.s.......(...."..}......(.....~....-.r...p.....(....o....s.........~.....~............~......( ...Vs....(!...t...........{...."..}.......0..7.......s".....(.......+.......o#...&.. o$...&..X....i2..o%...R....2...}.....(.....0...........(P....sf...}.....r...psZ...}......{....sg...}.....s....}.....(`...}

C:\Users\user\AppData\Local\Temp\Opera_installer_2403121104234259124.dll

Download File

Process:	C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4852640
Entropy (8bit):	6.878125903025885
Encrypted:	false
SSDEEP:	98304:g6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwC:lfKo30lSzTXr4dHUkrPwh/X5zWilPD5N
MD5:	FDEB4D1D95A738BA8882988A97A12D32
SHA1:	42DD25CAE583521AA96A02B5135BBA6FDE9AC3FB
SHA-256:	1C52520C6D2398A266245A1D29FCF5B58FF7BB8F7ECF8868898BAB7BCAD37D6E
SHA-512:	4CB87510D4612A36C83543CA58A17469AA8AAEE569481C121D2D70A7923D7174EFBDCEDE18342F49BB26AA0BBCD44B58630697EF54986AA5EFBF2B3920EF33CF
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e.........."!.....`3..z......@.'.......................................K.....8.J...@A.........................];.m....];.......=..4............I..)....I.p.....;.....................0.;......x3..............h;.4...<\;.`....................text...._3......`3................. ..`.rdata...[...p3..\...d3.............@..@.data.........;..@....;.............@....rodata......p=.......<............. ..`.tls....].....=.......<.............@...CPADinfo0.....=.......<.............@...malloc_h......=.......<............. ..`.rsrc....4....=..6....<.............@..@.reloc..p.....I......>H.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_24031211042526911280.dll

Download File

Process:	C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4852640
Entropy (8bit):	6.878125903025885
Encrypted:	false
SSDEEP:	98304:g6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwC:lfKo30lSzTXr4dHUkrPwh/X5zWilPD5N
MD5:	FDEB4D1D95A738BA8882988A97A12D32
SHA1:	42DD25CAE583521AA96A02B5135BBA6FDE9AC3FB
SHA-256:	1C52520C6D2398A266245A1D29FCF5B58FF7BB8F7ECF8868898BAB7BCAD37D6E
SHA-512:	4CB87510D4612A36C83543CA58A17469AA8AAEE569481C121D2D70A7923D7174EFBDCEDE18342F49BB26AA0BBCD44B58630697EF54986AA5EFBF2B3920EF33CF
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e.........."!.....`3..z......@.'.......................................K.....8.J...@A.........................];.m....];.......=..4............I..)....I.p.....;.....................0.;......x3..............h;.4...<\;.`....................text...._3......`3................. ..`.rdata...[...p3..\...d3.............@..@.data.........;..@....;.............@....rodata......p=.......<............. ..`.tls....].....=.......<.............@...CPADinfo0.....=.......<.............@...malloc_h......=.......<............. ..`.rsrc....4....=..6....<.............@..@.reloc..p.....I......>H.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_24031211042869310536.dll

Download File

Process:	C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4852640
Entropy (8bit):	6.878125903025885
Encrypted:	false
SSDEEP:	98304:g6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwC:lfKo30lSzTXr4dHUkrPwh/X5zWilPD5N
MD5:	FDEB4D1D95A738BA8882988A97A12D32
SHA1:	42DD25CAE583521AA96A02B5135BBA6FDE9AC3FB
SHA-256:	1C52520C6D2398A266245A1D29FCF5B58FF7BB8F7ECF8868898BAB7BCAD37D6E
SHA-512:	4CB87510D4612A36C83543CA58A17469AA8AAEE569481C121D2D70A7923D7174EFBDCEDE18342F49BB26AA0BBCD44B58630697EF54986AA5EFBF2B3920EF33CF
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e.........."!.....`3..z......@.'.......................................K.....8.J...@A.........................];.m....];.......=..4............I..)....I.p.....;.....................0.;......x3..............h;.4...<\;.`....................text...._3......`3................. ..`.rdata...[...p3..\...d3.............@..@.data.........;..@....;.............@....rodata......p=.......<............. ..`.tls....].....=.......<.............@...CPADinfo0.....=.......<.............@...malloc_h......=.......<............. ..`.rsrc....4....=..6....<.............@..@.reloc..p.....I......>H.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043017611524.dll

Download File

Process:	C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4852640
Entropy (8bit):	6.878125903025885
Encrypted:	false
SSDEEP:	98304:g6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwC:lfKo30lSzTXr4dHUkrPwh/X5zWilPD5N
MD5:	FDEB4D1D95A738BA8882988A97A12D32
SHA1:	42DD25CAE583521AA96A02B5135BBA6FDE9AC3FB
SHA-256:	1C52520C6D2398A266245A1D29FCF5B58FF7BB8F7ECF8868898BAB7BCAD37D6E
SHA-512:	4CB87510D4612A36C83543CA58A17469AA8AAEE569481C121D2D70A7923D7174EFBDCEDE18342F49BB26AA0BBCD44B58630697EF54986AA5EFBF2B3920EF33CF
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e.........."!.....`3..z......@.'.......................................K.....8.J...@A.........................];.m....];.......=..4............I..)....I.p.....;.....................0.;......x3..............h;.4...<\;.`....................text...._3......`3................. ..`.rdata...[...p3..\...d3.............@..@.data.........;..@....;.............@....rodata......p=.......<............. ..`.tls....].....=.......<.............@...CPADinfo0.....=.......<.............@...malloc_h......=.......<............. ..`.rsrc....4....=..6....<.............@..@.reloc..p.....I......>H.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043401411604.dll

Download File

Process:	C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4852640
Entropy (8bit):	6.878125903025885
Encrypted:	false
SSDEEP:	98304:g6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwC:lfKo30lSzTXr4dHUkrPwh/X5zWilPD5N
MD5:	FDEB4D1D95A738BA8882988A97A12D32
SHA1:	42DD25CAE583521AA96A02B5135BBA6FDE9AC3FB
SHA-256:	1C52520C6D2398A266245A1D29FCF5B58FF7BB8F7ECF8868898BAB7BCAD37D6E
SHA-512:	4CB87510D4612A36C83543CA58A17469AA8AAEE569481C121D2D70A7923D7174EFBDCEDE18342F49BB26AA0BBCD44B58630697EF54986AA5EFBF2B3920EF33CF
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e.........."!.....`3..z......@.'.......................................K.....8.J...@A.........................];.m....];.......=..4............I..)....I.p.....;.....................0.;......x3..............h;.4...<\;.`....................text...._3......`3................. ..`.rdata...[...p3..\...d3.............@..@.data.........;..@....;.............@....rodata......p=.......<............. ..`.tls....].....=.......<.............@...CPADinfo0.....=.......<.............@...malloc_h......=.......<............. ..`.rsrc....4....=..6....<.............@..@.reloc..p.....I......>H.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043726914020.dll

Download File

Process:	C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4852640
Entropy (8bit):	6.878125903025885
Encrypted:	false
SSDEEP:	98304:g6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwC:lfKo30lSzTXr4dHUkrPwh/X5zWilPD5N
MD5:	FDEB4D1D95A738BA8882988A97A12D32
SHA1:	42DD25CAE583521AA96A02B5135BBA6FDE9AC3FB
SHA-256:	1C52520C6D2398A266245A1D29FCF5B58FF7BB8F7ECF8868898BAB7BCAD37D6E
SHA-512:	4CB87510D4612A36C83543CA58A17469AA8AAEE569481C121D2D70A7923D7174EFBDCEDE18342F49BB26AA0BBCD44B58630697EF54986AA5EFBF2B3920EF33CF
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e.........."!.....`3..z......@.'.......................................K.....8.J...@A.........................];.m....];.......=..4............I..)....I.p.....;.....................0.;......x3..............h;.4...<\;.`....................text...._3......`3................. ..`.rdata...[...p3..\...d3.............@..@.data.........;..@....;.............@....rodata......p=.......<............. ..`.tls....].....=.......<.............@...CPADinfo0.....=.......<.............@...malloc_h......=.......<............. ..`.rsrc....4....=..6....<.............@..@.reloc..p.....I......>H.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043773814148.dll

Download File

Process:	C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4852640
Entropy (8bit):	6.878125903025885
Encrypted:	false
SSDEEP:	98304:g6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwC:lfKo30lSzTXr4dHUkrPwh/X5zWilPD5N
MD5:	FDEB4D1D95A738BA8882988A97A12D32
SHA1:	42DD25CAE583521AA96A02B5135BBA6FDE9AC3FB
SHA-256:	1C52520C6D2398A266245A1D29FCF5B58FF7BB8F7ECF8868898BAB7BCAD37D6E
SHA-512:	4CB87510D4612A36C83543CA58A17469AA8AAEE569481C121D2D70A7923D7174EFBDCEDE18342F49BB26AA0BBCD44B58630697EF54986AA5EFBF2B3920EF33CF
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e.........."!.....`3..z......@.'.......................................K.....8.J...@A.........................];.m....];.......=..4............I..)....I.p.....;.....................0.;......x3..............h;.4...<\;.`....................text...._3......`3................. ..`.rdata...[...p3..\...d3.............@..@.data.........;..@....;.............@....rodata......p=.......<............. ..`.tls....].....=.......<.............@...CPADinfo0.....=.......<.............@...malloc_h......=.......<............. ..`.rsrc....4....=..6....<.............@..@.reloc..p.....I......>H.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043820413232.dll

Download File

Process:	C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4852640
Entropy (8bit):	6.878125903025885
Encrypted:	false
SSDEEP:	98304:g6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwC:lfKo30lSzTXr4dHUkrPwh/X5zWilPD5N
MD5:	FDEB4D1D95A738BA8882988A97A12D32
SHA1:	42DD25CAE583521AA96A02B5135BBA6FDE9AC3FB
SHA-256:	1C52520C6D2398A266245A1D29FCF5B58FF7BB8F7ECF8868898BAB7BCAD37D6E
SHA-512:	4CB87510D4612A36C83543CA58A17469AA8AAEE569481C121D2D70A7923D7174EFBDCEDE18342F49BB26AA0BBCD44B58630697EF54986AA5EFBF2B3920EF33CF
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e.........."!.....`3..z......@.'.......................................K.....8.J...@A.........................];.m....];.......=..4............I..)....I.p.....;.....................0.;......x3..............h;.4...<\;.`....................text...._3......`3................. ..`.rdata...[...p3..\...d3.............@..@.data.........;..@....;.............@....rodata......p=.......<............. ..`.tls....].....=.......<.............@...CPADinfo0.....=.......<.............@...malloc_h......=.......<............. ..`.rsrc....4....=..6....<.............@..@.reloc..p.....I......>H.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043867714488.dll

Download File

Process:	C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4852640
Entropy (8bit):	6.878125903025885
Encrypted:	false
SSDEEP:	98304:g6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwC:lfKo30lSzTXr4dHUkrPwh/X5zWilPD5N
MD5:	FDEB4D1D95A738BA8882988A97A12D32
SHA1:	42DD25CAE583521AA96A02B5135BBA6FDE9AC3FB
SHA-256:	1C52520C6D2398A266245A1D29FCF5B58FF7BB8F7ECF8868898BAB7BCAD37D6E
SHA-512:	4CB87510D4612A36C83543CA58A17469AA8AAEE569481C121D2D70A7923D7174EFBDCEDE18342F49BB26AA0BBCD44B58630697EF54986AA5EFBF2B3920EF33CF
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e.........."!.....`3..z......@.'.......................................K.....8.J...@A.........................];.m....];.......=..4............I..)....I.p.....;.....................0.;......x3..............h;.4...<\;.`....................text...._3......`3................. ..`.rdata...[...p3..\...d3.............@..@.data.........;..@....;.............@....rodata......p=.......<............. ..`.tls....].....=.......<.............@...CPADinfo0.....=.......<.............@...malloc_h......=.......<............. ..`.rsrc....4....=..6....<.............@..@.reloc..p.....I......>H.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043920313116.dll

Download File

Process:	C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4852640
Entropy (8bit):	6.878125903025885
Encrypted:	false
SSDEEP:	98304:g6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwC:lfKo30lSzTXr4dHUkrPwh/X5zWilPD5N
MD5:	FDEB4D1D95A738BA8882988A97A12D32
SHA1:	42DD25CAE583521AA96A02B5135BBA6FDE9AC3FB
SHA-256:	1C52520C6D2398A266245A1D29FCF5B58FF7BB8F7ECF8868898BAB7BCAD37D6E
SHA-512:	4CB87510D4612A36C83543CA58A17469AA8AAEE569481C121D2D70A7923D7174EFBDCEDE18342F49BB26AA0BBCD44B58630697EF54986AA5EFBF2B3920EF33CF
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e.........."!.....`3..z......@.'.......................................K.....8.J...@A.........................];.m....];.......=..4............I..)....I.p.....;.....................0.;......x3..............h;.4...<\;.`....................text...._3......`3................. ..`.rdata...[...p3..\...d3.............@..@.data.........;..@....;.............@....rodata......p=.......<............. ..`.tls....].....=.......<.............@...CPADinfo0.....=.......<.............@...malloc_h......=.......<............. ..`.rsrc....4....=..6....<.............@..@.reloc..p.....I......>H.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_24031211043944414548.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\rMuSSyE2z14xNxfrVLVv1kvs.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4852640
Entropy (8bit):	6.878125903025885
Encrypted:	false
SSDEEP:	98304:g6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwC:lfKo30lSzTXr4dHUkrPwh/X5zWilPD5N
MD5:	FDEB4D1D95A738BA8882988A97A12D32
SHA1:	42DD25CAE583521AA96A02B5135BBA6FDE9AC3FB
SHA-256:	1C52520C6D2398A266245A1D29FCF5B58FF7BB8F7ECF8868898BAB7BCAD37D6E
SHA-512:	4CB87510D4612A36C83543CA58A17469AA8AAEE569481C121D2D70A7923D7174EFBDCEDE18342F49BB26AA0BBCD44B58630697EF54986AA5EFBF2B3920EF33CF
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e.........."!.....`3..z......@.'.......................................K.....8.J...@A.........................];.m....];.......=..4............I..)....I.p.....;.....................0.;......x3..............h;.4...<\;.`....................text...._3......`3................. ..`.rdata...[...p3..\...d3.............@..@.data.........;..@....;.............@....rodata......p=.......<............. ..`.tls....].....=.......<.............@...CPADinfo0.....=.......<.............@...malloc_h......=.......<............. ..`.rsrc....4....=..6....<.............@..@.reloc..p.....I......>H.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_24031211044129216532.dll

Download File

Process:	C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4852640
Entropy (8bit):	6.878125903025885
Encrypted:	false
SSDEEP:	98304:g6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwC:lfKo30lSzTXr4dHUkrPwh/X5zWilPD5N
MD5:	FDEB4D1D95A738BA8882988A97A12D32
SHA1:	42DD25CAE583521AA96A02B5135BBA6FDE9AC3FB
SHA-256:	1C52520C6D2398A266245A1D29FCF5B58FF7BB8F7ECF8868898BAB7BCAD37D6E
SHA-512:	4CB87510D4612A36C83543CA58A17469AA8AAEE569481C121D2D70A7923D7174EFBDCEDE18342F49BB26AA0BBCD44B58630697EF54986AA5EFBF2B3920EF33CF
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e.........."!.....`3..z......@.'.......................................K.....8.J...@A.........................];.m....];.......=..4............I..)....I.p.....;.....................0.;......x3..............h;.4...<\;.`....................text...._3......`3................. ..`.rdata...[...p3..\...d3.............@..@.data.........;..@....;.............@....rodata......p=.......<............. ..`.tls....].....=.......<.............@...CPADinfo0.....=.......<.............@...malloc_h......=.......<............. ..`.rsrc....4....=..6....<.............@..@.reloc..p.....I......>H.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Opera_installer_24031211045859715840.dll

Download File

Process:	C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4852640
Entropy (8bit):	6.878125903025885
Encrypted:	false
SSDEEP:	98304:g6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwC:lfKo30lSzTXr4dHUkrPwh/X5zWilPD5N
MD5:	FDEB4D1D95A738BA8882988A97A12D32
SHA1:	42DD25CAE583521AA96A02B5135BBA6FDE9AC3FB
SHA-256:	1C52520C6D2398A266245A1D29FCF5B58FF7BB8F7ECF8868898BAB7BCAD37D6E
SHA-512:	4CB87510D4612A36C83543CA58A17469AA8AAEE569481C121D2D70A7923D7174EFBDCEDE18342F49BB26AA0BBCD44B58630697EF54986AA5EFBF2B3920EF33CF
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e.........."!.....`3..z......@.'.......................................K.....8.J...@A.........................];.m....];.......=..4............I..)....I.p.....;.....................0.;......x3..............h;.4...<\;.`....................text...._3......`3................. ..`.rdata...[...p3..\...d3.............@..@.data.........;..@....;.............@....rodata......p=.......<............. ..`.tls....].....=.......<.............@...CPADinfo0.....=.......<.............@...malloc_h......=.......<............. ..`.rsrc....4....=..6....<.............@..@.reloc..p.....I......>H.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_140rv5d2.41e.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ftqjsf0.huo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pexq1oom.qsz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vkcd2kvq.ypp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\file.txt

Download File

Process:	C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	500000
Entropy (8bit):	6.021986548032622
Encrypted:	false
SSDEEP:	6144:8HPIkbNcJ6+M+pP4LRgnU1ICrxUqLsxy06Gm856Xorx9ioQbOF/rPsgTtprZP4FR:cPNcsiFU1bxUyXGHlWbOF/rPsgTX2Xz
MD5:	932F74E39CA5186F60BC9349C38DDA42
SHA1:	40540CF3ACC0541FE471259BE690AB3CE36EA13E
SHA-256:	33F115D30E946FBF55BCAE827EC929F0E3DB56CEC856AC04ED4027DF38F70300
SHA-512:	D2EB3C07C5F81F30B3CB158675BDA8D5587ADA41BE520C7A32713DC467E2FC421E66EB9316DDB4A43834EC3AD71D5E56F505E4180BB4055883224D5A1BE32395
Malicious:	false
Reputation:	unknown
Preview:	62lP/4uOUYfKA3tfxllnPzQXGLJgRjFKHZbIa8JtXF+oMlF4/GglqDQr8FrkYyAg2UYkxW9kefTa.NdkIBX7R0MXI/fz98B1G7Pj5EkToaaPHCnfPQ01B3yzo5ZQLm0Y6S/bZwQJ+1O3ua2jO3QslgyVX.0sCO32ZP26v5QpkgPMfQ6LYGfvPw/Z3yBcqZFGQYw5cUpLlOshrhokH3lYs/qr6OjQ02dt2FiG4c.j7nkEUF7P0yh1yFbK6aBHgYiliOsBF11EMx+QWETtPXLfm3WuhyrvcvmBVVi45ayu5vhYo3oTsVs.OnkiYR/v2VjJwSdl7Kwrba3P5cdHh7BefANDi2bGIoafnRn98g4YQtRVgpEQbRULAKJNlIkZjdJa.Q5jw67IDhIDvGxIDdsmr3NOfK/1xuB0at4WFtSvfmJbDum3LacnP4SOeajoPR3rYY1pS6Fg63beJ.RT68kEmTT01eX9bR7KlAuZEj+RDHjsH7c6E10J+z/c2WT1JVqt1kQ1vnUuLi4g9s7asdr8YvGbO5.rnXEUPJmT1wPdrwZUqzoVeZcfjwzkxU96Z3n16J4+lDfw9EXNzQL+M9bLjDDbV1DlWDH8Z9BCxwC.I2JS6ZgnO6lW9qQoOJGp846lYKOogT7bQ7/7BXP+SVKAiBEKhDbX4tfJQT7LvybURsdyt8CH60yU.n6Twu9oiay1ghXYuOEDteKMxfnC3CblbhJtfmTzWoMzg2bQvBKh0DncbCHid49SQkuH+dkCB4CC0.Z3g+r0uRLhtnIfRPToXE8fAQCgSIZYX93cP6ycyQfDC3hP2aqiikKrTeG4asHtXPbnk4bk+GLpuH.6zmu6TKxdRN7RrDgptIGObZxEVKJp35t4sSK7s0TKo3EPakM6AmqpbOwbeSlVU7LAkgj2CDX1gJi.l2hmltKpfpQLAz06AhhRGFk28JMl8O91NhI/y/UwYiMU6jqSTP8FmWGOEgSVUAdUa2HFX441kJ4Z

C:\Users\user\AppData\Local\Temp\nsuA1E3.tmp

Download File

Process:	C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe
File Type:	data
Category:	dropped
Size (bytes):	2560770
Entropy (8bit):	7.400203175030958
Encrypted:	false
SSDEEP:	49152:UnOW3WBEUnaQiKJ8N+AadA6mICFhNGffVCPi9NUko6jE:J/wKa+u6mICFSwPKDK
MD5:	9C363DBE4628244CF11152A6AC9E7413
SHA1:	373546BADE50BA73A7DF136C4F658F94A38E0537
SHA-256:	B5DB2B165823C3322F0140C22BD562C8DF6DC9C585FBF0B11AA899CE6AA8BBD7
SHA-512:	5623665FF16BC4B7FA817B8C9412BB3D219635FDDC510FEEAB431C05A9A09D9E7998CE9AE5837D285193534B2BCE31E93F0AABD9D5F3FFCF3AAD5B48B1441321
Malicious:	false
Reputation:	unknown
Preview:	........,...................G...................................................................................................................................................................................................................................................................................g...............................................................j...........................................................................................................................................8...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsvA4F1.tmp\INetC.dll

Download File

Process:	C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.666921368237103
Encrypted:	false
SSDEEP:	384:KOoVVefeWsI7rsIquPLNN546o0Ac9khYLMkIX0+Gzyekv:4VVaeE7wIqyJN5i
MD5:	2B342079303895C50AF8040A91F30F71
SHA1:	B11335E1CB8356D9C337CB89FE81D669A69DE17E
SHA-256:	2D5D89025911E2E273F90F393624BE4819641DBEE1606DE792362E442E54612F
SHA-512:	550452DADC86ECD205F40668894116790A456FE46E9985D68093D36CF32ABF00EDECB5C56FF0287464A0E819DB7B3CC53926037A116DE6C651332A7CC8035D47
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9<.EXR.EXR.EXR.b.).LXR.EXS..XR.b. .FXR.b.(.DXR.b...DXR.b.*.DXR.RichEXR.................PE..L....T.[...........!.....8...P......I?.......P...................................................................... G..l....?..d.......(...............................................................................P............................text....7.......8.................. ..`.data....<...P.......<..............@....rsrc...(............D..............@..@.reloc...............N..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\syncUpd.exe

Download File

Process:	C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	204800
Entropy (8bit):	6.491606338680486
Encrypted:	false
SSDEEP:	3072:8PDOu5suCmavnBRsuP6GTdbB27zP6FtHPUxX1GOL3+:455zaPBRPPj27uPH8jzu
MD5:	C722591F624FB69970F246B8C81D830F
SHA1:	85516DECEA5D6987BEBE39CBADF36053BEAF4BB0
SHA-256:	13CD1152A19FDAC6581CAC2BD822F34BD3026EA1783FF231E299B6D28C046A6A
SHA-512:	822584C5C8A0813AF4D845E80919776C71A43464AB719D1C303EBAAE6A8ED47763183566BEDC9BE2E8C44DE8EE6FD62D1E12BE471E5D5C73AE4B1DCDAA34A908
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L.....=d............................}.............@...........................#.............................................\|...(....@...x..............................................................................L............................text...d........................... ..`.rdata..@...........................@..@.data...@........(...~..............@....rsrc....h...@...z..................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\TgGBhjAUKSjQAdgyfPvaMx0f.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Ti2wvx1Jt0MWHlDpZMMIhhND.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.598326755201633
Encrypted:	false
SSDEEP:	48:QuZaMvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:1a4bGRTihhL6HXYc
MD5:	3E58AFAD64FE8B9C9BF0E6965F52D712
SHA1:	D8612CE37B4EF238B114E2827A5459A6BDD0981F
SHA-256:	88FFFEA369644E1C47E00FA10447639C2CA853E356E69F2CFF479DF01FE1E8F8
SHA-512:	C27EC4A598477F7C8E2D2A4E25118D101D2BBD9DDEC84BE2DAEB58AA9F709AC4D2C7C39FE35ED71B88CD4C51F8B13A6CC7BA1F11AA218342C44CFF2148317691
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="aNx79O0g6sXKQR1KCbpZG4hi2I6AZAqhzdOHDOXt">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\TmyU19puPszO5dD6QaXXYS9j.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\Tux8yeqUanpZipvXA8WXqYc0.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\UI7LDXaAp2RaeFVHf9g6LwB6.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\UIlVvmdU1KS1YgdCPOj7XPRB.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\UKcOeyzFWKgEp3jiLlc53JId.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.595533707793504
Encrypted:	false
SSDEEP:	48:QgLvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:fzbGRTihhL6HXYc
MD5:	13B2037B37D9201E6813D14CB4C344EB
SHA1:	66337AFB9D5D247D956619D35EFF069DB142004D
SHA-256:	DB67F4B27730AFC2048C2768B25E8F7571D5C70F14D8C2F78910E199091E52AA
SHA-512:	82F974D958D910BF61589C239EA931279BFC2C58CB47E283F658A45959B9949A39263070DFC6D3084DC1E014CEF9A7D0B9F3B76A818C133498648367EDD24719
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="MwksP40RskgWnORq6K9f3ozJ5EEUDyJCn2VvSily">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\UT13zjeHVdOFi7IHMIp0XqHQ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.590337223541327
Encrypted:	false
SSDEEP:	48:QUCbqvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:TU+bGRTihhL6HXYc
MD5:	B5A94B987ED49F492BCF87DD15053839
SHA1:	5026A8B314E8E2C28594BC26278563CD6B7F4A30
SHA-256:	D02A55D9EF31A4E7809258CAD5F5041DB64E61682DBEB8CA646F947B39EE3AD8
SHA-512:	3292C83B39DE3559CC4C1FED9C4B9387D4318E473B418D50606F749B230F246D9550409AC4786B8F3F1F8A70F70C99415249D9C920634FD4E5A48E120A409AEC
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="rKuTmTCuXpc7UEGNshl18cB3xQiQdNmqkc0Ekp8J">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\UrT5ltGRxob1yeMhM5Nnnzax.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\WmGZEzN2y17TSARkq7CMs3oI.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\XcDOAu7dcqSLvLgCVhDWG4DS.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\XgRMsEcdNLhAV5ZMS6q0eNdc.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\YTPWaMfX30OWGAa0N4zQELWE.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.590753339920411
Encrypted:	false
SSDEEP:	48:QZpvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:kRbGRTihhL6HXYc
MD5:	BB46073EB7149CB7C47129B949F37E34
SHA1:	59A27D9243DC3F5C22EA05B2D654BAAE0F36F37D
SHA-256:	9AEFF77BE74D9C3AB9C946D3C11DFCD5D951949F2BBDD14A12703A67670CF7B7
SHA-512:	E75A0D03D091C357123763651B061715E6F3AB9253E17D543FEC83CD94BE95AC242E7151C6ABA6CC01C71968167958C0843A02B209FACEE9A5B30F6D0AEC6ACA
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="aIyJ1aKazSkiOiFuQAsCYrx5ZF0SoVlm37vVIiQu">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\a3F2iXIaBwCbhUUvTA3BBuOE.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\bbLIw48fKM1lzSnI9fseLQ0z.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.584145650247149
Encrypted:	false
SSDEEP:	48:Q8vbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:lbGRTihhL6HXYc
MD5:	6918AB5FE0F7047174C7ED4FF2B40906
SHA1:	DF01CB5C858BABDBB6C30DD75588883BE2DF9A17
SHA-256:	A782A730AF361B55636338A1B665396886602B8017456318777B7BF5E0DB8B64
SHA-512:	EB1756155FEF07EB1C4F4E6895150ACB3D1AB46D37F14F5807A1CCBEEAAB9472D3B358FA9B90F73F7062D90C228FE2FF85D7FFD102BD2819249A9EFC6E848997
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="YugCRGYvABZs24bxsAk3bdxgvxRpioahGCcmqu8S">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\c0Si5Ocs5Hjqmkw7zPRBLU4J.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\eWykOtAnMlV1bwkA64D3jk1r.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\enc9JdewSUMVCRcBLY1bLbUT.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\et1UzaJspSJuRyCxNxPGYCVV.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768475333252262
Encrypted:	false
SSDEEP:	49152:YnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHp:bWqlkLESgCRE/vhOjb05efd6e/oXHp
MD5:	6E7737F5251D3BC5CF1D0D75778589ED
SHA1:	FE773AF6E4847CC1893C73D7E0EE05142D3EDB9A
SHA-256:	C7C078AC18647609190584E1EA4522D4CE069FCD1469A65DE79D5AFD099E8765
SHA-512:	ADFE96E47CB427766B69824931D8C7A35DF1A9C4C2BB7D10298FA03D7021CE5DEDE5280A5723C92786A1C3C372F2D994EE9B43DE0908B95E6C95911B52B7419A
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.......-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\f92wGKeu5LyIAhCs4NxRkLxR.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\fDVyGnt4qkfC1RQX2yjdlha8.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768471320239257
Encrypted:	false
SSDEEP:	49152:pnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXH+:QWqlkLESgCRE/vhOjb05efd6e/oXH+
MD5:	38390F042FA04827219CCFDB855B7629
SHA1:	CF2C4ABC250DFDD263C8BC5D9BD6CE9C087F8312
SHA-256:	D9FA44156C63FAF4DFD4290F9D0D3CBBAB8AFFBD6AE3F78603213E1A2C2E6830
SHA-512:	03DD8659976EEB9D2A461B377280196B186A8C262F621465C20DE6AF01C9C2650CBA3FDA8348659C9D76879B34D28CA62764098CE01C211D80B5B45517B3659D
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.....)4-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\fiUeZNNCTIS5H2aPexzpE5Lz.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\g74FLtS6pxPabgJh1GOJP0y9.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.594983809828944
Encrypted:	false
SSDEEP:	48:QnLlyvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:hbGRTihhL6HXYc
MD5:	18D256A4E60ECF3F2180933B0527FBB6
SHA1:	F979CAABDFB617CA49D2F0BD56AD441368B12432
SHA-256:	0CC1F5F4191453384FA83764C211DDC8FFAA95B1CD034CF174D6F887907A4DD1
SHA-512:	A34AC7C02077AA5D22A76432C0A2A2AE865616FF22C0932810BB220FA112E475F3B4716B6DE848C0140B0B2D9350319552D03A87F236AD408D2738785B3D3C82
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="cmsvQ1Uf0QCx5LezxM5OBIpXbKAsSAp4KKmQv5MJ">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\g8ZqhZX4Hv3yrSl3yliJsZDM.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\guekS5iP2Ex1XPBodoRkDEP3.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\i0DLgyxTLlkFBSXC6EtBlR3o.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\jWtlFlrLdXdhBLj1fOltMT9i.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\jx4EXQWaWISJJqVjnXD4Dqaz.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768473246930771
Encrypted:	false
SSDEEP:	49152:bnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHX:mWqlkLESgCRE/vhOjb05efd6e/oXHX
MD5:	FCED7D5FD85EA8ADC328E305BCDC4BC0
SHA1:	3040EA7407C73F4081727E144A859EA1A074E367
SHA-256:	28D6DBCCF2E99F32D5252C3C5D38F3B1EC411BC75DF7D42D3A6EDDCE48C7828F
SHA-512:	BE900DC66E2AE0B40864CA837E6664D4574D15E9BA1CCF9CBDCFB086CECE10FCB33D168E3BD8B98F21A30F8A99C9012067BB8D5F47A25C56046DF7A2D7BE56B6
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.....?x-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\jzqvqBGkG9ji22i8AoGkLtvR.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.586779401894647
Encrypted:	false
SSDEEP:	48:QhJvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:mxbGRTihhL6HXYc
MD5:	CE44696B51A2768CA98DC4D45D2171E1
SHA1:	49174149AF527BF642FFA59DF9C970D356D0A781
SHA-256:	B96C26167647460AED26EBA64E697DBD9A0CAADF5EE9A767D049240286179027
SHA-512:	BAB5F4E1348A358E21ED3F7F4C39BB547E173DBBEFECA2AAE1E9759D8290B02482EF0F6E112BF159813B3F0A4769DF133F32924B631C12DFA021D855A7A591C2
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="oOSMurELJSk8jXrBoJcRp4GvfH14ggRbvareevaP">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\k6s7peRuTySdHXpiWwpUH9mL.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\kIkH03mHJncFYDqHqXdphzO5.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.594297601765447
Encrypted:	false
SSDEEP:	48:QKcvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:PIbGRTihhL6HXYc
MD5:	91B7AB18F661D03A4A5ED03D6F273AFB
SHA1:	279667419E35B851494B6DA069119018B1433002
SHA-256:	F0685AC53925715533B4D83CDB9400DB0763FAD7AF99F5527001F2BF99E9E669
SHA-512:	7D6EEACFF3387CAF1199FF3BEE84F6A3EC42BFFFE3FCDFBFCDCF7B010C47B80B79D272C2177092DBA80E5664A6302D950230BCE6AC276DB8E1AD583D49B6DD5A
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="54Gr4vO0QVjHFmTudCj687QTyfe4Tew31CNA7X7e">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\ka3JrCFlTPYjnvR6dwKLC1vl.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\kbk5zLOtlX5KBIypEMa7wHhL.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\kujNjTMPu36kPLMvqPBbpIku.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.76847288657226
Encrypted:	false
SSDEEP:	49152:BnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHY:IWqlkLESgCRE/vhOjb05efd6e/oXHY
MD5:	6CE6FA646ED0FF21E6028021912E0C3D
SHA1:	CC28C250494DC88BF2E20B9143BC53B7A9BCD7FD
SHA-256:	CB9706FEBC44B55E895BDDFD2E8C16F194EFD2722EFF3A88D5D89E4625AA6B84
SHA-512:	5672E7C661D45C4E7FB38F6582811FC1C906115A35E4067EB1165B97EECA20B40BB41713F2F0D0A925BDA7F6EF9AC5D8B9EED9DE2F77C6354274C8E1B23D73F5
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.....).-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\lLVPG0Pkhk3MeRMVuEfaKb2V.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\leLskzRZPIglQflslvTIwLTy.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768473268395656
Encrypted:	false
SSDEEP:	49152:wnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXH8:TWqlkLESgCRE/vhOjb05efd6e/oXH8
MD5:	48A60D9CBAB02152380985D0D929D54C
SHA1:	182849A12043A3FCDE02526BE6B16C05F3BDED86
SHA-256:	D1A30CECC38031E3AA72BF7C5D536BED856BB0EB80B3F3B55FC06DEEA8187BC1
SHA-512:	7C4FCC7519461EB58E543FE13DB29507CCEEEA95BA6853EEC5C8860C36739A7CE7ACDF7664B28B7481111F5D7204EC8B95DF8DCFACD471EC649572182D81E598
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.....e.-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\ma5ZV2wEknznzPeuTeaX9Fk3.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\n3Yk1EJMr8upEtxmsPsGJQY9.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\n9Mh8v3pnnImlBJy2SUqnwt7.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.598954164195802
Encrypted:	false
SSDEEP:	48:QtYVvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:IgbGRTihhL6HXYc
MD5:	B0D866208CE77DFC34990A2FB2735AA9
SHA1:	E344685DD5824330B7BE164BAB17AE9E2C5F791D
SHA-256:	B08809664CA1CADD973D18B04B2B50525F4E443A411920A0B74D8C375F6AF094
SHA-512:	B4A0C270067E561014C3C184F4F98539A009AA3FE944203A2C2791FA4A3980D40D0A8A88DD8235C09B47480FEDC9DDA684985279483E7D1BE458E5A7A28D8484
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="zzPhP0EFfBuZh6Y3hjUOeQ0UAQZhBJRF2Jl8Wnaf">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\nDHXe5EkxWeixtBE9998831S.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\nNtGSwumkPliSKVeAx7Sx8Gp.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\nU8NHI9fYTvNPbiYhk76Vc0l.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768477406799686
Encrypted:	false
SSDEEP:	49152:3nSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXH0:CWqlkLESgCRE/vhOjb05efd6e/oXH0
MD5:	D2FAEB1EC860FC058F0FE0BBDA5B1A87
SHA1:	9BDD67B3187884373CDD5CBCD8D6E1C9EDD01A72
SHA-256:	2ACBC1591A3287FEF96640053C9FB8AB623F6E878FA133ACFD83F474F3B420F5
SHA-512:	3DDFB70EB52D83D56A1B853E17EEE0B24D4EBB091321C146F7F86AB34061F8835614FDB59F54E59F044612F622F7FB79F9D33806217A8F61FC6C6DB71F130228
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.....f.....@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\nvMOfQgAbNYiBrdqNEHby9rc.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\oRNRkRJgpfntnnUy3280Q2gz.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.599878785516158
Encrypted:	false
SSDEEP:	48:QDMvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:g4bGRTihhL6HXYc
MD5:	EC425D5958835E12CBF4309E2793D4AB
SHA1:	981AF420B09E350745390400D267FFF2C35793AB
SHA-256:	340963B3CEC0BAA285370DF2E1E140A2BA8451732071CAEDDCAA588BD4779873
SHA-512:	43A281D0842B88DB4A87A5675EB00A86638EC71FEED3FBA436E84A82FF76EC8FE05A3D861EBF67CF695DAEF0E838440549D41A0DEFFC99B138EB6E48C1E8389B
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="mUGp3W170DX4VYo94Bz25vpRwTVSGhPJTi8cQ3jC">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\orrmvmRrWiQUvvR2gvxmt2Uq.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.593494273496843
Encrypted:	false
SSDEEP:	48:QLHvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:mbGRTihhL6HXYc
MD5:	76EBD54D0A6305A316A5975BAAB6399C
SHA1:	D0D63A34F50F294170BC2C08E7CB3F08FBDE0E52
SHA-256:	737B5FAF3FD7927E0B4B04AF7E82E88FE25B0AB6E46435DF6374803C4C39FFA2
SHA-512:	7BCB690CFC1A363791370CC55019463983CDCE70D2C2ECA5C6F3FFB6A17E77C73D23276C7536C6DFB17872CC214AB3416BB0AF9B62402C1983B20E171F46365C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="Aduyc3BFJbYoIsuWbVNtFdg8pwDDGJBmuYik6LEJ">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\pN2O0fDFwQyZhLFu32KEUc8D.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\phZoEhmPHJEnryk70uKpl9zQ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\qLEG52WWxIWvDwEETVieoeBU.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768476822870185
Encrypted:	false
SSDEEP:	49152:snSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHa:/WqlkLESgCRE/vhOjb05efd6e/oXHa
MD5:	3C982E3594F2F49BE9CB21C88EDA12D6
SHA1:	11E9A1EA3A396FF4C8E988AD18547BC32271BA8F
SHA-256:	1D9260EEC107FE58C47C5EC70F99C91739FBA13EC8C90C92D432BDCA6796C381
SHA-512:	14916A03F1D9229EBD91FF2E08788880100139DA3BCB9FD2601EF800F9A156A58E2DA5E27CE8A0CCE1FB39DC836DC4803B6ED8EB9E6FD8D9D98F4B046F5855F5
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.....).-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\rNWlWD0ZgXMhzWvOuALV5nXl.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\ro486V1Z7P66nNToWTrVxquk.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\rvy2oX9wb6hdfWfPiYtPw60n.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\sZTgVuBgO0l3CMzVYan4pxrE.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.5804267238701835
Encrypted:	false
SSDEEP:	48:QBCvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:eGbGRTihhL6HXYc
MD5:	4DCBFA364C32FCF1BDF770C06288F9E4
SHA1:	E84E044D7253B09DE79E3BF13BF8D299FB0B39FD
SHA-256:	4A31CA45DA21F7D12112310F2E656C6DB8E503589597043661D71FD7F1B664AC
SHA-512:	1421C5B33E3CC6113B7B547967848948420F901056DA6B30C3B598C8F4CA8C8634AE8F496031AAF7242C891DC8C3FAEFFC483422B603A78C4EE3A45A25B29EFE
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="wh3Canni0YrTddaoKhuptKBcw74skuVm3gmCQxOK">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\tkHy6gygmfOPY9aBah1pIwua.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\tkxNqRBruO0TCZ7E4aLz1RHH.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\tlmCvYWISSwVWnUxg9w0yKg0.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\uTpnhMoQAbjpswVVMilQAog8.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\wGwvjr8JuoYAqhoeP1STOomL.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.597463902653766
Encrypted:	false
SSDEEP:	48:Q5uvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:8SbGRTihhL6HXYc
MD5:	64367B65D0762355A82FDFEB184961FC
SHA1:	5E439232823EB3C29345B80783DC64058DCC138E
SHA-256:	360D38D3F4B1E54B98D003DCBBFD42E7564EBE994166A1D7B5B34B3F6B860A57
SHA-512:	54AEDA4D3860AD809AC8FAE735F5665CF1E7EA6127D3171CD4708BBAE6F47F47FA982A81193F711DDA1A7222D6C5FB710F24FF619648E14D2F7611A450470F16
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="OdNRsXTbYrPBEdUBWV0I6VZa6iJsxkL72sKS1qmm">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\AppData\Local\xwluxp5OZq2fzKcnUhKN90Gy.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768477096051595
Encrypted:	false
SSDEEP:	49152:1nSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHG:sWqlkLESgCRE/vhOjb05efd6e/oXHG
MD5:	D6C2FBF8DAFCB34BC8797545B2A94CA8
SHA1:	8FE3C369AEC5F02016D030BED57CE0E15BB5C3BE
SHA-256:	A7A37F24ADD0B9FA6EA9716F4A1EB19C8B2EB4421D7414E83605205AD5AF0654
SHA-512:	5BC0A1FE7BBD5DC1A4AF5989B473A20BB775CFD5C9B4AFB4E410E9C4D70E92E5F85DF30B281F0547472E24E361639411451EC89E8FB6316384CFD7D6F429AEEE
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.......-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\y4lq5SHqKAOV4kY1xCRGbtJI.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768477037361091
Encrypted:	false
SSDEEP:	49152:BnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXH/:IWqlkLESgCRE/vhOjb05efd6e/oXH/
MD5:	0156652DDCB44EB5E79384EB83B7FC64
SHA1:	E25C00E1D76148D4054846BA6283DDC648F6795A
SHA-256:	21B1686B451D7EDD6688D1D8BAEA36D536E60E5A4ADD200BA2EF7A698C4EAFEB
SHA-512:	ABA7D75030A46787F65F3B2C96FF8EE85BBFDDE4F482AFEB65B2E97B2F96C3D8D59F2385505CD4A4241EA763C6515C562BE27F42B5A910F1B328A63B66E49612
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.......-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\AppData\Local\yyIn2S9KkOFmc5VIOG5URAcM.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\yyOg8vFUEf8ewje7ePyYaYrp.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\AppData\Local\zF1fl3LOa2LapjgwxbfBCS0k.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0J09ro90wH7cLZwlpWjZz8T8.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.979911370098063
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5XCK9j+DPSrHFn:fE1wkn23yK0DP8l
MD5:	6B7E5A19BB07AE769A9A7E415E5296B2
SHA1:	1CE66BC0F4A447EB0ABA58455968FE94074F2B54
SHA-256:	5AA16BE37EBE86BAAADC371AFA698B5B23E2389120058793674576F3E333C2C4
SHA-512:	6588B5E6AC679AEF9C307975D5D9414F190E66F8C1444EDC2DCC1C160C45B91FA2D739AC2C926A63BA7E1574CD4D78318D6F20791E7D6642F7673ADD0406F53A
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\rvy2oX9wb6hdfWfPiYtPw60n.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0WOLhTTA42JINQ9Omh8xrRDx.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.945642848698058
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5xCkrdEAWAl:fE1wkn23B9WAl
MD5:	594160F079DBA870B45F09D27B97998F
SHA1:	C2E0BD4B2D6302C17CE655E3AE67DBB11FC02E7B
SHA-256:	640B0A6B41E3486DFEFA6BE098DFE8EA369EA379F301B593872A967FD90AD1D7
SHA-512:	EB2E7DC588FC314B2377933F3FB9ECEBF0DEB882B9C412B80781F21313C442009E210087183C88C01E2D1AE34FCB486A1D5E9CBB6A0CAAE4E44589CDCD8B3562
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\TgGBhjAUKSjQAdgyfPvaMx0f.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0vVJWHdlOpVUJxV1xztDPHUw.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.849193254030616
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5ARZ+mn:fE1wkn23ARZ+m
MD5:	C6B7FEB7EA62E586B5069F0330DE9AF9
SHA1:	1F6B8785496087A9AF9588FBC0E120B5624F81C6
SHA-256:	A5F75B274DB0DC4DFBCF03414FC546050641C66CBDAD9DA08A8A0DB630EC8B89
SHA-512:	574C102988AE5434D509774A71D783E6E38609F46F6485D7742665051591E2BE0F49ADE89D96EC568757C9035A022D8DB714210D106AF426FF1B60D5168499B7
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\enc9JdewSUMVCRcBLY1bLbUT.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1txDsrfHbBgBylWpI2XKTXX2.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.922314725880134
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5DcXRP6HW6m:fE1wkn23USHW6m
MD5:	87986056B125DA9E1F276792338144DC
SHA1:	B3615B9C04AF2885BCD8CA37F72957C21F6BDB8B
SHA-256:	F73DF980A26A30A8932EA76A7BAD72DDB113AC3932F48898A7B3F03AF9DDCCB7
SHA-512:	1DC9E693AE5CC0B5534E9C37DE7AAED7F2A836070FC2B9EDDB6839D03D44EA281B879D74031EFFF6BF6D48B77339D9F6BAC372FBE5C3C9819F892BADF8DD53D5
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\f92wGKeu5LyIAhCs4NxRkLxR.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\26JlZQCiOjvgSz9otdXlHJBB.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.889119159859072
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5feJpdbBA:fE1wkn23GB+
MD5:	559E91B44A77EE7BC0798CFB0FE22FD5
SHA1:	4F7DEF6A2BDA094DFF2D626114E63DD02B333600
SHA-256:	073AF4B493988BB206B575CB78DE531169A29EBDB770682D8A0A1434BB0FD4A2
SHA-512:	FADB379987A4ECB0135495438383E010E581C41F7AAA49253D4AAA05BE6DAE6C0AA2A92961C509DE0F67672C2667E4865090ADC55E512560E035E6CFF270A5CF
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\zF1fl3LOa2LapjgwxbfBCS0k.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2QWycgsKSAUaWcb234VluyVy.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.933255124462213
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5JpUvA3fgDHHjkAln:fE1wkn23nwHDkAl
MD5:	47A03D6A0440A33BC366F19D58BDB95E
SHA1:	AC6D42E581E6AB64257D64B29EAD020FF6A7F1FB
SHA-256:	460155F7A15F9813366C57CE48DBD795B2E8B0DE1CB7917B5B30EAD730BF1AFA
SHA-512:	623EE0B675C8293F25B5A23A773298DD064383A8D6FCEE286159BC98354704D03570C93632833D70DBC11813EB76446F94D0847B08A38521ECC94B21DFCF5E37
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\lLVPG0Pkhk3MeRMVuEfaKb2V.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\45euY0tWMStjkWwOBWZtGnI0.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.979911370098062
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5cdLruF/mLzw3PokAln:fE1wkn23cdHuFeg3Qkm
MD5:	7D7241E855548C0874878AE7E365523E
SHA1:	393AF0546C9002F70A47013D165F570AF22A7B9E
SHA-256:	DC5E9F0672AA3ABC396308FD1688A90C7878A6EEF721260B56AD6C3695BCA1E0
SHA-512:	29C2C4782A6E2584769818B85B6DFE89DE277284C612122D458B17088B4DAE4A10991E8AC95F9D181D2DDB97FC888E50D296EA23C96C5B170EA46A55CD23680C
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\yyIn2S9KkOFmc5VIOG5URAcM.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4gIAsw31EaIKBtzY8UpjYqHc.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.882014449776854
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5hqxdphyFn:fE1wkn23N
MD5:	503A7A0A367432EB0B3ED429C5C21F33
SHA1:	DCA06094F05FACF488CB2E6FF3BEE43CD409C196
SHA-256:	247133F1D2080DD4F9F6CE2C908E60F8E2DA60036B7D6C791C9CF8FA0FB4DA5B
SHA-512:	606AF776198EF518BEC13678A489BB2B75D205CA5DCF6170EE5B5F88DC32771A98A66F604A1EB84B126AEF807451CD8DF920FB2C7D921C8DF4DCA0777B5809C4
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\DOHofbJiGO0ppvf8BnLjEcOT.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\562IOAurui1iMq5ZnURlELqJ.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.956797786124995
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5OQDxoRcZQ0dASkdan:fE1wkn23OQDxu2/D
MD5:	BEB94EEC3A3B54ED530C4D7039471183
SHA1:	93C098F67D15C76F708231CFAA377EB61C52D35B
SHA-256:	51DC0AC1BD34ECFF5F9ED656216E4C2CEB55DA732C7F9D943356901BA498594A
SHA-512:	DD83184B0F00148C4AE5D26667882D1440FF97AA4F727F4AB8FB36B16CCE257047E9B1FE75DC941214F78EE993D8716942BFC8D10F30E25E93F243BD5F5AD300
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\kujNjTMPu36kPLMvqPBbpIku.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\64W1FeA5ZnvYwrYyuSLeSK0I.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	5.013967197544179
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5DlXTjEW5YyASkdan:fE1wkn23RXTjEW5V/D
MD5:	6907FC62A400688E581C46F94827572B
SHA1:	4D3872E33E9C3577C70015CE7996556E2EB33752
SHA-256:	BF3948CB0EC622FF540497AC0D4F028E1869E5CB186E69545F73539084707988
SHA-512:	3EDB6939FBCBA89FE730FFB33D6CC635BE5CD90DC9206DA5AB99E883BE121678D411B48D1981D86FE59880A5119290D4F2BEA40C2BA80B23A8DF72FFEA402BDB
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\fDVyGnt4qkfC1RQX2yjdlha8.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6EJHjgRIzjgBosA7d8ecDUNh.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.072525276265644
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5yI14xNoZAs:fE1wkn23yI1dZAs
MD5:	3F2DAC2C21590FE3C5FFDE238DC85CFF
SHA1:	AD694B1F191B34CFB81357AEAD05E87E5D1A173C
SHA-256:	9CF6D2752CD69EEB3F8E39F0944C057868B8E9EAD0B7F2939AF9A1D18040EF41
SHA-512:	E1CECFAA3CA5EA2FF0C28FA4FDAC58AC501C33C93AB0FF5CCD3899428CDD8CF92A72892F18CE1D443189A7F7134D47314F849C004741E90EF7030A6D85EEBC7A
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\WmGZEzN2y17TSARkq7CMs3oI.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6isJJ7wloEiUNIFQIZCrGgvi.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.937516258419333
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5UpgiQ7ccAdASkdan:fE1wkn23UNW4ASD
MD5:	47D6F3210A7EBD7105F1644063AA6C47
SHA1:	3DAD08F64DEDD34B4B05EB0EC4DE9CA30E9693DA
SHA-256:	0B80B3D2B9C5BA9EE8073052B6A7EAC7B3DD9F1A955684E9B918420C5471D143
SHA-512:	4CB0B40BDE823D000F31D9278A5AD5F4514F7D5E2EC8FED600D21063230A2199F9EBD08579BED69EA34D5D550D79E84A776A4F3F7F62330A5F8AFF0CE6497C12
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\qLEG52WWxIWvDwEETVieoeBU.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\79J3LANQWKbJF2lR4gqU68ES.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.956583247280138
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5vQelqKW0Cln:fE1wkn23eNL
MD5:	97E6F60F2A1F56BE617F7988A63ACF78
SHA1:	5FC9C565BFC33B52DC14ABA01FDF2321938E2C91
SHA-256:	6C3E3E696460E45E493921F6D6A0D05C36EA03D0192F54DC4143AF2AFBCEF37F
SHA-512:	61DF043D293E6CEDCED6FFF81456D84B7CDACFA09908C899DF65339B1C3A3B9A0ABFA5A87D1AC1D43A6EA0612B00FABA482C54B259D4D912D7D01A258310137E
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\J5gykLd70qOkxMaAyCwBf3AO.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7d8IogXL4FtHFodng5T2yNKJ.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	5.017552575284555
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5T8smCdKP1zL4/kdan:fE1wkn23ZmCdKPBk/D
MD5:	48549D1998C1C52A869DFC5DAC828B09
SHA1:	EA8436F7BF162BD6CA921999B3D08A0A529C4597
SHA-256:	A344221014FD7BB8C88671431DE14ABF10B4FB4F47DA5EB97B23C7DC073965CF
SHA-512:	AC6715FE70C3DE8EA64E221C9C86B3AD458ADC73B6BAC2E4CB82B1C06DCD7CBA2E9B652934AE675737F5A522A8B4D66DD2CBCBCA46B32C987662F6E9F3029DAC
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\6z1e79d9YW0aNxV6xEjP29XG.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8RikxgyHSlngyCNkLljOoIea.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	5.032961708039141
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5u4VAGWQtjHOCSkdan:fE1wkn23u4e4jzSD
MD5:	119FF2FF52836FD7E3EE888F264486BC
SHA1:	6B8E92BEDAF50CE164D78B190D55CBC2FE569DA4
SHA-256:	0A870B4A2B973AC0F9C34CC817D361A79ED994734C7F7D3BEAD39D1C3AFADE28
SHA-512:	4794D2E2DC5AFEFDC4465821067B524EDCABC84BB210FFEE07EDDE3EFF9B3E6C56D4B634859A6651289F3B44A0A769889579AB5CFBC9493DA329316CCEB9434F
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\KFfdFQJ0GFXA36ymuAOaK0ZR.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8jCBtnWc1Ir4FhlXpfJLJwbt.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.095853399083569
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5sizcCaHDaGzyEHv:fE1wkn23siFKDIm
MD5:	0E533E9D9C7147C0626947A0846088CE
SHA1:	E87A0145C7DA58AEFFCA88A7C398754A4F659912
SHA-256:	61F58A94758D207D0E57A3E6A552471D938CC166384F5177D7E6E37C5C796A93
SHA-512:	956DED51C45004C917E6FD774192F7A0368F52642BB5F1595DA74C3DA3B2FB8BBA5A6A91F5EB3FC0F63AEE67F4FF2016A81A1DC4FD33121018870D9D11E70064
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\IGVy70B2MbWqfodclXqYMOZv.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9EVhyPbJZWDMphgwa1d2iYKJ.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.99795647876236
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5O1VxYoNfrLn:fE1wkn23OfxYKH
MD5:	05F0F04B90FB5806B7BF8AD5CD8B1B86
SHA1:	4A8E5503EB5F058FB9EB5D16EF11184F7DEC1CC7
SHA-256:	03356C08F9D9B29261C1D010DCE80A6968C0F0E4EA290EB3772E35F989EE33A7
SHA-512:	BB0FE9902827693A0ADD7C62028A44A648A2474F60407B71DE2A6E5A185C09428461A832D30A656A2BD186B98161F6752A8DB768DC70FD025BCAE6CEA1ECCEC6
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\kIkH03mHJncFYDqHqXdphzO5.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9WqUvEngz5tu4Jus6UqDSeAH.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.02549466035497
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J513GCgDz2Fn:fE1wkn239Ge
MD5:	EC02BA0DFED97B0DB28E92C51645D792
SHA1:	2DD54381D51A0A3242AF0290531DB3E6FB812971
SHA-256:	EC970580E03C5E8223ED6E76D1171973C25A16A127BADA71CFCDF131EFAE286C
SHA-512:	F8794F424EB80632CAF4DA165800F16F53416568A50E25F6402FFB177158D44D49189A2463DFC26FE37EB55032939E554347753A6D03FC3F3F091F0BFDA9289E
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\PRVOgEotbjGXE8sD4i3FyhZT.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BVuucCXc4ipTOaEN9UbIG06h.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.905716942869602
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5cKT3Ztm0W+9AdAl:fE1wkn23cKltKs
MD5:	07393588727EC8B95B0146D1EFF03370
SHA1:	7EDC5A0CBBCD79A11DBF05A82664320D82ADB29F
SHA-256:	E9641BFDDDFF2F813406E6A41FA471430BB2FF2B5346FF10AE8A1DA1EC5E9664
SHA-512:	7314BE4CE3739596507793F8DF096FACE33DBC68BFD85129083A4202CEA3085BC471E6EA2C8793E13F09F92085CA89438C38D0BE7CD98A013D8145A5C47ED66A
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\97vQigClUgXPlHCQsrK19F5k.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CjdCWP2sC37ZrV3R6LwCpexO.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.001792167262221
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5xBCUZMLL:fE1wkn23HCUZMn
MD5:	51CF9EA2FE18D31F9D606E428DFBC7F4
SHA1:	ED0E0484EF4F0B2927A3CF3E375D95376BBE731C
SHA-256:	2F3F2894F61389ABB564F030DF235916C18CF0FC1536259FEC7EDAD9EDD35AB7
SHA-512:	958ADDC0A0CD083D8DE0CCF3EECFACC45541F3037A76D8E0838AAD3E38B0B868D14085C0E23E0F63B6D05FBCE3A23C20BA23EEF16234D418387D4757A2ABBCAE
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\TdtQ1FE4bYO5ogxoTGdiEN38.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DAPdCitNhM6K85idSxzFsn9c.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.828253494058786
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5xQd8H/MYIU8GV0diFn:fE1wkn23d7pF0s
MD5:	F8C13EE12AFE042B6F83A9A22D95A06C
SHA1:	B3C6A931DB4EE2B09C35A9F0DFFA8962D6BEC649
SHA-256:	70642268FCCCA4E8DE1E95D3E056B2BF08EAAB6A21B4F736771BCB42147494C5
SHA-512:	D703C1BC565C16B04D051A4766414220F61A34C8E10FE13C97C3E643FD44A260A981991D67E5E6DE7F2B795697C83D2A05BCF46F49A7FD397E31A061F2D30B50
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\Tux8yeqUanpZipvXA8WXqYc0.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\E0t808UD5wPZCrXfVGxoO4mM.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.858686326958929
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5LFVSdP2uFh1m:fE1wkn235KP2u1m
MD5:	61B25D6590B60E9D9D294BD38202F3B6
SHA1:	A206C4E77BAFDD57078933CC57312856E27CD21F
SHA-256:	C3E3ABCAC1F813A09C4D64F6971040D877FFCB5253488624B75BAD77619823C3
SHA-512:	6FC4BA945FEC52F2D5EC588496AEEE99CB53A0A9058E6FD8ED2C46239233CA3708B15CF96BFB075F1EB053C60FE85659CE16D8F2AB71BD50BC6E568F2D057BED
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\nNtGSwumkPliSKVeAx7Sx8Gp.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GDW6oyyvh1Tx5s2LyRfh47Sr.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.927597740033761
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5CQzMdgWXKB5wCl:fE1wkn23CQDH/wCl
MD5:	85C7CB2CECC20A16A33436C483868768
SHA1:	33BCDF587B9A2AAAB774B8C3144212E01B79E8EC
SHA-256:	3140ECDFFB926ADCA0604AC7101184EEB19A97FA536697E63FA2C3B2059691AB
SHA-512:	8FEEDBA849CC0160750FFCF3BA1BE6E3424C814E60822990C2A6BFAE8616BB58ABEF289F619884CBD5DD20325E5414CEB8B9481BA8C2FEC9BB69BB10D330AFA5
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\guekS5iP2Ex1XPBodoRkDEP3.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GqtFjA5wUyMdLuRfwskrpVTo.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.956583247280137
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5ncIbvxnl:fE1wkn235bv1l
MD5:	846131325C812632767FB64C5961B01A
SHA1:	4F608C4A46833EDA76533CA0B69C8972E95CAF02
SHA-256:	DCC8E75ECCF071E1412299EED455C952C83F988176A95AA8080D8E53E13C39CC
SHA-512:	09C7D7FD8640062ADC9BB5BA58116CEBA287DAE53639A2AD6A56035F118E54B519497F021E3223C4955754D02F0CCE5F101220BA5F979B2B8AC3E42633E308F2
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\B9mSYpwKkVgW9jJSaxBMcATu.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\H4NVC7ZwPA7tQJGraaH0GriF.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.848914386741143
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5gxYLd/kdan:fE1wkn23gxapD
MD5:	BB6078D8D52DF5C35B0ECFC8AB83DC78
SHA1:	59C7797A09A6B1E7D47DCC68CA399C3E9D63DE00
SHA-256:	BB6F874AC2A2800C105789C676C9E481F21BD91DB454CBE854C799743354862C
SHA-512:	7019C9EAEE34EE2F3B5D512ACA00354D18E805FB09B71449EEC88538D4F50F327A4B16ADAAFC3EBB8806FED3421B2248C16E1DF5562F1A7ACC84D8EBC0A71129
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\EwzOUe6vEjttYfeygpeUfeHd.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HcKDjXDeVjoAYG9oEwfQ5r7W.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.918104667105448
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5pdaRCX1:fE1wkn23zaR8
MD5:	FEE9491FC280FB5FE3D4892263190D1D
SHA1:	5D3506559415055AFDD74B3CE3ED17A13C7028F6
SHA-256:	BD91E08C0B24710AA19B6585766F08312BD62A6179D46DABBF14BD7751C62C65
SHA-512:	02B33806DD294BB1E641E68F6D9071C203843AA02126078D09A12664D5F9200D6BFBF9F40452396A8C9658537C1F58DD1E6F064CEB02EB0F9DEEEFDA05F567ED
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\Lx8QrL0pgGPlzgQWZQW3XR1F.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IHa5q36o0oDSI0oxRh2AwjiE.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.933255124462214
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J59C31hrBGLVF:fE1wkn23owLVF
MD5:	EA08168E4B91525040F4B81AE0E57665
SHA1:	F2A15A201BB65D4109F488956D8B109D576471BF
SHA-256:	464E22B276ECF4509F4ED91C30F2FE700DE5DAAE3C9D80DBD6F44C38AFB4211D
SHA-512:	EF3EB36C2366FD336697888D863CE1196AD9606C68CDDD6C16AD3708539B9220D74AD763A0DD9DC76570BE9A412D08B66EA43B0AB821C985D16169AAB16F2988
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\XgRMsEcdNLhAV5ZMS6q0eNdc.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IVOq1djrOaeTxLiPySq6sN5l.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.841015588569455
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5cRfoQEAS:fE1wkn23cRfxEAS
MD5:	F7772CF1C4FEF0817D7ACB31F5E063FD
SHA1:	255BAAB2197AEF33EE0915370B9F24D4AC6CDC2F
SHA-256:	E0CB222DFF1BFC1EE3144C6E23CC7024D524E4E3D9273763E06378FF60006C1D
SHA-512:	A6DFBCCC0047029894A095CAA08A49174B63B0E3E5D3C6006B8420B7A5DB6E5289919710F209F4A59284A0D634B986E369A462141738C6CFB698FBAC006A75E2
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\9pxDWajsJYwYwL1brTzHEdek.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\J8yKUFyiGbt768ehGRwDyrcp.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.9379317041235735
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5ROuOc+NrvjEL4Al:fE1wkn23pOzJNm
MD5:	E9FEC5A83CD4C556A1BA6A60B38024AD
SHA1:	6DA34FA2EE0A8BABF9C87EF876BBFB0B39B07F06
SHA-256:	029706B07923DB21AB9FEA884302BED33D1E9921887F6CF4AC113CC6C9CEF306
SHA-512:	A266A92B11B5EA9177EE13CCB5AF1B45673A6F0EC874E8E9C545BCCB3025D69272C49660DB6BA210487F83800A81E8315E51894C80960C787F365EE35873D20E
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\tkHy6gygmfOPY9aBah1pIwua.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JHyB8AKI6HCE6tGU3bnuI5r6.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.055927493255113
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5Voe2SnGPTmDNwvn:fE1wkn23VaT0N2
MD5:	512FDF7EFC547A942183F084A268A678
SHA1:	4DE80AC7C419D2969F757A7A431466E2F50EDDF7
SHA-256:	BF13AA5FBAF03152133BD960DC1488C7D1DDAA935029F9D80A35E51E9C4858D6
SHA-512:	6F976BD5CDE694E9CDC0F7C471747270F5103BCBFE60698A9116FEA94271C40680AB7C766B8B9BF96D13BA42C804811F12F7C594A8AA92A337730536FF6C0E85
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\0MO04SVirwqcj6WPf5Zv7PoT.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JttcrlpAPl4aOfhp8XC7VBXP.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.853028942530477
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5KC3vyLqICDn:fE1wkn23KCQq/D
MD5:	3E1FE100A29803A3CEC68521CA62CEBD
SHA1:	37016394AD187CEAE9A7BBC03ABA0EA07A8B8A5D
SHA-256:	1F05530EE1BDE5FE72E9EDAFA5277477D5B1B0BC8EB80C535524B0DCF62BC493
SHA-512:	200912A3AD692620A688710A4EF0BF7CB44AB6FFF9EC7992B9550FAF98846FE2D092AA2E3203B71BE829E5625489435DE2E6CF1CCC019BE7B48C73E690E9A15B
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\oRNRkRJgpfntnnUy3280Q2gz.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JzQd2zNS2LuiFZIBJg0WYcl0.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.968970971515983
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5pQLNcAN9fNsn:fE1wkn23sNDN9Fs
MD5:	744EF60E784C58E373164D444C1E2409
SHA1:	B0F5F1DFB2495F0C01FAA9E00C3B780B97D6C1A3
SHA-256:	DD86F3CA0F9CE12F74938944CDD414BCF237ABD57CE4ED2E5F956419576A479C
SHA-512:	EECF888B1F33C9A600DD46D75C0FBBA65E4D546A3E0595BCC3B7140BBB48D352DB170585002E1332D32F9725B75030DA4FD4450DC886F6A9AC6A865F0330929C
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\LulQEAYQpS9lk1qZLpImyHK7.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\K5EbMQs6xVELU0vVhpEDrOBd.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.99795647876236
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5Vr8ZiV+1FdAl:fE1wkn23BxmAl
MD5:	67DC173D64D0E0D8218C5CD5590DB343
SHA1:	2E10AA1D7925FE15056E30AD2966D370C3F95975
SHA-256:	D5E2986F0F0AF3471ABF4048AC60BAD81BBF6F31CBFB59EBC7EB796B0296367D
SHA-512:	CD1C413DDA128A5FB641AE4BD0E6E8BB276155AE8A128253A2E9C511458506C276ECB2DB10B52D24F0EC01B0DEE42249D39EE11E21E88D793A3D8620C66AFA01
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\pN2O0fDFwQyZhLFu32KEUc8D.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KfGswAZKZMHpZo4ArOFGPkJi.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.920867400226368
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5OuQpSm5l:fE1wkn23OL7
MD5:	C1917AE6E0E4A51721D6E0FAE954E0A8
SHA1:	0BCE9FA59C2D41285582384CFF01B0CD5763AF00
SHA-256:	5A3035348971473F269DCEEB0642A08ABAF1E94E437ABDC6EC5216F03965F847
SHA-512:	4749DD6A76911D2EF935BF76D3820561E177917AD9F51E5D06A7BCBB6D062562FD286915DE7D02A33CC8545C5116F9D50748396C5250F6C7C18F8ABDCBC3A6DD
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\k6s7peRuTySdHXpiWwpUH9mL.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KrG1uWAeN2xCX4UgIRWXMrz7.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.865791037041147
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5wsTcnhtD/ml:fE1wkn23wsInhtD/ml
MD5:	0156CE25E93339A4460185B7543B0F8B
SHA1:	F7638EED2A50A24230E84A183A6EEA28F7DED012
SHA-256:	3493ACAEDD658D79B481544FC7694A7C18D8BA8EE9066A4C38F665210918E10A
SHA-512:	85EE644BA36D3B534C2C36AF76BE8026B150774EF2820AF59D74D6E5258695AFC8F7B628E5371C554A8E504066B413FAC05D97E4D5B1FED0D9974313E21A93A8
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\UI7LDXaAp2RaeFVHf9g6LwB6.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LKmDph5LIywjCE77xYaea19T.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.820207746784239
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5iDQXcRGFtzS:fE1wkn23i8sRGFtG
MD5:	9973ABD667990646C7D271FCEA04B217
SHA1:	7BD7CBCCD994C34ACD3820357F9FD042CCC7632C
SHA-256:	21D99347C0701F7A2A80BA150C61CB705CAA8B3089DA8365314C1C173CD51B85
SHA-512:	DB3E90AB17EB24A72A5852E463BB3DA86B1EE8B6DDD395FA6D75927A97F16F0771513F6F9B82695AC5054B70D03B046A06B567DAFD2598A1D285DC464DB12FB1
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\GfRX4UT2Opv4sOsHjzHHVCjf.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MCYmcBRyIU8ux2QHjbZuxfqz.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.958030572933904
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J58x1PsLNVF:fE1wkn238zwVF
MD5:	9A11C9FF15B07D1B4DACD8EDE2B735C2
SHA1:	777DAC54DD2E624A8C1E045FEB682C4F3F27E651
SHA-256:	34B04562862F15D92CC8F28B790F02CD6247CAF72D08AABB0DF171235D1C17F3
SHA-512:	801FC34FD49C1D01C639C7523782579BA47685FBBBB7B2FA665A54BEBE1B9E1C5D07E88F66B1709F7972D4424B856CC4EAC6ACF93AEB3D3338D94E86B1A6FB21
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\YTPWaMfX30OWGAa0N4zQELWE.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MMUVZxTIvuJIWYs0euk86qxA.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.996509153108593
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5039qukzmBUdCln:fE1wkn230tP5BaCl
MD5:	7A3A85DC2F0C5054E2400CEE549793FD
SHA1:	A22D09C0FFB4A1451799D0B68C742C85B8CE9E2F
SHA-256:	635DD45F869D2501F5ADAECA5B01AD568015EF1731660DB124ABB2FC990DA1BF
SHA-512:	F2DE4195CF191EAC9B4FEC890D39DB950AA85BEB14F09309D4A2EBC8CD7A1045BBEE4CD4380FF29146FA64EF7BFF81071A05DC68FA72D44767F4C09B2A13449D
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\QRVPcUOZwKQgBVL5bWKd8sH5.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MXHxg7qBXVuJrgcu6doi4FNe.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.828253494058786
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5UsoAD8zcCL4AHFn:fE1wkn23UsFmL4iF
MD5:	26B23889B3786F54D9167BF9174ADEA6
SHA1:	58CC5AED7792C7F244294E416DBEFD4C9C07D38B
SHA-256:	3EA455101DB9F262E698C7D434F6CD8F6FBAFB07A28A4D6E80627C597829C7E2
SHA-512:	91B4C8047AA4E824238A4284D08E887EF1986BECE166614E5C09E0EF1CE21282849C673A11F11F0BDE8C648AE663F95F987C07C868D542B27719F2996D70A9E4
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\1IiLAoyBh4YnTxVttC3glecg.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Me7XLDxydOOLg6FSpuWpJFuG.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.829700819712553
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5AycFV9UH9sk4AHF:fE1wkn23AycFsH9sS
MD5:	9DF184239FC279569BC02033BC7E70FA
SHA1:	2BE4A86E5420F1CAE477C9D8E2A5F61DA144A21C
SHA-256:	199AB61F2C61F1F1542466A6C02152AB3A04DE59329572EBB4A3F4112E9466B2
SHA-512:	0F1DC5ADEF57C37C266B0ECBA4EA18F7FAE63213E26FC22A69F063D34A2B9C4D9BB036A9058C6DC2F8A7164EE89A2BA1FB12E60BCC5A709C5767C07C774F145C
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\eWykOtAnMlV1bwkA64D3jk1r.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NAr5maBkVhXrAaU2xNYDG0Ni.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.876296536149033
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5AjfBkqrdGAsIkdan:fE1wkn23AjfiqJtD
MD5:	1392F27DB3AE3C958EBCFA2BDF680DC6
SHA1:	F45DE49458BAF24FDAF24342B88405CEE3A7AD5C
SHA-256:	42C8B3F07A37AE18304B8148F1584EB4ED735CFCB9FA6BBFFC67E75EF7FC4282
SHA-512:	5EF8152F8440854AAB3FE2564DC3698E2A31AD476BA00401DF028840AAC8306DF72CEE495D716B4E85D54EAC5C3D2A6B35DB3BF764496949626081C466F96A4D
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\et1UzaJspSJuRyCxNxPGYCVV.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NSz8C5FjEwzY7lc1l5tTf7Zu.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.914835645523092
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5RJI1czyEbVkmn:fE1wkn23vtyEVL
MD5:	64C26C4750DF0E242AD9588E0273C767
SHA1:	40622027E5C2492EB339693A48E1168716A600AE
SHA-256:	28539515E1C9ED344840451F5FA1DA92B65089C00E4CF3520F66565594831DC3
SHA-512:	8E28AAA9A0139826C814D426F7C630D62F79D9125FAF662D0054E9C4D176F5E945A16D3489EA0FE231F5D3F1E941C57151F8DB67B2DB856D3AE6B0907D67A30B
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\tlmCvYWISSwVWnUxg9w0yKg0.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OgJTlumfhkuuRPLFvr1On9vQ.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.878178761276992
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5Q02Lw920dAln:fE1wkn23Q0eCCl
MD5:	0CDBBA59EFFC3CCDE630C376545A8C97
SHA1:	CAA1F1BCB50B7770C3FE8EE16070F85B04CC10F7
SHA-256:	7C0AC32EFA037D35E5C08C5B2E132E342156E2E86C38D028D19635B33CE1F2D3
SHA-512:	7DC85DD78AD00690CD2F66C290161A7EFAA99E940E5B51243F3F6AB90E06F980E229C063D6F358FDA2D53A4FD4474F091D2D61C40B9D073F4982FDBAD21A77A3
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\5QpyioUXq8ASWQahMvzU4ahz.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OyeiCH3bPxPVxTNeTi5EUshF.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.829700819712552
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5Pq7PArNHF:fE1wkn23yArVF
MD5:	EA823A0F2545884DB35AC8FC23FA5574
SHA1:	B355B9CCDBE1A93C79E16497D5A9B8AF4990EEEE
SHA-256:	3A5342CB70F0280B8F1803847315C5C2AA7285AC7DB7721A5B37FDD927BEF571
SHA-512:	23304697A6B436F87EBBEA0E704EDC3D6ECDCCA1891432E6928E77FA8045041E13B3508DB5E7D834341FE83CE70A3079DBA5EA30F363C3AF406F90DE775F2A74
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\jWtlFlrLdXdhBLj1fOltMT9i.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sg2B0JnlYsjOOp9PXVd15s2q.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.990348341776704
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5oye5BhvjMJlIkdan:fE1wkn23oyCfjVD
MD5:	A6BCD3E6D4BEF539DF6294BE5D323055
SHA1:	A8516C53EA720ADEE038E4E4DA215234C7AD9D11
SHA-256:	8BFCC76DB92F4AA6A68165FB1FCAC200E621EBBE29DE35CC544559B78D5F6B92
SHA-512:	8C9F6824C63AC51B1AD2764A698C27BC6EB1A5B71D0FF017EFF35E1D2C5A457560DEBD49369FB5E31900BDA769D375BCFB15D26D081AEF7AF19252BA30192D0A
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\MW0Q5IkKXdDw9nrX6CojJx9n.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TrzJY4SdW5VqRT3oUgzb9jSd.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.91099995702323
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5MbwTgeQAs:fE1wkn23MbXhv
MD5:	C15AEA6E3C87604A5CA6D01F631A37C1
SHA1:	93E8CA452F5AF2C5B5913D147F6CDD649CE2FBAA
SHA-256:	734B32C8409956B4A559C70680C8933ABF956C1190548E32C748DD0392DDACCD
SHA-512:	050437B01C56B8B5D54012413D8554E3BB09B1DC3DA5A7BD70A8525937E12E0A0C5749E1FF8F874B69E108E5425B26D7387F04C24495EFC4D14BCEC3CAAE95C0
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\i0DLgyxTLlkFBSXC6EtBlR3o.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TtdffhNnzdGUOw1Q6n3IszxI.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.909552631369464
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5hit3X9XDMln:fE1wkn232tXDS
MD5:	4EE6B986EF617AF181EDD4BFF29BAE8B
SHA1:	BE4E7D8AE5C2D43A7062291C0AD4717A68543932
SHA-256:	E893BA65BDB00C4FEFA350B34D55586065C7E6A58B01CA1067C755A490997538
SHA-512:	EA8590029B9BB3B3376B3A8756C057A876FC1035B0336D9E96423808BFA0C8F224E6B8BF7D5CEBF8146D9CFD15B5140AA8AC843ECCF5165601A7C716823BDAB0
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\DG5NfvChXpdFrpWmBrnRWaQb.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\U1hx9WBnTHOidubdRJPbHA8j.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.904269617215838
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5HJ9FQes12dAHFn:fE1wkn23p9Fts12Cl
MD5:	4BE48AD357A02DF9F0BC2D2813E23D49
SHA1:	CF4CBD3572083A9E7D29B658B9C76B4BBA50E155
SHA-256:	75E7058734BC09CE8400D77E4B53924BB2B76240F459573EBEB6598CE5784554
SHA-512:	C519E6E2590FBDACB88136CB3F5B205511EF29C37D55E71A085B51C19D1A51642E91F9CCC3E2A57A97AA3254CC47467BFCAD46AD1392B84F250D83D37E08F8F1
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\bbLIw48fKM1lzSnI9fseLQ0z.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ugc0V90naF7CA7jLJhXrOwzq.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.96224063170859
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5xIcdUr9987PJHF:fE1wkn23zdUr99cT
MD5:	91B16C30B23589E51B1C837240DE9D1C
SHA1:	A26213803A4CB8F9735445AFD3173B8398F66996
SHA-256:	6F62C55EE85588552A56CBF7CF96D9AFDAC664029C99E62091323A05CD9EE605
SHA-512:	51BA2297118F0B7E4D4056AD30D9D9FD1A1289EE09AAF25185437D83AEA6C1BE62EC7BA2CB1AF59E8DD7A7728A4C1787D235B2C0146C7F1CA07C987CCD5B82E2
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\TmyU19puPszO5dD6QaXXYS9j.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\V3AtsmKWfYlu7Eug1wlWAH9h.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.871074051194774
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5LWfUgvKXl18Adm:fE1wkn23jgvKw4m
MD5:	B7F5BEE99FB6AF21C8BD9AFB3EF3C3CA
SHA1:	AE33E4DB0D900D362F37343E50FD5090D0FF75E9
SHA-256:	ED5BAF22C99BE7469DF8B9446C99E2176A975B1C2C70234DBB64CA20D49D5D05
SHA-512:	865E814AF4B2E9B1F17DE87F933F46E77CFE80E0594F1E9CC13C84B555E89B3C817776E42864EE09CABF733FFF64E468BE0CEFF558D66BF8BA79DD62F10FD55B
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\n3Yk1EJMr8upEtxmsPsGJQY9.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VUJ1APavr4g9GBy9emLR2vwj.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.967523645862218
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5ROdA3Dm/SrfTAln:fE1wkn23zDjTAl
MD5:	ACDA6256C73CD827B085C672FFABEDD9
SHA1:	E85D472A037BB4D2C4A496A452CF5CB96673D5F0
SHA-256:	68A669EAFBE09F589ACF1F69B7AB7C0E5AA87334C48455C8B032798447E7E010
SHA-512:	39D98E21C4FBF1E30D8D4CC9DF6577606E995AEB2BFD1E1BECB987E93CCD05F641B6C70BFCB4A4162A1BF5CD0CAAA6F178DC3B3BB23279846E8B2BCFCF0A6B3B
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\tkxNqRBruO0TCZ7E4aLz1RHH.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WFLbR91U37oILGhK1Q5GQNWV.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.907164268523369
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5IFe11aj3F:fE1wkn23IFe1kjF
MD5:	07A39284EDCB39D79136FF6B54E91C2C
SHA1:	0C5203D62E6020BEE9DE60F2748C29D425FF2AA7
SHA-256:	D0C818B9CFCB875B4E2753429FAC006D9CE6B5F8BB0590C08A661A6ECB4175F2
SHA-512:	3C31E7F1E1D4B5CBE199B020C5F94C99EEA4385CD93BEA04F5E8EE20DC07284B6652758A704488CE5CF4C4DEF78947F6633B017DFF795341B0F3E6029E7CCC52
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\ma5ZV2wEknznzPeuTeaX9Fk3.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WHOE8wVBsC06cG3PMXZ41tA4.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	5.087911886789217
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5cvUzRO8P/kASkdan:fE1wkn23cv18HJSD
MD5:	815C873AFBBC3EAD874A31753E87CDFB
SHA1:	C45BB2F57C9FAC779B2E5EE50B24F830C183A0F1
SHA-256:	0909CC74856BB4B3B669614B8C12A0611334018CB0EFCDC87A3A8B5F787D5CB4
SHA-512:	D59EC36A254FACD9160452BDC37FF02279D11225FB2B24A0A113A09FC881ED2E1ED272F96DF60260EC2D575EFD6ADD10CA727F43691A076C20E148DB8AF5CE81
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\y4lq5SHqKAOV4kY1xCRGbtJI.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XCcXtVNwlBCqsuRQM07uv7xU.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.968970971515984
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5VTHDBWQuFVFn:fE1wkn235jgxF
MD5:	8F7C9A6AF1F218EB0ACC0C20480F831E
SHA1:	7BDD59C6EF85F3F3AA52870C7293E198F42D430C
SHA-256:	6C367AB1964974EB2ADA56D367158D8D6CCE30B714C78C0046DEFFC18804B6C2
SHA-512:	1E0DDABAEF0C4BDF9A2FC9895C9E13A8710415B41D8B4D46EA84C5DC362423307172B12A2CD17BD0775B70F593B53D7F811AB5C0A268663767067FB6E68AA69E
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\06nVIZvE4iGjgzg643uXiijC.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XxBWkAwnJl3TYI8aDIgt8atT.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.08491300050149
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5vSVmGO5GiL4m:fE1wkn23a8R4m
MD5:	5494069C9D30EA2805F3CA5E9BB28FA4
SHA1:	3759C41A14EA817D19A4A542C6B42F025DDF9E47
SHA-256:	87A4D4108740E4411820ECC49CE65A9451551F1F7C25B9281F12C964BCA1C07B
SHA-512:	C4B073E00528EAAC85278B275499F695E58450C6E4F8719AEAA5765D6A0E4ECE23F0C78536A4B5E469F825E42821935F022052E6F341911CE9AC0D6CEF18DE56
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\JmFHdFFXnf32rCkwI8iKN74G.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Y3v4PLQ2XJADPLe8uTGKTGBj.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.923503759209997
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5ndUQ07nQ8kdan:fE1wkn23dUQ09D
MD5:	0090A615FAB73D22582E2416A27F3523
SHA1:	C3361E9675C5721E20AE07E4155F7273B40CD9F4
SHA-256:	52D98048B2E7CDF619CE951BD9054107B09E2D8D9232B4AF5E829E1EEF2B5671
SHA-512:	127C71B1E0C3FF920497D05BC7F10AE90C34CC79E65F367BB58AB08647158411EEC00E051F426F671F12BDD87A222CEE21B475B892D0BADB9911120671F6DDAF
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\B8Lqzc0h0CXWQep40oCdtIvu.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZxCxof6FGyd7qDqEPzShgVDy.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.968970971515984
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5VNj+dgg3T0EF:fE1wkn23nN3EF
MD5:	4EC56071D1C9F9B042596CC0BD3630A1
SHA1:	1874F80252B5888E4405808645B461AA4F3F6B20
SHA-256:	F15407CB7BFC47AC8B433E37C8F88D7DA03E17F85DBDE743B317BA83A93A20F4
SHA-512:	8E96CD03713D3FCD55E17267262C2A57F2B864AAC70A298AA46D6E1F7A2C9D18A1FCD5986C323A082671DF0483B023AEE00F9BDF72142FF5EE556A4F5F24F14C
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\phZoEhmPHJEnryk70uKpl9zQ.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bLqhYt9ogAh97MPkvppQVF9X.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.920493029951543
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5giDHqJiHgDAs:fE1wkn23giDHqQm
MD5:	17EE40C3677F3915D0DE43E2CC2A9726
SHA1:	21DE465CF6C84FEC0EFB82F8C45DDCF7AD4604BD
SHA-256:	D67C4DB169DF1610438B779667317FB975F8CD430E345D75EC0986BE8331727B
SHA-512:	A754BA7AB40F18375C362821F0E09E2949DABB1CBB4584D0FD7AAE7ACF846EF4D2C465ADF9703C1741963600031862C6A44A4FBCA9E34D94261FD41D07393A8E
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\EGZvqStEuOZgeHhVMxPhyZjZ.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\beH9MpS951FkEDtYIMOxB9PT.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	5.075186919814478
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5LigTr1dcSTu6sIkdan:fE1wkn232WDdpD
MD5:	D651BF4A57A3041AA79964CD42BC90F8
SHA1:	A20029E8DA98B5660325E9309474CCD440A3BDCC
SHA-256:	3844A04A72A0614FCFC6A6BE47FECD7CDACDAD61218FB3FA2CF2B66CC74044F3
SHA-512:	2D0C9E22CF4A72B38DD713266811FEB569C9C21C4D2AEED7CB2F76C9E576EA119B4D445646D26E707F20B55D39F60371D26538116894CAC3BADF256DF41B026B
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\nU8NHI9fYTvNPbiYhk76Vc0l.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bmpPREy9jpg9Y5dahXR78j0C.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.916657341451682
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5wuiuONMk4Lv:fE1wkn23wuiuONMk4Lv
MD5:	66326AF8309BD6E3287B6021D5F6BDCB
SHA1:	1D10EBB942E633DC113E5DD690480FCC40AFE65B
SHA-256:	C5870207CC0CCFA352095A547C0779759864C1D754E2EB81C70D7BB6A32615CA
SHA-512:	424341A0671587B33C431B2E51D6B286B5F066A0F48D6EA84C38F1602E3B7E7B638B37F82446709037E4719300A21151F016F9EACC810EC45A8890C04C78E3FE
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\UKcOeyzFWKgEp3jiLlc53JId.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cu7dRoXaHj4ykdzix5wPfjXx.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.916657341451683
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J52Irm/HdAHFn:fE1wkn232aQm
MD5:	4FB70ACF0F69B4CBB4A8A4D4F677E4AC
SHA1:	CABD4F261991B6058E07CAFA74F56F10DA6DF1FE
SHA-256:	0F0DC9838FD57D05B2961646244FB29346E2D7ECEE7B8F7003E0C493F92CA31D
SHA-512:	99B41B773C3B55BC7DA2091D0FA1CDBC5ED0B141B7DFEEC75854A1BCF63C689292524353B988EFF759538CB1AF926C4FBA99A5378796AE51C0830F196C5AA421
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\S58tmyihHBD6BmCz1ZODtpm0.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d1fRvP84Ga9Br7ODiQTXn4vQ.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.909552631369464
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5pVFpoM2Nt2THFn:fE1wkn237FG9k
MD5:	03B25F9C859543C87FEAD64CB5A60098
SHA1:	A0BF263534B9DE92B536E268D61802678EBEE751
SHA-256:	7CF405945205190D6AA7CDA39063F5F3A3CE56DB6F7521D3FAF8B3F53856FB1C
SHA-512:	81BF4B7F6B6C4CAE136C8E675172837B1BC4F43329DAE8FB9593E5210C161F7874325FA9FDA60BFA2DD98781D9A9EB5EE65933A856C86637308C46C8E4FE580D
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\Lp5WnTgHCMiSZVksHSRp5zyx.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eWOYF1zwQp5lzVxU2fjmQUeK.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	5.013967197544179
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5dSCuJ/kdan:fE1wkn23qlD
MD5:	DFDFB2A59EE177342E1AD7063C041AAF
SHA1:	2690DAC8FB77AA47DCA65F316A08ED14DA32545C
SHA-256:	0ADF0F770439408F0FD671D8BB385946339FB9CBD4D409CBCC46DF5C6714338E
SHA-512:	E202FA26254B43253CBFB6D3CA80532505EE152F194B73E16210B187E5517543DC6F58753BE1520EFEBEA96A9594F2B8FE85FCA689445152DC4AB141746B72BD
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\xwluxp5OZq2fzKcnUhKN90Gy.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f6dPjqM04FFhKPYuWUTKufeU.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	5.030742475370033
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5qUOJtNyToG3Tykdan:fE1wkn23qUOJ6kG3GD
MD5:	71FAEA4D8EB36F360491AE1DB84ABD29
SHA1:	D5BFEB16EAC3F110DE433804A79E2BE06EB9A2DE
SHA-256:	36DCE4361EA22852E9B0B614C554F6637B77F6886BFB1C03697CFDEE5B2DAE5D
SHA-512:	1CAFCA13099E25175B0FC8C1CD7045030F9FE6225AE7DF8058C08178F8FD73F2359CE00EE60CA9205966B2AB0BA98BF6E13D01D70808F4F153192919D0BB8041
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\OHK6a4WIJ0F6rlhWGJwMYrRP.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f8MQunt0M68AqAW4zdwcL0Ui.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.918104667105448
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5Eci/gL:fE1wkn23En/gL
MD5:	9F5A3F929D7A062437C91076362A086E
SHA1:	E79B51FE861B241BDDCBCCF7BEFB4532200AEC6E
SHA-256:	139FC73EE7BA57C919DF2719807474D5775BFD6E8FB3B8A64EB6BDE1975565C0
SHA-512:	38E3A4281DB7B63A8C61DFE12DC539F5F095B10C3FA99E22CB472CE1D53E28AD085DCCA67B147F54FFE4790565FC1F7955BA366E01DC67D099511E591A3147AE
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\a3F2iXIaBwCbhUUvTA3BBuOE.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fYZb9ShA44FqrsrhTi1y1tTz.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.859521258323178
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5JAn6axHEykdan:fE1wkn23SPxkyD
MD5:	FA6D9E29CEB1788BFF73A111791E804A
SHA1:	ACFB12B902409391F0A55A0F1774C05B4FEF86A5
SHA-256:	232D6DF8C50D6B93C5BE059872C2C59D771C89CB28E804AC58686765DAEF0131
SHA-512:	034C9A432672364AC688A3DFEB986E1299350354F017D6187BB2D2C29F22BBA66ED9159A77425259003B68346329D41789441790AE1DE2E1E5322AAEDC3431D4
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\leLskzRZPIglQflslvTIwLTy.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\g36Pj4OeQfT5fsEy942pjuLB.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.766446791066172
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5wgNjfEJACHFn:fE1wkn23wsfw
MD5:	0C840CB08C92DF968339D9963481EA6E
SHA1:	7D34723F9DC096572EB68B2C8487A95EE54A9AC0
SHA-256:	2C7FB3D8B6008CB191C47C36C8E592BA0154B0F24FBF03F48A00C0E5DDF7C737
SHA-512:	D3C125478A9B058AD7D7518BC64BA357B03C32698549E14663BD34B7DAF1DDDF3DCB3B31351D3C0D17EA031835F23B0DCA64F311598944BD9115305C8AE911AB
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\UrT5ltGRxob1yeMhM5Nnnzax.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\g3wuBpjd4YSwE1PpTVWpnQ2U.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.842088543948397
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5LjKbtdN20dm:fE1wkn23vKbtr2km
MD5:	DDAA507460A42B6F2407E7DB94E17A84
SHA1:	596B821BC629778E516B9AFCE7BDEA7ECCA87D77
SHA-256:	AF421121A3E190D08CFB0ACA9DEAB74AA1A5164781B494CFCF093094C7DF5EEA
SHA-512:	F12163340957A39DE99685AE7ABD7DAB67914D1DAAAC70AFE95E66A8D2F9E493C0511AFED7469BD8374A29D5CB0C7EB83C3B020CE15AE5C9D841294C806554EC
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\nDHXe5EkxWeixtBE9998831S.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gN85yFjd6Vx1mOqdlrX804mt.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.992854591656512
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5tun0WBrC+X2PXkiykdan:fE1wkn23vCX2PUiyD
MD5:	D9C4B9C7A041E1A76EEF790C91E343B3
SHA1:	362BD32CAC47F85119FBF7FF5CF907FE92510B33
SHA-256:	6093CCED83664B926E986F0259C9AC8BF858EE6BA585E79C89ABBB1A4BBBF269
SHA-512:	60FCB7E289A06F5469B36CFF3E1AB726FE2D047479FBF27C5A0F078849842FF59D6055695E436D1262C63715EDC7C7D551C19D40D6B001CB42C656DC262EFA72
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\HKhPqHszLj6gz3A9XYe5jsNS.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gR0lGfIoDtFYzlUhRusWoKhW.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.921940355605309
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5XjhzrWxrDKOP:fE1wkn234PvP
MD5:	EDB6914DDC9FC74DD65F20CB4909A24A
SHA1:	C23DDF834DC1BBE185BE9BA2789F42AD1267278F
SHA-256:	0FF50029A11C7E51C2CD5C707A77FA7F725B0963ACCEC6EBA11B416CAF939ED4
SHA-512:	89B8392D6E35C8A99B2ADAE9C8384C4F88C38435A67F54A9FB71EBC61C320CDBD6CD2A215F57D3DDD4634C7AB7B3974C96DFB0F99D3775A81611690A6F139691
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\2xlrDVEKDyhTNLHkwA8DqN66.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ghLXR4xqE410iKbU3cBOmlGw.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.684773283480668
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5KXYP6EUJFn:fE1wkn23Ky6rF
MD5:	BB76B088C94E28760C268224ED13CAE7
SHA1:	DB4999297537F43EEE19E017471EC67440BCDC5F
SHA-256:	9C155ECCB36EB199FA8C38EA46E0BE8F775C0783060B1845F23FFBF9445FF8E8
SHA-512:	0254EB079DCE0176F2EBD23878B40979B05DBF615EF53212E158B8E21D6F5ACEC64FBEF8D7B73C8E1B5D05627F288394F4566911C102813B007537487513F027
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\orrmvmRrWiQUvvR2gvxmt2Uq.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hDjwSDfdU2qJ2iM65plUxEZr.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.892954848358932
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5XC1hKyxjWX:fE1wkn23SOijC
MD5:	69E26F8017BB86A37F6E1B9C78D24AC1
SHA1:	310641882EAB48B40E1A7362F9D454706AA1E4A7
SHA-256:	A8C62CFAB8CBC64D8349F07C63FC354830499F01C1C64CFD40A87438FF95E57E
SHA-512:	B04735EFB7F00604A8BBA40257F157D06F970B9E1352AFC8CD6607D6252C4E5676A6A9B7E2FDF72E458EAF066A5CE93451CCD87904CD2DF3478599A19C80DA32
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\ro486V1Z7P66nNToWTrVxquk.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hJyo6w6bfQfja88teforIKdz.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.918104667105449
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5ctCE8Y0Vumn:fE1wkn23cuPX
MD5:	C6B446745D4CC3385458C81DC6C3F35B
SHA1:	E6B5087C75F4CBFA5074F21DDA85ADC5516949A8
SHA-256:	DE8E9E542C56A2D9FCD578527FD487D4D62F7C126A081ACC1FAF1EF4479D3E4C
SHA-512:	C33710782F019338BBD20293B2976451A9765DFAC04741F46850A8561BE328727F8C8366D1E342386E535485B97CC43C120BBA090A75A294AC665FD7BD8B7587
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\9HGEbLH7EssqmLwFcrlZYSWT.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hQMzrTDrEmEhlXEwSqkI11ka.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.077808290419272
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5r/SdiF:fE1wkn23mdiF
MD5:	B3EB0AFB4B101FBD2507FEAE89E83733
SHA1:	DC35995DD36FF98E30DDBEBD302FA418EAFC1C37
SHA-256:	EC176DBD1D23452F195F7C6E6CD92D81E2D1239A2A44DEA6409CF43C93DA83A7
SHA-512:	03DA22834009340390062F5B93CA46D51F3FE7F04636ECA350C666F28221C14E0E7C8506F1D09DC5721822367AE1280FAA3FAE79A64F389A718F11179C237BD9
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\Nq9MYb4uPnSDV9cCg1KHXQbW.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\i8HshVgTCpXiQf6L29fDdtf2.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.003613863190812
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5wxPf4BaMo0XUcACl:fE1wkn23wlf2aMD+Cl
MD5:	877E22609258A308EDB9FBF006FA9AB0
SHA1:	CC738AB78F1AB4DA33CC3494B329D38087AD66C5
SHA-256:	3A92D1BF5C8623211A9A2FF012193B4D9D3CA72D0D06E5FCC36DF8B7BBB9B6E8
SHA-512:	7013208D378F32FD4ED38FCDAC5D47A6A28AEE50E467FD3BF0B7BCEAE5A87E1972FAAB5E8634B35692191A5254A590DEFAC0E64BEBC34E880D3A9A5EDD43B201
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\UT13zjeHVdOFi7IHMIp0XqHQ.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ikpPsIJMpIzBG9ZiRh1WNm6b.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.945642848698059
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5VXTsEkmn:fE1wkn239TsEL
MD5:	C52726A06B74E9F46FEC6EEA3AF51B97
SHA1:	E1B975441ADE9D8B575B7F2310C23DECD7D32645
SHA-256:	C500D9BB54A37484577E758727638D77F2841B7AA34EA526753142DA505262D4
SHA-512:	EC344EAE0B9303F2DDD4EC50194E07027EC4C7FD8C2FA593325CC6868BD827C7BE45D393FC4672DC95E920C27F435BF4CE6C242D31D8CA2FF64D2A4DE3E9DD30
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\0rPqVWXk4L1q7vaDqSSAYuOV.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jSlH1NDdwZ5sVvpJLaRGlUg3.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.939985464269607
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5xMXYI6NrhL4Al:fE1wkn23Wm1L4Al
MD5:	37735D46DF8F44E0BAF5BD89D54F6F89
SHA1:	41CD968F770A4928B6EB8B5B31935BC17DD614C9
SHA-256:	2A48E26F0F312E36F2F696A1B7021E24E5F12A1C7CD6776144FB671B48F014D4
SHA-512:	F8D7F9E01B178C0B99FEDDB2149EB8475BB1AA7AE57F4FA2E301D279563260903838135B610BE7E90FDAE06052D73393FD1A5C2B5A7C14C74A57EA1FC21ECBBF
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\Ti2wvx1Jt0MWHlDpZMMIhhND.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kAkbE0p9XJOYqRS1e4Gf5Dm5.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.945642848698058
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5sm9UuyHVaUAo3SL4mn:fE1wkn23smUHVYoiLv
MD5:	5931A129BDBA443064C5C39CE56DD285
SHA1:	C8FE3A1AEBC5F654A541B29330BF824974566F8B
SHA-256:	F9B8CEB5674C8EB2C6B71F338F8942F00EF4C6109FE4A7C44CB02237D47CC891
SHA-512:	D6BDC14F5D1CA85F2A97EF42F2C7910DC58571809BAFC13EF086B893EA63D59FD9FE9B6BF25D6DA6B6E1CDE0A614D24F644761FE0273A06921A9F9C97EF66820
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\ICXg2Ke2vnpuobif1V7ZIlR7.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\l2ChmrDmSS97MQITbBWwabW2.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.806372696894627
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J52VR3mccIVsn:fE1wkn23273mcy
MD5:	E99145653B5674F4D0DC9179A5491CED
SHA1:	BE555908ACB9770B3789ACE36AA0EB08F6B59299
SHA-256:	3829D195DC35DA5FAD9881E84544372CB25DEC116239E26FFB4B2ED712E3D466
SHA-512:	0FD02A4B6769A5F125075C7A03C11649CBDFE20C145DE5145A966CE3EC7CEF708B9369DF419B9BE1F7B4AB78DCC74FF83A4ED1AB8C02755857A095504BA119C4
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\Sp4RC4Fzn9R3nxCm7XaceyVC.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lDqIZHzEh5aA9T958bHHuayh.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.933255124462212
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5VWZ9lPvpg8BWHF:fE1wkn232xp5BAF
MD5:	3439D6F7DE73D25E4E98421B7F0A243C
SHA1:	87569B486EC4B1DD43B11AB3B12A89E260622EA7
SHA-256:	8B925D6EF76C15135F670CE38A04E7F34C72E164E43BA401A3FF1918A62C5512
SHA-512:	ADFF2AC82B811FE35F310402A83A1A441A70DC69F9619C5CF9E77C1BEA0FD73D4E5AAB876121243784997CDB5673207023DE11F5A38377BCD2976F01DCABF0A2
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\03VPbfdR0v0eUJbl3BY2yvWa.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lN6EZkNxV3rXX2qxPicAYE9F.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	5.033218236775856
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5iANFMBHmrYpL4iykdan:fE1wkn23iANFElQD
MD5:	3ED98596C7A77682FF4316D1D9DD73C3
SHA1:	E1758227AD1241FDC439474E9CB926C2161C7C06
SHA-256:	D371B293D9C940EC9354CB89896F0FE5E1F856F8DADC1CE401E4B8F524CBCB1A
SHA-512:	49B238477D9C454DE1AA326718704F571F0DFEDF5941E6EC40540B80C50EC36186F01B9E7990EF91E8946896EAF86C20BB43B0FF59CBE4F43AE816DF90AC7D06
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\Ge2xGCQPLJT2DzNk3YNjEyuZ.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lWyBM6xzEYH8af3JtrgoGLji.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.824043435284101
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5P3Qc08xtl:fE1wkn23y8rl
MD5:	A4F890CB1B5ABE8356EBE15625EFC5BF
SHA1:	4FD1AE001F90676E8FB57E82324CD59B50717A02
SHA-256:	7CDD9FFBFCEB4AE10E7E88C39EE5A81CF7936C28D3F48FCBE3A24AF4806E71E7
SHA-512:	94617316C9377CB19DE0E845D6DD85BD0E6929BB4D1D61AEE7EB5AF42FAA7E9ADC3535A2A683FED29985A635B10A52317BF093EF8D6E1CE487BF7F72D6DC6E3B
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\jzqvqBGkG9ji22i8AoGkLtvR.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ly0vAWTAcIU5cged5BZiiVcK.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	5.036367335666442
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J52CVNWXkwQ/kdan:fE1wkn232CnQkwoD
MD5:	0CDE8F9B6EE4D8EB981358B8A772897C
SHA1:	E35AEB6EE786F9124C19A795C21CE5CE8DA70472
SHA-256:	4D1D473DBF9A669C79DAA70226B3C58F7FD816D0A25F5C02B30442D8D9AA9083
SHA-512:	25E97125EE7B8B2D8589A46BCCE0CDB57027786CB807A70828828920D46B12B532CA8E454D9B7B403BF262C4046DEBA35CF601FEBAC9620EF1894EED1ADE9508
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\SgphKg63629U7dMJ7gswdhRB.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mJLmefrCsgE5krwk9Oci0Bbw.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.7658403565739045
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5cbevw+8x4Al:fE1wkn23cbqIl
MD5:	9E53571A574F43F030363442C58715FA
SHA1:	11DFA42B862FFDBAD3E470A4F9A2E70C6BEBD4D2
SHA-256:	CA29628C8A2432794D7000CFE077DC1A63779F1080BCF15CE7EE92EBAC31D7E8
SHA-512:	0B3122D44D143B23F4B961A89ACB194C2F2725EF5405E569F242394385584B3CDA504ACFF1FB7070C6E757071B400259EDA1DD1B40572FE32F9423059033BDC7
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\yyOg8vFUEf8ewje7ePyYaYrp.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mVUYVq6R7ZMOQMgpxdxZp1O4.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.967523645862217
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5gujmOOM0sn:fE1wkn23g2OM0s
MD5:	55776389F8D2B436ADAB1CCCA20B1FDB
SHA1:	5C904D2679F377021099132B39CE55847026C343
SHA-256:	CCB6661B520F23B8301BBE5909C84D0BAFFA17E21279223B250873DF7A3337EA
SHA-512:	80B1D5C7763A867F6764790F016F75E609D56347B67BFCA24C6CE2E412818DB8B197ECC4B59E1D5D446E147D6E349D6B66B2AF6B93F4511D55E636C60D76474E
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\EfWbusCUqNvTcQMtFkj7YUGY.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mmqKP8XD0uGxtV9TJKNqEzH1.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.847745928376849
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5DxA/riIsMfLvn:fE1wkn23lgl5fLv
MD5:	5567DA83B6ED5FF9C9795D7D73677374
SHA1:	C89AC7D4C1D1328DEF7AF27BA8230F845906F502
SHA-256:	3D0838A16172B2694ADA09B652F926AD0445E5C0A1B2073F8BC8C7ADA06F050D
SHA-512:	8CF390A2917EF0699375B8E9840D2CB4FD806D02BBD5C021E4446E13352AC6CC933F6CB2C8E2D8E057AEDCBFFCB60A274972A9DD24FFF02F3523A40F9AA25FF3
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\fiUeZNNCTIS5H2aPexzpE5Lz.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nkgJlCpXnklvIZptbofXvweb.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.003613863190812
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5opIMq0ExtER0s:fE1wkn23o40ExtEt
MD5:	A02E043B24FD1E6B66969D9BFB2E5E77
SHA1:	E652754B0980EFFE14FB80B1EAFDF9F0E801C490
SHA-256:	168D407A157B03E54091922F7C26852A3CE4756B400B62EDF967CA49BD033DEA
SHA-512:	CDE097FE43C319D70147C94FB7B0FFF12D1C57507080987B8D0FDC765C4F13D99360E5407E0CCCEFEE4C8506FC079260AE35FB5423524918DDE2A7A737F9C8DE
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\MLm2a0TiwOQvrEuSm0y6Hlo4.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oNve74NBPpA58KkAy4un9IhP.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.014554261772892
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5G7XzJ1ezn:fE1wkn23GzzJAz
MD5:	FAB854E8C515F932224460723EDC41CE
SHA1:	6F65934B2BA7E3475D84FA59DE848662457C0F4B
SHA-256:	4AF55FF4FF15EC2A34A861F53DE18119609C69E18FB1D5924EB1FB786E9AAA0B
SHA-512:	242BD4BC416B61C09DB216961C840597593774D88BA2546AF164A46D19D5D58FD78AEC74D7D3CE19A342BAB7986EA0CE8055CE310CE4729291674272D5E240E4
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\c0Si5Ocs5Hjqmkw7zPRBLU4J.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oheY3Go4pZ1wm0vIDukxGCTy.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.927597740033761
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5dSto2VJs1IWNbLv:fE1wkn23K0IWNX
MD5:	06538E012E96D61C2F64872293C3496E
SHA1:	FDC796E3DE09A87FC2943B0B2F5B335216E3C982
SHA-256:	D601743A9B6555A409D64E6BD9E26C7D9101A187E5C621C6858712890F495901
SHA-512:	03BC688BC7D22C3A5574C4A673790E346FDB35854F575984151AA4D2A34672C7C44E71C590378F8467AB5AFE6A183F83903470EFDB683345EE06086550B8DE7E
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\87JPMSplrYgzi5Cttm3Z375k.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pSM2nuIFwq1STBoginT3tgcm.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.956583247280138
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5OHo8xcoLACl:fE1wkn23O5aoLNl
MD5:	26861A2570914D2E02C7C7168D9E5070
SHA1:	7DF7EEDE7A442C874282ADD2559BAFAF1405A419
SHA-256:	A9F68BE33E1CD7D0E880FC730038F98FB85ED939F52DE4F21E6F04D0043A95FD
SHA-512:	B48C0B5B02E9395387C702498FEC71CD11CC17FA84727B55F676EB44FA50308E5EB66F7A7A31ED45931D6C57AB5DF3B45A5A3A29D2ACE25292AD3F7BD1D2DC92
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\kbk5zLOtlX5KBIypEMa7wHhL.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pY0QVnYhBROLQVS5oQrN5o7m.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.939985464269607
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J52lerRkVK8PLAdiF:fE1wkn232lMRizv
MD5:	379D5169B927978D992F8E1423CC08DB
SHA1:	9BE48DFEF2CFD4B59E536C6CE1383325947212E4
SHA-256:	320F57892108D05BB8B733D1373835FF2FFBDAC9DAB195391C9AFBDA84FD5980
SHA-512:	673B6B520465BF05C7ADB0FBA1CA168ACB391D9B3E28328A2CB3E531946739D5DC9031D07316FE8A0EA79998F9017F53B3CABE728E230C62204E63FFCD2DE233
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\SN1mrhiBAGt5YdpSiR94ouLj.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pY628AxjApG4YTXlrhGV8yw3.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.903895246941012
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J52Nw48VCasRNVkm:fE1wkn232aCawEm
MD5:	388056804706CDE8884CF2A3FDC88443
SHA1:	4F9E7C08925A5B1A381D44B6E6CF4A7CE9B272F9
SHA-256:	746F7700BCFB916D012F5C66BBD6823AEDDEE180F872715185889D67FADDB369
SHA-512:	887C37D3081913DED1902040F6A05FFD948DD333C1FDA9B06F5121253B345C8A6A56C90A6994B55596718C54B0F6C09AD82A98369EF707CB1B073E61DC95596D
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\ShUBAVvG4N04pgkRyyhwlthp.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qCOpGIKJ0lXq2cvfLssuk720.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.967523645862218
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5smHYcSCQyv9Nln:fE1wkn23smHBTv9Nl
MD5:	E8C12186875A7FFDE4F5FA9D9AC29D1B
SHA1:	5072AE528B49F43C4FA54CDFA50AD016B91876E7
SHA-256:	80D817B78BD1093C9DF6184D4C7161D6786D2D7F3821472B7804415C931887B3
SHA-512:	4699FCC98BBE3752C45AA7B2604ECEFE8E76683B087E338A859CE22DA69D0B62900F51667C61CF2CC2BF49451C961E9B264FF66AF1D4D954A1FB882847658F9F
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\IC4DTPQmGTctezS5guL9vFLJ.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qFVilIfcpozbs3MkwKHcvv8j.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.00889687734444
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5X9UsE/:fE1wkn23Tw
MD5:	E57451714EE283882F8D8D52CE9EF9D5
SHA1:	5B1EB7D2E29CD86BC7CC362DD97F12121DA1DA37
SHA-256:	DFC899544CE258C7515E759A181E0EC988B31A714F7AA327D75F50646E7E2D3F
SHA-512:	B84034BC0C3BCD2C66D88E8C9F4786B29E687E1DC954E4810DDE0BD7AF9D6827B5C1E8900FB940BF1D341D89F4FC62CB788A90AC30A7EA4BEB91560B0CDEDE73
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\2mVrLbuGc4HvqI1vBpAy5Z7r.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qbR2nxvU5YfBQ02xmUe4NkXt.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.904269617215836
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5SXQK5Aprzs:fE1wkn23SXQyArzs
MD5:	C1570BF3B35AB8F627F134F7E758F6B8
SHA1:	12CA282DEC56DBE7165333510C51253A9A70B0C5
SHA-256:	C7B8DB3FF7FEFCEB717F32CE3E71F8D9EBBD3FA930F5B24CEDD0FAA2B78B5283
SHA-512:	1B49358B21643E775C7CEE9F056BA938E920466CB149BF9080522B3634F47BB2CD4AA321C9596F38ACE2B0C132384225FD2BA32B69C5245402DF9485D264EBD6
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\wGwvjr8JuoYAqhoeP1STOomL.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rAqJNKgRVbKovSMY9qDHSj7d.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.92027604748274
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5PFP2kzPvOdmIkdan:fE1wkn239Pnj2D
MD5:	95A87FB2F9CF9FA90F3AA744EA3F18DE
SHA1:	F01DBFF6B30849695532A1B0D93CEC045297C3F5
SHA-256:	B04B73BF33D04613850A08317BA6FAD29F736D633A5AD31F9B94B6CF1C3A3BA1
SHA-512:	D8941E2B53694E4EF1D8008965767159385DAEC8049081B8F769DDB686DF7978F52B45176D1D097E55775171E22F1D7E2A1E9C482DEA9CC00E64723A0AE14340
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\jx4EXQWaWISJJqVjnXD4Dqaz.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\s1E2hy8nTgTiq969cqnOj6it.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.893329218633757
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5WrNhob8yVd+4m:fE1wkn23WLob8yVd+v
MD5:	7441CA891B8C38B1A19B1014078E820B
SHA1:	4D77B1FD1407582D7366467122C8DDDA51DE4039
SHA-256:	ACDB12E6798D34E28AB06F99AA79287949809B5CAC6D7341186BE8BBAF31E9CF
SHA-512:	5CC57AD1568CC1EFB2C940731E520913449F23697479EA4716A16D4FC51C3FDF7C6A9BAE686098FDE2BCDF02906B65FF4C6698E89625EC1E9A1DC286A6A71E98
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\sZTgVuBgO0l3CMzVYan4pxrE.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sCaMNwrALXlwWpSshXrS6cdu.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.904269617215838
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5pkTq60boEF:fE1wkn23X60cEF
MD5:	356B3BABE12108A1927AF5355953FE51
SHA1:	78D3A4E318E0959B2404EDE98A8C6C665E24C1EF
SHA-256:	A52DBAD06639EACE8EC17699856FBA0DCB4417D97363B02F95E4EC354DC37783
SHA-512:	BAAA2875F09544322C1180E2CDCC88AB031573C5D5EBEFF0B096E02ABB542D59DE4C81190E9A746B81F9D799EF474511AA407C8F3E2D51155A07E1DDB1B71B8C
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\LAJLX2OtZ85vzPOftAYRcEsi.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t0VeReiJ2D1H7tlhX86CFX2V.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.967523645862217
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5CvPvNUy6Adm:fE1wkn23CvP+zv
MD5:	BC76A0CA16AE0965408BB39E02EA77F7
SHA1:	98F1A1A91D1891F10AC4C440715DEBC244B8AA49
SHA-256:	D9FA2C1196C65F683DB0B4369DAEDE614005B0F62C55DB8E90D747B68A000EF3
SHA-512:	417ADDDEB030555EF9B910A53B691E5E8BF6C40E3241C5B0A5EF2713A769D2573883BB7823E8D064C4D78FAAD049E85C8278A68908C6717FE0B19C7AB6DED221
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\g74FLtS6pxPabgJh1GOJP0y9.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tyRpv4Ym9bfSQFq5y44ZesRX.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.91099995702323
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J59GhqsgLCEeyLiF:fE1wkn233LFN+F
MD5:	E099FD20D54CA6A6675260986C9EA41F
SHA1:	75A0F0E41CB10B210FA44D05D0BE320A94709C9A
SHA-256:	FC8652DC8D208E826C52D7AF54BCD68436A675F9B2B7DC81000D21D220A94658
SHA-512:	8FE570053033FA217AD8EF3A85F81BB4076C4A51E84C91A5D6E92EA22A9BD342261B8B3D9BB39563CAAE58B660F6E9D33EA6B3640DA246F64F5757058611FF75
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\XcDOAu7dcqSLvLgCVhDWG4DS.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\u3cUq3l4BLwzorw3WojT8R94.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.905716942869603
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5OEKm72Pj9ln:fE1wkn23OEKm7ojH
MD5:	DDB5C45F3EC99A758296010FEDAA092B
SHA1:	6BC8FF6C757A8D6BA6EAEEE577591AE0D095B113
SHA-256:	EAA6D13464815270C84FEF773E5A151586F422DDED83BC96296DFD6E89439A61
SHA-512:	705F6A8C7664EF2885E53606E4F8235333F52145C0ABAAFBA9CF6C374D6C608C0E20086D172E60272E4D57206E752FAD4782A8B9A2AA356C800EFDBD6C22849C
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\ka3JrCFlTPYjnvR6dwKLC1vl.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uHxI55dS46eMPxqmwl14Uvsb.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.9064414641734455
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J51CcHUxpnFe8NlIkdan:fE1wkn23hHUxmTD
MD5:	8EBC4FA51BDC3BEBE4268DD0CC709FA5
SHA1:	B35FC032F2FB1D0FA1E86260C62E729A18B4AFD4
SHA-256:	3A758F90CCA143E568108CE8B75F69377B05F4D85E0BA082E55646DB9B97F26D
SHA-512:	F272063B671650DED43A86893180E370F202E0747CCB69BDF15D994C4B61B0F338D0997E1E59A0FB18FE44CC943E0AC2ECA72EACD67BB48DD1BED11D584B1B17
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\PgyoyDyjTaeBIiR0ZncnFz3x.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vNxTxhnF1jLDF3c3IhQ0ugBn.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.008896877344439
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5ws9EG32UbSX3Lv:fE1wkn23ws9tDbSLv
MD5:	F71A06DD7ABD20F0267496D203DCD387
SHA1:	0E8916E58DF524DD345C2886AF6998D86BC4EABD
SHA-256:	3423FE32C656326F5FDB28CADE67EC5DCC9C4B574685C994E9AC1450AA233B30
SHA-512:	0CDEC66FCDF344BC3E06FA463AC86515DEC74DBB7B2317D35A3FE6891AB7E1D8989BAE517714929A9067099468E701871F461D5AE8C1B78DE12F898DAFAE65B5
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\UIlVvmdU1KS1YgdCPOj7XPRB.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\viVdM1bZfxrDUfNurqYFq5oQ.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.809601950902222
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J509W5g1DVSNl:fE1wkn2308gqNl
MD5:	668F5252B276D1CE86445345972222AA
SHA1:	3550F186BB7AE6089CBD8376B81AA3350636A5C8
SHA-256:	35D08187DAC1138CA04CEF231DF471A7CC0EB80D47AEB286ED63A12666D01EFF
SHA-512:	645997B71F86D4E6DDA1570FB492449D3608E78BB059AC601EAEF697AE39A71ACD9E8C6AFDC69259B889D901CC20C7D54726068DF4BECA7D629F47D012BD77EB
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\QXOXdXIs2CDsFYBPsa07tHNX.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wO2nme35VyCy2jM8Jkkrv3aB.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.782670203801878
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5QxhikHZKCdJF:fE1wkn23QHH5KC
MD5:	54AE41C7B528529DB95069CC3EF71B61
SHA1:	156DF94BCF94854CA6B29CE4AB4F1BD331DE7B59
SHA-256:	C17F384042ECD66B5EBA0DF10067ADCAFAD0F698A9C9FC732ACE5B1E084AAFB5
SHA-512:	978B92D6236A71F52C67D440587B0A470A3AB96C1D712D288CB55F0A4AA1166CA29963FE661A14CAC95E844E045D1A1181CB83C8515107B5AF6910D4B633DCA8
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\uTpnhMoQAbjpswVVMilQAog8.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xYZ8ltMxDtErLgr3Gr6hsDwB.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.938538138615841
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5LcoPTS3h0sn:fE1wkn231PTkCs
MD5:	5E8B89116E360ED35DE9F06388F24464
SHA1:	913CD92C64D124A0B326896959FE23DF9CBF868C
SHA-256:	8D759E63219B111F5CDD24B45AE3E186BAD5971DE623C41872D832F91E1353C1
SHA-512:	8A8875F8477F2F1B9A1ABA97EA6CCF106A54FE07F3276CF59D59D18D33FE4DCAAF08615963DAA25F5A364B79DFA529AEE2DF2FAEAB511379D69B5E3F3ADD013C
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\n9Mh8v3pnnImlBJy2SUqnwt7.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xff4reuwezkTHOPHNgaOdMxG.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.929045065687528
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5X+yo9QYTLosn:fE1wkn23uf7Tr
MD5:	A8319F26C621BAA15E4E1F391A1DB2E4
SHA1:	870D8FE5B188350854F44403034CE2F1683D81F7
SHA-256:	0134B3B5D5ADA48D6AAC0EA83B7D36F8B2E08E9A94CB7E8E22EA407C21678D35
SHA-512:	9E367C7377723C2A24F3D297A9F3FE1187D7CA94E243609C16759A2CEADFE966E41C83C979D63399188909DDF845E92D94C4A9989F7909B71B98F9E13764343A
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\rNWlWD0ZgXMhzWvOuALV5nXl.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xjfzmzWD1uQBqZzTdHA0H8BM.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.937516258419332
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5ifJyALiPzMRdmIkdan:fE1wkn23ixyALEMRpD
MD5:	04FF26E98BFDB4B4C93FC2FDC669B129
SHA1:	DA1658B9CF9D6FC27F4D7B8665871385D532F9DF
SHA-256:	AFBCEF42CA65D3DB94CA9A7D926EEAA8C8EE75751F7F71345356CA663ECC4F34
SHA-512:	D9D02849AA3BDE7487F3A1F69CAF162B2E77FE2343DB3DE29FCAF97967062DCF2EAD969BB5DCD6BEF34A11DB6B8C7A4F75142E2AF834DD61D9E2EC64E449CD38
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\GzgoX5V54ke4dVGjS16ex045.exe" --silent --allusers=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ybfKR4xYXNZBwVs19w5NxNCx.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	5.019837275926519
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5LkqD0CmnRztHlcv:fE1wkn23z7mRz2
MD5:	BAC937B7A49A41C50F9EB016CE096D02
SHA1:	49E8EE4A7A1D17DF09AD68A226E433712BBA4D0E
SHA-256:	AA70FB31652C56714BE8F2470E13E82489DE59A51EDF1FCA61F2A32EC6CACEDA
SHA-512:	81F440D0F0F9AE9BDF9528E9F321BFFFA6BA7E7D2DAB9E53F23B16FA3D252E424E36C21927132CF931727B0F8AD37570ABDEC5D5A227A15659BE211E6194132D
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\nvMOfQgAbNYiBrdqNEHby9rc.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ygAJfFrum1FZrl8um8F1ktaM.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.87528410996946
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5c8RIAt7v:fE1wkn23cPA5
MD5:	13FA44EBD5F942C70DB71C158F3737C3
SHA1:	4F2B6E089A38C8156BA4CEB5782AC92CB954B0B5
SHA-256:	FB58851F3952AC8EBEF2F5E5710CCC484227ACF3FCD4211819E3DEEE9AF0930D
SHA-512:	CD7B1F6AA2BD94A66DAE31BE2450C6A3937BB43B5CABBA252A3698B8AFBBFB58273DB602D69CC4C41CB880AA3361B57D7E965F3E80B7988FE09FC026E5FA7BEA
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\9er3Js7GDifxgqZh2XipvtXh.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zZ1vzBEdn1hKBDBvQgosimyo.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.80926734820216
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5tD4ICko0ueL:fE1wkn23x4qp/
MD5:	8151A7F9E4A5183582A479C8F31816DE
SHA1:	D04596658DE1A6963C41F2270DB4E70E5D2FD14B
SHA-256:	A1018151F9CA3D74CE64F080B1D06E2D0ACA8C49CA6EE366D211CC021B3EC7F6
SHA-512:	8D15B3E8DF426D6779FA53DF35A865A73A35A77E3E0055F242F6EB7A1E90ABA637601642D9A0C18ADF0DBCD7E5B31DEC3355DC55B60C00BD4530C4263092610E
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\HfRmesToGDAxeXrQ5sUnZbvw.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zmt1Uz6FR5q2VJqcLQpvqgxZ.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	69
Entropy (8bit):	4.934702450115979
Encrypted:	false
SSDEEP:	3:Ljn9m1t+kiE2J5C9UphWDJXkFn:fE1wkn23C9vV0F
MD5:	4488820E8561D04101C9BD1C880592F5
SHA1:	CE61DD81BC9C66F89B9B9B9720A9CBA8687FF770
SHA-256:	77EC233DE4FC8B225C45FEABAF154CF4C76C666E4E569F6823F811B60241B94B
SHA-512:	9C325CB0A7C0BFD145A45F1707E7A706EAAAA1A9AD3EEC232472CA93E4496E7BB316747B074CBD5A37DC9EC02CC823E35E7F41AB4D426912A7C22F4C9D921BF2
Malicious:	true
Reputation:	unknown
Preview:	start "" "C:\Users\user\AppData\Local\g8ZqhZX4Hv3yrSl3yliJsZDM.exe"

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports\settings.dat

Download File

Process:	C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.204162526001658
Encrypted:	false
SSDEEP:	3:FkWXlJ6gn:9J6g
MD5:	9AD22A19C0E4A6789F105D0014907013
SHA1:	D9B423C71EB18733C652790038E47EBA60F65D7C
SHA-256:	E02B21CAD9C24DDC6AAA31C2A21778BB68534EC677C6E618D2A2B0AB82F7A5EC
SHA-512:	1666641EFBABDE9349567F6F27A4BB692021DC96FF5B00BA52791CEC0FF3275322F6EEBB6822D28412920D227C24CE130F27D1EC86EF553A0876CB67BE29369B
Malicious:	false
Reputation:	unknown
Preview:	sdPC.....................@....<M..?n$.6.

C:\Users\user\AppData\Roaming\Temp\Task.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\BroomSetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	4.806068215477973
Encrypted:	false
SSDEEP:	3:HFUuvaOpLKBchEXEtTC5WAut+kiE2J5xAIEyrKBySKFS3:Ogas7SXEFAuwkn23faKS3
MD5:	43A95207D30C95F513309A882D511D25
SHA1:	B5088D2A0F8BDEBFCABCB194362AB59D20014F29
SHA-256:	DDA9B22F2D2D9CFF7036DEEBDDE40E7CDB62F2587DFC304FE32EF9BFA974DFB6
SHA-512:	52BDAA18A5883343C56F33FC631D2E63B2D30730C482D8278FFA9C8CD9E6469DC88BB32DFDF16118E279D6DC715C92D8DBF534A4D8698195CD14DFD7BC7034ED
Malicious:	false
Reputation:	unknown
Preview:	chcp 1251.. schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\user\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F..

C:\Users\user\Pictures\0IFrK3aRWk7G6YUjUT8ew0OK.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\0iUkmKUli4rxdTjqlhfb3STv.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.5934969142329205
Encrypted:	false
SSDEEP:	48:Q5vbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:8bGRTihhL6HXYc
MD5:	17C6CD9DE9C27B5D73EF66DDA5502048
SHA1:	A429590DB103BE394F18898AF0F1105BEE4348A6
SHA-256:	7413A6B06C091A78C59975AFCE0D2BE772A905F98BD852CCD6CE16BA5CA4580A
SHA-512:	FEA95677ADFEB687E81411BB056F581E435C82537A986FF9A6CD1172039DC9163F3F4FEB5F2DB2D8318514B6C9F6F2B85972315734783C018D2D955BB6C1055B
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="4NZx8mfjGRy08ENou6ZJ8IRywLXBeCla5jn3pdEI">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\1OQjrbwH6I3sd8vA3ha6k08p.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768476822870185
Encrypted:	false
SSDEEP:	49152:snSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHa:/WqlkLESgCRE/vhOjb05efd6e/oXHa
MD5:	3C982E3594F2F49BE9CB21C88EDA12D6
SHA1:	11E9A1EA3A396FF4C8E988AD18547BC32271BA8F
SHA-256:	1D9260EEC107FE58C47C5EC70F99C91739FBA13EC8C90C92D432BDCA6796C381
SHA-512:	14916A03F1D9229EBD91FF2E08788880100139DA3BCB9FD2601EF800F9A156A58E2DA5E27CE8A0CCE1FB39DC836DC4803B6ED8EB9E6FD8D9D98F4B046F5855F5
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.....).-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\Pictures\2ut031I6nOWGwcANYtiL1o1J.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.589477210560654
Encrypted:	false
SSDEEP:	48:QfvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:mbGRTihhL6HXYc
MD5:	9A01C47E6AF92F5487F55CA838C8C585
SHA1:	5FEC5CB0E6F79F5F09B97D7D1EC65AB8B3B26934
SHA-256:	AB3A393727A7964D54A455CF2A92A03A8B04B853F3DAC66C1734237C0BC00E8B
SHA-512:	3421BE4B574BA9D1AAA48EDB62FD5D9EB93212FB7C899083641B960403BA06367EA898CB9F2212F6BBCEF13578F4F50A55A2B4B6074A1F5C85EF9AB10F5AE763
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="b2nJBSbLEcDFuNBpYnZa6yvx1Zqf8p7Cv0rsFJDx">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\3rV9RY4D0vXRAkg7JT32cmCD.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.590320057990015
Encrypted:	false
SSDEEP:	48:QTmVvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:ndbGRTihhL6HXYc
MD5:	124D3780E1935118528A0A552818A614
SHA1:	054C37F4EB32FFDAD8236083A900D0D025F20C73
SHA-256:	B19A421026346DABFE3F82E4D773B052716EC5FD1568D5FC5E36D995330633F9
SHA-512:	4E90BE6F337895D30297B3D4BDF80C1A58B4E22122A15E728CEDE35CF8EA18173F42E3678493EC96F83CA0FF2790BCA55DB9A47A14968B0E499CE8718657F818
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="27HlViOL8qwizSs6Avgr46uwzrsVUNftxEzfpaDk">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\4F7ctSfTyUiwf5E5Jj8ISwxp.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\4cq2SZqMHS3XYqkYi9qoDSje.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768477352100368
Encrypted:	false
SSDEEP:	49152:SnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHO:xWqlkLESgCRE/vhOjb05efd6e/oXHO
MD5:	AEC29038F28A2E108580AE0EEFF02CA1
SHA1:	37B3ADDFCD4B7363D183836AF69CF7B3439AB34F
SHA-256:	8E0B511B5C14173B2933BCF7B24C31CB4B1196E07C80AFC94A0762FC15F33AF2
SHA-512:	D1B799BC93CD0288DB17CC20D8397CF1164CF87B7A0CAA74C9D6F65BBC012933B48E3392BAB01DBE86238714743D186FB551F2DE0004F29FC8BC6F3439A6D5B2
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.......-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\Pictures\4oOqWbJEImqDRLxD75xKRNjm.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768474686252889
Encrypted:	false
SSDEEP:	49152:TnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHR:eWqlkLESgCRE/vhOjb05efd6e/oXHR
MD5:	E7B0996EC1DB9891291BCF610944BD08
SHA1:	296335E95A28B96C2625ECECA861B13F81344105
SHA-256:	20AF48449A47172E31F7ADC1A22A5AD2782A5B9BFD116C44C3E6EC1B12AE04B6
SHA-512:	C36D6C4D36453DF372E306A2A5BE28E2985CFA3E525814C149F4404AB33CED3E751B057668E70A4ACE2AAB430EBC089EC88DFF8923AB4C6846422D54862B294C
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.....Sd-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\Pictures\5pdwJpq902hXA5VnaRygPeAf.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\6EttYMEl0lv0TgoioCDqPARX.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\6FilrATN3dQE8srgx4AKUMVc.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\7SwW0NDNOzD4bm2fh2mMH4aC.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\7mP2uTTqqwYXFx3CixL6JUmx.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768475062916736
Encrypted:	false
SSDEEP:	49152:JnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHy:wWqlkLESgCRE/vhOjb05efd6e/oXHy
MD5:	5A5F1F5AC33EB04DA8C532DBA872AF5D
SHA1:	7128141687FFB1B0332F8F5BC99C93977E360215
SHA-256:	F4BAAD410FD3ABD0DCF086FE6F0AADFB5B20C833AE37A7162F5677541102C46A
SHA-512:	A5960BDBFA8F7632D60FD538901052C6EFD3CF1C9A0301D5AD735BC9256B280CE7684CEE76FEE9325532C39A6B37621C56BDA966C73BAE0678CB89ACC90F17F6
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.......-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\Pictures\7yvJjVKbdq1WHJrfxFmH3872.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\89IAnuHgvZ52kCx57pWfMJyj.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.587631067826824
Encrypted:	false
SSDEEP:	48:Q0vbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:RbGRTihhL6HXYc
MD5:	0B33AEE427F9E9D9A927128F0F787D05
SHA1:	0B079A9949FD95E0EA4B2CAC3297F0C13F8215CA
SHA-256:	83AB5E77FDF50ACBE15AE1BF6323E32FC7C8D95D357986B10661410B4BABC3D9
SHA-512:	E25FB7EF9D9579FDC47A938CF7BDCFC372181A2962C9165853FFE6745B1D9050C64EF0E5073FE3FC4BD49630D227473AF3BD87903923A883E48C177441B350E7
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="28rddVnKHdbl0f6S8oOnhmqoec0XbU5dG65NOGGE">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\94dy1QqwzgyoJs6C4qGbaLjk.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\BtncwRtgPRnpujyKznLGy9d8.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\C2ytbpXjpVGZQltGJ6eXiuhX.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.7684788886449265
Encrypted:	false
SSDEEP:	49152:AnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHD:DWqlkLESgCRE/vhOjb05efd6e/oXHD
MD5:	B45C1FA86E412EA2EF84700E4E5FDAA2
SHA1:	F30CFB4B6C1CF0AC7FC38560E206A501D86C98B6
SHA-256:	6F4A53B48E3A48A598CD4D8CFFC5A7E8CF1FBDB8E7E8AF435A835F8D2ACDA2FF
SHA-512:	597F9E23BE2A68D8B9551CFAA987A467126E1726F6C0C70B4E89F2EE5546B6864A2AA43D6EB37C72FC41C8D50D25CB7D2F85C948DC6ADCC56FD1A5F991119216
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S...........@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\Pictures\C9Df3LuwbD9ycdo5E8aI5Wc6.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\CaOK3iO8OQAwsgQeckh3C4UP.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.586779401894647
Encrypted:	false
SSDEEP:	48:QhJvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:mxbGRTihhL6HXYc
MD5:	CE44696B51A2768CA98DC4D45D2171E1
SHA1:	49174149AF527BF642FFA59DF9C970D356D0A781
SHA-256:	B96C26167647460AED26EBA64E697DBD9A0CAADF5EE9A767D049240286179027
SHA-512:	BAB5F4E1348A358E21ED3F7F4C39BB547E173DBBEFECA2AAE1E9759D8290B02482EF0F6E112BF159813B3F0A4769DF133F32924B631C12DFA021D855A7A591C2
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="oOSMurELJSk8jXrBoJcRp4GvfH14ggRbvareevaP">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\CasE9Xp1QOtkW4E3aVj16cmV.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.598954164195802
Encrypted:	false
SSDEEP:	48:QtYVvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:IgbGRTihhL6HXYc
MD5:	B0D866208CE77DFC34990A2FB2735AA9
SHA1:	E344685DD5824330B7BE164BAB17AE9E2C5F791D
SHA-256:	B08809664CA1CADD973D18B04B2B50525F4E443A411920A0B74D8C375F6AF094
SHA-512:	B4A0C270067E561014C3C184F4F98539A009AA3FE944203A2C2791FA4A3980D40D0A8A88DD8235C09B47480FEDC9DDA684985279483E7D1BE458E5A7A28D8484
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="zzPhP0EFfBuZh6Y3hjUOeQ0UAQZhBJRF2Jl8Wnaf">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\Ci70jxmBCikoxRrlulJIEQH3.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.5944565456773026
Encrypted:	false
SSDEEP:	48:QNCvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:qGbGRTihhL6HXYc
MD5:	19FAF3E185160C000923046DFB83A54E
SHA1:	9E8582102E54A52A3E3AE15E18AA7E34C811288C
SHA-256:	A96B228C294474805C391BDB09EC70E162667EF96C505212A1689561FE50EEAF
SHA-512:	AAD64924C0AE35F7E71B405B9163AA293201D1ED5085759D1F7C1D2BDFC2620830A7BA4B420444517226A11795633FFCC050F9712E8910155A79957342D12906
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="uG72uopF2AYtkCBSPuDNGwEHTvYx5cQyL3vf0OMw">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\CmAp0DxyhTEj5GF5fAGFiA38.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768474603168777
Encrypted:	false
SSDEEP:	49152:cnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXH9:PWqlkLESgCRE/vhOjb05efd6e/oXH9
MD5:	08E95226386FC4EB5E6002A38F7C62CE
SHA1:	77CCFC55BBF395AD554070C7C4142F1615FE19ED
SHA-256:	92917B24FBA11EB44C77E063901C1D6E50C41A8454DF90A7F82E1FBF2E61BADB
SHA-512:	94C91E4636F4896A8128693B0B20868E621153B372B9680C9E6AC1094A7B8F278CFE4FE685E248078FD60D3494DB2D4B168D6DBCE7D267AE28B438168D4C4050
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.....B'....@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\Pictures\DY8D6dQbgIgJO1SaVNqhiZOW.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\HFiFGl6AR63OLnORhPPDiWeA.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.7684784672148375
Encrypted:	false
SSDEEP:	49152:znSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHu:+WqlkLESgCRE/vhOjb05efd6e/oXHu
MD5:	E2DB55FB4F95CEA3A702E64BFD6FFDD7
SHA1:	EC2F8E7BA489AD5764F5B1ED1D3F065BFBCB102A
SHA-256:	BF53EBA11C956500EE629965DA5C23F3D589AFD3B0BD8191224372013EFEC81D
SHA-512:	8729AB9F745FE9DB0454C81AE7A441B8799749D2C3FBD75D3EA33E96D4704A25510BDBA28EDD5418DBD03057FFEDAC83708666FFB6BA06C9683BDE368DD5221C
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S......q-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\Pictures\HHCsqXDqpAXkK1qXCMPkWTES.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\HN7tYbFl9xu8SJ0TV9kPnV6R.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\IVPQ2alvXAGOa4ZbvjP04aTV.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.593494273496843
Encrypted:	false
SSDEEP:	48:QLHvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:mbGRTihhL6HXYc
MD5:	76EBD54D0A6305A316A5975BAAB6399C
SHA1:	D0D63A34F50F294170BC2C08E7CB3F08FBDE0E52
SHA-256:	737B5FAF3FD7927E0B4B04AF7E82E88FE25B0AB6E46435DF6374803C4C39FFA2
SHA-512:	7BCB690CFC1A363791370CC55019463983CDCE70D2C2ECA5C6F3FFB6A17E77C73D23276C7536C6DFB17872CC214AB3416BB0AF9B62402C1983B20E171F46365C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="Aduyc3BFJbYoIsuWbVNtFdg8pwDDGJBmuYik6LEJ">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\IvU2uyNuWFigEygNV6rctFCx.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.598326755201633
Encrypted:	false
SSDEEP:	48:QuZaMvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:1a4bGRTihhL6HXYc
MD5:	3E58AFAD64FE8B9C9BF0E6965F52D712
SHA1:	D8612CE37B4EF238B114E2827A5459A6BDD0981F
SHA-256:	88FFFEA369644E1C47E00FA10447639C2CA853E356E69F2CFF479DF01FE1E8F8
SHA-512:	C27EC4A598477F7C8E2D2A4E25118D101D2BBD9DDEC84BE2DAEB58AA9F709AC4D2C7C39FE35ED71B88CD4C51F8B13A6CC7BA1F11AA218342C44CFF2148317691
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="aNx79O0g6sXKQR1KCbpZG4hi2I6AZAqhzdOHDOXt">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\J0L5GIP8nWdOG64Uj1tuCr4I.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.584145650247149
Encrypted:	false
SSDEEP:	48:Q8vbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:lbGRTihhL6HXYc
MD5:	6918AB5FE0F7047174C7ED4FF2B40906
SHA1:	DF01CB5C858BABDBB6C30DD75588883BE2DF9A17
SHA-256:	A782A730AF361B55636338A1B665396886602B8017456318777B7BF5E0DB8B64
SHA-512:	EB1756155FEF07EB1C4F4E6895150ACB3D1AB46D37F14F5807A1CCBEEAAB9472D3B358FA9B90F73F7062D90C228FE2FF85D7FFD102BD2819249A9EFC6E848997
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="YugCRGYvABZs24bxsAk3bdxgvxRpioahGCcmqu8S">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\Jshk17Bukhv7AlOodjXBVX2B.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\K3a3RLkBmOAUgzYQ2MxzfB6S.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\KV7xIiMtLy0kJUjIxAoYbPAI.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\LKiziaTKHXhXmsyq7iSl6Znq.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\LiMUMFNfqgHoXxfy9KUypTg9.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\MWbupbq1lCIXYvylS8lGgBPD.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\NUsC1LZWtdLvV2hVDgycM5e6.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\NmDs1HYwuXH0hryD0mdBt3jX.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.599878785516158
Encrypted:	false
SSDEEP:	48:QDMvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:g4bGRTihhL6HXYc
MD5:	EC425D5958835E12CBF4309E2793D4AB
SHA1:	981AF420B09E350745390400D267FFF2C35793AB
SHA-256:	340963B3CEC0BAA285370DF2E1E140A2BA8451732071CAEDDCAA588BD4779873
SHA-512:	43A281D0842B88DB4A87A5675EB00A86638EC71FEED3FBA436E84A82FF76EC8FE05A3D861EBF67CF695DAEF0E838440549D41A0DEFFC99B138EB6E48C1E8389B
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="mUGp3W170DX4VYo94Bz25vpRwTVSGhPJTi8cQ3jC">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\OrUhyJcu1NvcVz9aYKgQaEHF.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.5950357282118865
Encrypted:	false
SSDEEP:	48:Qc9vbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:jbGRTihhL6HXYc
MD5:	8C86009F112CCC03B42F85A4E9D00D7E
SHA1:	CE41C078EE160C1DD5597AAE9E5E354A6A9490D7
SHA-256:	8BE265E45535E7F92F7F7FD95897FEA44E2D457596491E53AC4EE881F2D1D1F3
SHA-512:	7222C01529CB5BEA77C5714F94C5ADBEA078ADFB33C5204E43F3B81440013FBE7294A1CDB39B722072852E965032972653AB4201E972FD0A2F8F212B556D9C47
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="Fn7iRFR5EaLZfC8IF7qQZVwnkDuXuc9KBmF0ri1q">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\P52PQNhb6DjA6yqnfJVJRvJc.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\PHBccilKfK9jHQUPwgnTj8b3.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\QIllRQrcYueLdSshRqLTqOvP.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.7684771284236795
Encrypted:	false
SSDEEP:	49152:5nSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHx:AWqlkLESgCRE/vhOjb05efd6e/oXHx
MD5:	9BFF769347ADF4195895A2AA8C977EFF
SHA1:	6FFFA44F2676944F8EF58FB5CFD95BFEA01C881E
SHA-256:	08C8D1F053816719D8F03C23C2FDB3AB6D6DBE21DCB17B513F109DAEE3FA8EA3
SHA-512:	70A39EE9C5A37F891EA01618DC3E3ACF1A78E73B7619FE75A275532A43946E834420EC7BC41B77626853918075865C8BC06B7FEC2FD81B5E54C506A59E6D1E8F
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S......+....@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\Pictures\S9FRoySbKySnaEAuJOzqToi9.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.76847288657226
Encrypted:	false
SSDEEP:	49152:BnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHY:IWqlkLESgCRE/vhOjb05efd6e/oXHY
MD5:	6CE6FA646ED0FF21E6028021912E0C3D
SHA1:	CC28C250494DC88BF2E20B9143BC53B7A9BCD7FD
SHA-256:	CB9706FEBC44B55E895BDDFD2E8C16F194EFD2722EFF3A88D5D89E4625AA6B84
SHA-512:	5672E7C661D45C4E7FB38F6582811FC1C906115A35E4067EB1165B97EECA20B40BB41713F2F0D0A925BDA7F6EF9AC5D8B9EED9DE2F77C6354274C8E1B23D73F5
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.....).-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\Pictures\ThBPJoGxW6s6xOvtetaJLwi2.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768476278129193
Encrypted:	false
SSDEEP:	49152:lnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXH0:8WqlkLESgCRE/vhOjb05efd6e/oXH0
MD5:	968B869AA841B0C675BF2C61DFEAA509
SHA1:	78DB97489F21B53BC7F580F107BD2D1B19D70864
SHA-256:	2249D665BDE0C3FB63E2D24EECA3FFC57DDC4E11C108BE6D23BCE4648B2241EC
SHA-512:	87C005BB51AA85B2C289271F925FDC0B7D02B06670A31C6B699956880F1B925E28333C9B9975B564B44C6C3C65E504269143A2874C38CD000ABEC0A75A2D5EEA
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.......-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\Pictures\VF98zhY4QVhDxJpNtAE2TU6d.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\VbjnVPoWpC8ngAejNWQ8DLBN.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.591178926763232
Encrypted:	false
SSDEEP:	48:QsA/vbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:lAXbGRTihhL6HXYc
MD5:	20D3F63E3FA30A0CF952459CAD05F218
SHA1:	0309C0C86A0226E80E7A42A2724E180719A4DF46
SHA-256:	2A90E0F98B01BA162D8140828126FD4D53CB9FE9C1493B6F4BC223AB1B426489
SHA-512:	694D2A26DF77E39752DEEE1C1EE80E510710E9673FEE390132E827FB6A068A129D485FD3F9F1EC8B47B7DE1011324353F0C5DE9F6CB7413D394DAF025B5AFDE4
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="Z0Y4lmnetww1Wlx4OWOy26iUwEKlCx9EEIPeD85W">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\VgDhRl17mSZEAyX0ktrL58w3.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\WBuKGU5qJ5VUXxoLOGiXoBkH.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.594983809828944
Encrypted:	false
SSDEEP:	48:QnLlyvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:hbGRTihhL6HXYc
MD5:	18D256A4E60ECF3F2180933B0527FBB6
SHA1:	F979CAABDFB617CA49D2F0BD56AD441368B12432
SHA-256:	0CC1F5F4191453384FA83764C211DDC8FFAA95B1CD034CF174D6F887907A4DD1
SHA-512:	A34AC7C02077AA5D22A76432C0A2A2AE865616FF22C0932810BB220FA112E475F3B4716B6DE848C0140B0B2D9350319552D03A87F236AD408D2738785B3D3C82
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="cmsvQ1Uf0QCx5LezxM5OBIpXbKAsSAp4KKmQv5MJ">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\WIPfhQxM6KJXx251iZNwCqDU.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.590753339920411
Encrypted:	false
SSDEEP:	48:QZpvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:kRbGRTihhL6HXYc
MD5:	BB46073EB7149CB7C47129B949F37E34
SHA1:	59A27D9243DC3F5C22EA05B2D654BAAE0F36F37D
SHA-256:	9AEFF77BE74D9C3AB9C946D3C11DFCD5D951949F2BBDD14A12703A67670CF7B7
SHA-512:	E75A0D03D091C357123763651B061715E6F3AB9253E17D543FEC83CD94BE95AC242E7151C6ABA6CC01C71968167958C0843A02B209FACEE9A5B30F6D0AEC6ACA
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="aIyJ1aKazSkiOiFuQAsCYrx5ZF0SoVlm37vVIiQu">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\WtNveQ4d78dApFTRjzeseQ67.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\X0QE4YfIdkFIaFg73EESBmNY.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.597463902653766
Encrypted:	false
SSDEEP:	48:Q5uvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:8SbGRTihhL6HXYc
MD5:	64367B65D0762355A82FDFEB184961FC
SHA1:	5E439232823EB3C29345B80783DC64058DCC138E
SHA-256:	360D38D3F4B1E54B98D003DCBBFD42E7564EBE994166A1D7B5B34B3F6B860A57
SHA-512:	54AEDA4D3860AD809AC8FAE735F5665CF1E7EA6127D3171CD4708BBAE6F47F47FA982A81193F711DDA1A7222D6C5FB710F24FF619648E14D2F7611A450470F16
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="OdNRsXTbYrPBEdUBWV0I6VZa6iJsxkL72sKS1qmm">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\X25zuvF7asVSMm12uFSrccNg.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\XBfbSv4es0kCeAv5VfvvgpQ7.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\XIBzivlqsIPRfzklN9g3VnQx.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\YpqMAvbWtKvsPXvu1AiMGUgE.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\ZeGipmT3eHYuvmbIxgXMhYeA.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\aFkMZIYV0H3vyPVwOnL9WjBJ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\aUJQGrpjjWYYDUiVfYPZvQ7q.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\aUOQyBDQWpOtJeSIFm10c61i.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\alBY3v35R74xONR13b2VtkYE.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\b1uZ67lknMP13RedpY9EzGAj.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\cNYL5IyksZKthNvEJoyBw8Ag.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\dZhcoTSgym1JGRiEQOUqAdeo.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\dghB8AfRudM2FLzl5fgKHzMA.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768474475729983
Encrypted:	false
SSDEEP:	49152:RnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHa:4WqlkLESgCRE/vhOjb05efd6e/oXHa
MD5:	1A962D068BAAA6EBDF686E99D21C8B1C
SHA1:	4A14CF4732149E362B20E7D764045E5868B19A1A
SHA-256:	5AE1502FFB9365AAD71C053BF21E868FB7B9E8ACA5B524A3BD84AA48D30B7F0D
SHA-512:	426550E1C10C742FE30CEE0EFF81BB3FA405D6FEE2ACA853E51D78E668ED8AD0CF9FF43D2213A4575F468D0133DE4AB296CB37AF76A0E871A99A086FB6ED9DD9
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S....."y-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\Pictures\dnobo8kquxthKYPbiVKNkBHX.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\eqwQ4v4W79HQtYChIL8CXQJj.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768477096051595
Encrypted:	false
SSDEEP:	49152:1nSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHG:sWqlkLESgCRE/vhOjb05efd6e/oXHG
MD5:	D6C2FBF8DAFCB34BC8797545B2A94CA8
SHA1:	8FE3C369AEC5F02016D030BED57CE0E15BB5C3BE
SHA-256:	A7A37F24ADD0B9FA6EA9716F4A1EB19C8B2EB4421D7414E83605205AD5AF0654
SHA-512:	5BC0A1FE7BBD5DC1A4AF5989B473A20BB775CFD5C9B4AFB4E410E9C4D70E92E5F85DF30B281F0547472E24E361639411451EC89E8FB6316384CFD7D6F429AEEE
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.......-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\gC6HQHcPvsALd84vdJXhjM8b.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\hoIRHCmbfleOimlEQBUf6Nsu.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768475333252262
Encrypted:	false
SSDEEP:	49152:YnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHp:bWqlkLESgCRE/vhOjb05efd6e/oXHp
MD5:	6E7737F5251D3BC5CF1D0D75778589ED
SHA1:	FE773AF6E4847CC1893C73D7E0EE05142D3EDB9A
SHA-256:	C7C078AC18647609190584E1EA4522D4CE069FCD1469A65DE79D5AFD099E8765
SHA-512:	ADFE96E47CB427766B69824931D8C7A35DF1A9C4C2BB7D10298FA03D7021CE5DEDE5280A5723C92786A1C3C372F2D994EE9B43DE0908B95E6C95911B52B7419A
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.......-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\Pictures\jLh2jXNiKaCQ93A91IuQMDiC.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\k24uGEMvDOJxGSYIEJfkvAv5.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\k61IyshjXf2xgCwUvOFWwmgI.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\khZWbExKB8w1JkxRWheAWkKQ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.595533707793504
Encrypted:	false
SSDEEP:	48:QgLvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:fzbGRTihhL6HXYc
MD5:	13B2037B37D9201E6813D14CB4C344EB
SHA1:	66337AFB9D5D247D956619D35EFF069DB142004D
SHA-256:	DB67F4B27730AFC2048C2768B25E8F7571D5C70F14D8C2F78910E199091E52AA
SHA-512:	82F974D958D910BF61589C239EA931279BFC2C58CB47E283F658A45959B9949A39263070DFC6D3084DC1E014CEF9A7D0B9F3B76A818C133498648367EDD24719
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="MwksP40RskgWnORq6K9f3ozJ5EEUDyJCn2VvSily">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\l4uKqmU2WFXWkMNLmByrfqyU.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768473246930771
Encrypted:	false
SSDEEP:	49152:bnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHX:mWqlkLESgCRE/vhOjb05efd6e/oXHX
MD5:	FCED7D5FD85EA8ADC328E305BCDC4BC0
SHA1:	3040EA7407C73F4081727E144A859EA1A074E367
SHA-256:	28D6DBCCF2E99F32D5252C3C5D38F3B1EC411BC75DF7D42D3A6EDDCE48C7828F
SHA-512:	BE900DC66E2AE0B40864CA837E6664D4574D15E9BA1CCF9CBDCFB086CECE10FCB33D168E3BD8B98F21A30F8A99C9012067BB8D5F47A25C56046DF7A2D7BE56B6
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.....?x-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\Pictures\lPSfsxgFucUyDCrXpMn2ucYq.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768477037361091
Encrypted:	false
SSDEEP:	49152:BnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXH/:IWqlkLESgCRE/vhOjb05efd6e/oXH/
MD5:	0156652DDCB44EB5E79384EB83B7FC64
SHA1:	E25C00E1D76148D4054846BA6283DDC648F6795A
SHA-256:	21B1686B451D7EDD6688D1D8BAEA36D536E60E5A4ADD200BA2EF7A698C4EAFEB
SHA-512:	ABA7D75030A46787F65F3B2C96FF8EE85BBFDDE4F482AFEB65B2E97B2F96C3D8D59F2385505CD4A4241EA763C6515C562BE27F42B5A910F1B328A63B66E49612
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.......-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\Pictures\lpOXM8pg9J4cVKMm0aJJw34A.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\mxmsi31bOIKdEb9VIHBYJshQ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\nYogaRAZxPLuvJnrVaN7fjAe.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\nnZpB7DttFEiMoRHhyjsMIGz.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\nrklq6P1CNvXZbzoZhiYO66H.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768471320239257
Encrypted:	false
SSDEEP:	49152:pnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXH+:QWqlkLESgCRE/vhOjb05efd6e/oXH+
MD5:	38390F042FA04827219CCFDB855B7629
SHA1:	CF2C4ABC250DFDD263C8BC5D9BD6CE9C087F8312
SHA-256:	D9FA44156C63FAF4DFD4290F9D0D3CBBAB8AFFBD6AE3F78603213E1A2C2E6830
SHA-512:	03DD8659976EEB9D2A461B377280196B186A8C262F621465C20DE6AF01C9C2650CBA3FDA8348659C9D76879B34D28CA62764098CE01C211D80B5B45517B3659D
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.....)4-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\Pictures\oL06QqFgQZZETtHJ8qOWjQhV.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\oXoLzyLcYgk57zCvqPsFCNIg.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\owaM0vzN2jKxgkVfs4bImjfe.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\qISpsWpv4oIvhES3MTpCAdcJ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.594297601765447
Encrypted:	false
SSDEEP:	48:QKcvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:PIbGRTihhL6HXYc
MD5:	91B7AB18F661D03A4A5ED03D6F273AFB
SHA1:	279667419E35B851494B6DA069119018B1433002
SHA-256:	F0685AC53925715533B4D83CDB9400DB0763FAD7AF99F5527001F2BF99E9E669
SHA-512:	7D6EEACFF3387CAF1199FF3BEE84F6A3EC42BFFFE3FCDFBFCDCF7B010C47B80B79D272C2177092DBA80E5664A6302D950230BCE6AC276DB8E1AD583D49B6DD5A
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="54Gr4vO0QVjHFmTudCj687QTyfe4Tew31CNA7X7e">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\qLwqLSV4rPxepI9a27kf3QoZ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.5804267238701835
Encrypted:	false
SSDEEP:	48:QBCvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:eGbGRTihhL6HXYc
MD5:	4DCBFA364C32FCF1BDF770C06288F9E4
SHA1:	E84E044D7253B09DE79E3BF13BF8D299FB0B39FD
SHA-256:	4A31CA45DA21F7D12112310F2E656C6DB8E503589597043661D71FD7F1B664AC
SHA-512:	1421C5B33E3CC6113B7B547967848948420F901056DA6B30C3B598C8F4CA8C8634AE8F496031AAF7242C891DC8C3FAEFFC483422B603A78C4EE3A45A25B29EFE
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="wh3Canni0YrTddaoKhuptKBcw74skuVm3gmCQxOK">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\quqghK17OnNCuj9KAvNZQsIX.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768478933370879
Encrypted:	false
SSDEEP:	49152:CnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHg:BWqlkLESgCRE/vhOjb05efd6e/oXHg
MD5:	18A0C971C87F30E90DC78E5331D1643C
SHA1:	E76C6A0F9611032E9505FFD1AE175F754BA9656B
SHA-256:	8B2D66F20A317A29C73B8C127065F85F19C948075958E5136655FCF4F3C7BE5B
SHA-512:	4CF2FE3A995D2153FDC27208F0061C3981EFE5E0A3D0A8B8D7EB533969E180C224736C090BEC959FA8A2407FB7A372DF8B8BEE4B168602148AD1C07333AB6E0D
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.......-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\Pictures\rSYsgRim3M5YCzGnR78v4Mm1.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\rfKusEcfqkKKVyx19jVITYlO.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\s2A2nVFap842S1hTJXF9l5R8.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\sP3BgFXaLWMMa0a6kgrVZ5A3.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768473268395656
Encrypted:	false
SSDEEP:	49152:wnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXH8:TWqlkLESgCRE/vhOjb05efd6e/oXH8
MD5:	48A60D9CBAB02152380985D0D929D54C
SHA1:	182849A12043A3FCDE02526BE6B16C05F3BDED86
SHA-256:	D1A30CECC38031E3AA72BF7C5D536BED856BB0EB80B3F3B55FC06DEEA8187BC1
SHA-512:	7C4FCC7519461EB58E543FE13DB29507CCEEEA95BA6853EEC5C8860C36739A7CE7ACDF7664B28B7481111F5D7204EC8B95DF8DCFACD471EC649572182D81E598
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.....e.-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\Pictures\u118vbhgpAsB1DCQ91pKfLua.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.768477406799686
Encrypted:	false
SSDEEP:	49152:3nSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXH0:CWqlkLESgCRE/vhOjb05efd6e/oXH0
MD5:	D2FAEB1EC860FC058F0FE0BBDA5B1A87
SHA1:	9BDD67B3187884373CDD5CBCD8D6E1C9EDD01A72
SHA-256:	2ACBC1591A3287FEF96640053C9FB8AB623F6E878FA133ACFD83F474F3B420F5
SHA-512:	3DDFB70EB52D83D56A1B853E17EEE0B24D4EBB091321C146F7F86AB34061F8835614FDB59F54E59F044612F622F7FB79F9D33806217A8F61FC6C6DB71F130228
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S.....f.....@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\Pictures\vC3Q85PP4k1yZfTFObCtFF23.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2146714
Entropy (8bit):	7.981933831324803
Encrypted:	false
SSDEEP:	49152:LCani5uuCsnFsOVBPivSHGhkSmGqV9vqQiOK57WH7XCc:26i5uu3qOnPi8Gh3REvqQiOK+Lb
MD5:	AF528677E66608860208878377380FD9
SHA1:	0414F65A08126C60AB802933D47DE0F44487CFB0
SHA-256:	F31521168BA53BF2CFAA451586A8115500E52C948787E5E112F4C8FBD350B474
SHA-512:	4771C7606046EF28DDB960463728B27B4C518FE9879A52856A6D4C89BF3EF9E534A9AD14F820247242EFA610575F6CF570D9F3C12D778F804879129181029126
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..... W............................uC............@........................................... .................................\|........J...........................................................................................................text...$........................... .0`.data...............................@.`..rdata..8j.......l..................@.`@.bss......... ........................`..idata..\|...........................@.0..ndata..............................@.`..rsrc....J.......L..................@.0.........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\w9PVG5CKOJz2PxNYSzlQtvrS.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981672598408151
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/H+:GIecbBwTy2ZvsUVwpbgom/H+
MD5:	95B643F1AB74DB2FD054852EF281577D
SHA1:	D5B57FC15D13C853607B0D8A8BBB1EDE2AB7E9B4
SHA-256:	B31BFC8449E3055E70F5D8D3C08382E3CA78607B613734A7CA75E7768EC1E1CF
SHA-512:	338D0AE525B1DCB4C25CFD93575FA2C95F2C98648F05000FD00470D8D5D02C90F9B5903D863770C91C16F2289AFFFF5E20FA9BCF58A1CA1BFE9FE866E6F562D9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\wkhy7uRGkuNSmBiMfg2ujY77.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7446
Entropy (8bit):	5.422209848736349
Encrypted:	false
SSDEEP:	192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5:	5B423612B36CDE7F2745455C5DD82577
SHA1:	0187C7C80743B44E9E0C193E993294E3B969CC3D
SHA-256:	E0840D2EA74A00DCC545D770B91D9D889E5A82C7BEDF1B989E0A89DB04685B09
SHA-512:	C26A1E7E96DBD178D961C630ABD8E564EF69532F386FB198EB20119A88ECAB2FE885D71AC0C90687C18910CE00C445F352A5E8FBF5328F3403964F7C7802414C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="https://cdn.iplogger.org/redirect/brand.png" />..<meta property="og:description" content="yip.su is a Branded Short Domain" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="o

C:\Users\user\Pictures\yk5Kg8CP5R0lBkwzd8NmvR55.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.594796492064785
Encrypted:	false
SSDEEP:	48:QhYvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:LbGRTihhL6HXYc
MD5:	BB40AAC6F8024856A8C512BA3D3F6482
SHA1:	663C78256C81721031771ED0BDA556040CB5AD63
SHA-256:	BF049555FAA65A3B38AE190B9F47EF9E1E54A8A1C52363E89C9F634FFE3DEAB4
SHA-512:	AB524A0492358AC6FE09653E0D10FAFE5669CB402B942B89E71AC27EE54B448C91B8647180C367ACEFF43B3B73DC8266BBF78D7FDC60121287D4EE3C14F9AD8F
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="hJhShjx3YLxcWDxhE2dK9WLYa5FwYJAC93ogLKKU">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\yuOzOMiGu18r6OI15UqZiVhD.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (414)
Category:	dropped
Size (bytes):	3612
Entropy (8bit):	4.590337223541327
Encrypted:	false
SSDEEP:	48:QUCbqvbGa6TDZzmQiNqcBkVEfriDe1lLfifMMT+CXDuHX3c:TU+bGRTihhL6HXYc
MD5:	B5A94B987ED49F492BCF87DD15053839
SHA1:	5026A8B314E8E2C28594BC26278563CD6B7F4A30
SHA-256:	D02A55D9EF31A4E7809258CAD5F5041DB64E61682DBEB8CA646F947B39EE3AD8
SHA-512:	3292C83B39DE3559CC4C1FED9C4B9387D4318E473B418D50606F749B230F246D9550409AC4786B8F3F1F8A70F70C99415249D9C920634FD4E5A48E120A409AEC
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="en" class="h-100 scroll-behavior-smooth " dir="ltr">.<head>. <meta charset="utf-8">. <meta name="viewport" content="width=device-width, initial-scale=1">.. CSRF Token -->. <meta name="csrf-token" content="rKuTmTCuXpc7UEGNshl18cB3xQiQdNmqkc0Ekp8J">.. <title>Link disabled</title>.. <meta name="robots" content="noindex">.. <link href="https://shortiny.com/uploads/brand/favicon.png" rel="icon">.. Scripts -->. <script src="https://shortiny.com/js/app.js" defer></script>.. Styles -->. <link href="https://shortiny.com/css/app.css" rel="stylesheet" data-theme-light="https://shortiny.com/css/app.css" data-theme-dark="https://shortiny.com/css/app.dark.css" data-theme-target="href">.. . <style>. @import url("https://rsms.me/inter/inter.css");. </style>. </head>. <body class="d-flex flex-column">. <div class="bg-base-1 d-flex align-items-center flex-fill">. <div class="cont

C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	2960760
Entropy (8bit):	7.7684744475228085
Encrypted:	false
SSDEEP:	49152:DnSiPqYQwkkSJiNlwsmSgBmfPl/nJ8UE/JjhhOjbLI/xsAePXdcTC3v3oBXHZ:uWqlkLESgCRE/vhOjb05efd6e/oXHZ
MD5:	9D6D8C23FE185D39AA9259B64543248E
SHA1:	C398864928A1C4A96DF40F0F249DF3FD86B00A2A
SHA-256:	885FC53BC83438AB500EB7FAC5A5A37D9BE824C65122BC731016540C31633389
SHA-512:	E7DBCCD4273034FC5F24719F2958B908998ECDB10EFE244A20685412921D267E13C16AC492A96590323121CDBB7D1CDF782F6BFA562FD0835C4568DE749FBF02
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...)..e..........".......,......`&. .R..p&...R...@...........................S......-...@..................................pS.......R..............-.x+...qS...............................R.......R.............................................UPX0.....`&.............................UPX1......,..p&..~,.................@....rsrc.........R.......,.............@...4.22.UPX!......^..\l.R..z,..VR.&..xa.!.U..]....U..1.]........SWV.....E.`..@....@.......@d.....d....}...........M.1..U..A.M.).).9..L.M.4.....9.r.9.wx.u..t.SPQ...;..U.....B.......B..M...;}.}<.M...Z.9.r........X$.E...........,......t.....`..A1.CL.1..E....F......w.s..^_[]...>..h......C.......M......U........[......WV....x ..m.u.....1.H^_].F..H..N......5.@8.n??M.@.n..P..@.G~...}..O.<..G.)...p..9.r....9.....pI.SQR.....;.....L}..W......w....;E.}H.._.9.r..E.....E....{..X0.T........u.W.F.E.@...

C:\Users\user\Pictures\zcKoLXDqvdAUIOoGZ6SAU0N3.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4283784
Entropy (8bit):	7.981675240385367
Encrypted:	false
SSDEEP:	98304:MDN+eXM1btSiwqm6V4yFoZO8sUVDPcpbBs7BEvIKGuE7dP/HS:GIecbBwTy2ZvsUVwpbgom/HS
MD5:	5F2CE2E258A6EEF93E5E22DCE2717F82
SHA1:	6932BCE782770230740201976311AED8135210EF
SHA-256:	92C21775152FA963C6E48A5F63B78E8A71CCE26B47B203A4734D7173220EA8A9
SHA-512:	A316CD56A2E3785AC5D897C909DE2655BFF3711356E50610B61E0FC21D2ABD1D6D95E8BEE2697C1A876F7E6B943C36C29D8F77F121689C1DADA693B6B4A11BC0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u'...t...t...t..t...t..t...t..t...t...t...t...t..t..t...t..t...t..t...tRich...t........................PE..L....dd.....................ZE.....}.............@.................................j8B.......................................@.(....pE..x...........RA.................................................................L............................text...d........................... ..`.rdata....@.......@.................@..@.data...@.....@..(....@.............@....rsrc....HL..pE..z....@.............@..@................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.19067578612513
TrID:	Win64 Executable GUI Net Framework (217006/5) 49.88% Win64 Executable GUI (202006/5) 46.43% Win64 Executable (generic) (12005/4) 2.76% Generic Win/DOS Executable (2004/3) 0.46% DOS Executable Generic (2002/1) 0.46%
File name:	3SqWYf8qFi.exe
File size:	46'816 bytes
MD5:	27b3e45a81641d0e7d0dea29938774ae
SHA1:	b169677b0772e523a49aee97a0d5aca89ade3068
SHA256:	ab7237aba6c89c09aeaf5111575614041aafc280f2461f3e669195ce6943e4e1
SHA512:	27287844bd394e834f7832cfa236fcc7c8f52035ead0226a5108adb5e349cb3bd505e2aa39c83100ce09e12f46a78bea4e43cbd93feeae8a761cda36e96c16c6
SSDEEP:	768:l9KG4oE3utrXgye+k9l2eeicYSFQLq34pUr2SIO8BC45SNUgRaCEFiRvk:7KG4p3utzgH195eicDFSqopUiJArNNRG
TLSH:	2F238E7177BC823BCEAF0AB4646152000374D362AE42CFBD2DD9A1DE58977C503623AB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...I.B..........."...0.....&............ ....@...... ..............................J.....`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x400000
Entrypoint Section:
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xAF428149 [Tue Mar 6 01:47:53 2063 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:

Authenticode Signature

Signature Valid:	false
Signature Issuer:	C=US, S=Washington, L=Redmond, OU=Microsoft Corporation, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	12/03/2024 08:58:25 12/03/2025 08:58:25
Subject Chain	C=US, S=Washington, L=Redmond, OU=Microsoft Corporation, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011
Version:	3
Thumbprint MD5:	6F7B463152C74EE5B9FB9EE710D533C8
Thumbprint SHA-1:	9CFF85D86FB9513952E088C0625A3477DBA8BE71
Thumbprint SHA-256:	78DC0E6A3749E01CE1C5413DBB350ED48221D96B0C331BF732A985E74E5DE6C0
Serial:	2D12E4E96E80CFDC437AFF543B3B77AA

Entrypoint Preview

Instruction
dec ebp
pop edx
nop
add byte ptr [ebx], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x626	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x9e00	0x18e0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb310	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x93e6	0x9400	15161743413fd589518921a9c7eba0c6	False	0.5047508445945946	data	5.9614551171159205	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x626	0x800	7ccd95491660fbda3924dbe08f84df33	False	0.32421875	data	3.4778778318304995	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc0a0	0x39c	data			0.38852813852813856
RT_MANIFEST	0xc43c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Target ID:	0
Start time:	12:03:52
Start date:	12/03/2024
Path:	C:\Users\user\Desktop\3SqWYf8qFi.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\3SqWYf8qFi.exe
Imagebase:	0x28b2b930000
File size:	46'816 bytes
MD5 hash:	27B3E45A81641D0E7D0DEA29938774AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	12:04:10
Start date:	12/03/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\3SqWYf8qFi.exe" -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:04:10
Start date:	12/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:04:10
Start date:	12/03/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Imagebase:	0x820000
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	12:04:10
Start date:	12/03/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Wow64 process (32bit):
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
Imagebase:
File size:	108'664 bytes
MD5 hash:	914F728C04D3EDDD5FBA59420E74E56B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:04:11
Start date:	12/03/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6908 -s 56832
Imagebase:	0x7ff76e1b0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:04:14
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe"
Imagebase:	0x400000
File size:	2'146'714 bytes
MD5 hash:	AF528677E66608860208878377380FD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:04:15
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\F3bLUEvvHahM06jSZWbJPDdX.exe"
Imagebase:	0x400000
File size:	4'283'784 bytes
MD5 hash:	5F2CE2E258A6EEF93E5E22DCE2717F82
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	12:04:15
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe" --silent --allusers=0
Imagebase:	0xf40000
File size:	2'960'760 bytes
MD5 hash:	18A0C971C87F30E90DC78E5331D1643C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	12:04:15
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\wQ9dgKtBZDeIUddSVpW8BvEm.exe"
Imagebase:	0x400000
File size:	4'283'784 bytes
MD5 hash:	95B643F1AB74DB2FD054852EF281577D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	12:04:15
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\jpm6qF5Qiq3f7hmREIabTmaO.exe"
Imagebase:	0x400000
File size:	4'283'784 bytes
MD5 hash:	95B643F1AB74DB2FD054852EF281577D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	12:04:16
Start date:	12/03/2024
Path:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\syncUpd.exe
Imagebase:	0x400000
File size:	204'800 bytes
MD5 hash:	C722591F624FB69970F246B8C81D830F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000F.00000003.1947105334.00000000007B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 0000000F.00000003.1947105334.00000000007B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000F.00000002.2877662329.0000000000833000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000F.00000002.2877720615.0000000000848000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:04:16
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\dC7amCutZVjsSWxQ9FIlZYqw.exe"
Imagebase:	0x400000
File size:	4'283'784 bytes
MD5 hash:	5F2CE2E258A6EEF93E5E22DCE2717F82
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	12:04:16
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\3iX1J0J7PXcnIfnf5KGl849r.exe"
Imagebase:	0x400000
File size:	2'146'714 bytes
MD5 hash:	AF528677E66608860208878377380FD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	12:04:22
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe" --silent --allusers=0
Imagebase:	0x1a0000
File size:	2'960'760 bytes
MD5 hash:	968B869AA841B0C675BF2C61DFEAA509
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	12:04:22
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\H1Mms5Gptfho9VyHt62sHSNN.exe"
Imagebase:	0x400000
File size:	2'146'714 bytes
MD5 hash:	AF528677E66608860208878377380FD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	12:04:22
Start date:	12/03/2024
Path:	C:\Users\user\AppData\Local\Temp\BroomSetup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\BroomSetup.exe
Imagebase:	0x400000
File size:	1'828'864 bytes
MD5 hash:	EEE5DDCFFBED16222CAC0A1B4E2E466E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	12:04:22
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\VWhRbFHRqImCr0UdFf6QtJNt.exe"
Imagebase:	0x400000
File size:	2'146'714 bytes
MD5 hash:	AF528677E66608860208878377380FD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	12:04:22
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\f2CDTsUNlMadewChtQe3a8Da.exe"
Imagebase:	0x400000
File size:	4'283'784 bytes
MD5 hash:	95B643F1AB74DB2FD054852EF281577D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000017.00000003.2076235587.0000000003AD2000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	12:04:24
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\VySSnHhKNg09wrV9qkpgKtg9.exe"
Imagebase:	0x400000
File size:	4'283'784 bytes
MD5 hash:	5F2CE2E258A6EEF93E5E22DCE2717F82
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	12:04:24
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\dZhcoTSgym1JGRiEQOUqAdeo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\dZhcoTSgym1JGRiEQOUqAdeo.exe"
Imagebase:	0x400000
File size:	4'283'784 bytes
MD5 hash:	5F2CE2E258A6EEF93E5E22DCE2717F82
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	12:04:24
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\rfKusEcfqkKKVyx19jVITYlO.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\rfKusEcfqkKKVyx19jVITYlO.exe"
Imagebase:	0x400000
File size:	4'283'784 bytes
MD5 hash:	95B643F1AB74DB2FD054852EF281577D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	12:04:24
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe" --silent --allusers=0
Imagebase:	0xca0000
File size:	2'960'760 bytes
MD5 hash:	9BFF769347ADF4195895A2AA8C977EFF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	12:04:24
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Pictures\rMuSSyE2z14xNxfrVLVv1kvs.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6c4b21c8,0x6c4b21d4,0x6c4b21e0
Imagebase:	0xf40000
File size:	2'960'760 bytes
MD5 hash:	18A0C971C87F30E90DC78E5331D1643C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	12:04:25
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe" --silent --allusers=0
Imagebase:	0x840000
File size:	2'960'760 bytes
MD5 hash:	9D6D8C23FE185D39AA9259B64543248E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	12:04:29
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Pictures\UPwYHcUA3TbsX6l2qc9SZcBH.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2d4,0x300,0x6b8021c8,0x6b8021d4,0x6b8021e0
Imagebase:	0x1a0000
File size:	2'960'760 bytes
MD5 hash:	968B869AA841B0C675BF2C61DFEAA509
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	12:04:32
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Pictures\Rfsq67IamA4rPpnX6LHMDFkm.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e8,0x2ec,0x2f0,0x2c4,0x304,0x6bd721c8,0x6bd721d4,0x6bd721e0
Imagebase:	0xca0000
File size:	2'960'760 bytes
MD5 hash:	9BFF769347ADF4195895A2AA8C977EFF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	12:04:32
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\mxmsi31bOIKdEb9VIHBYJshQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\mxmsi31bOIKdEb9VIHBYJshQ.exe"
Imagebase:	0x400000
File size:	2'146'714 bytes
MD5 hash:	AF528677E66608860208878377380FD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	12:04:32
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe" --silent --allusers=0
Imagebase:	0x1f0000
File size:	2'960'760 bytes
MD5 hash:	6E7737F5251D3BC5CF1D0D75778589ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	12:04:33
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe" --silent --allusers=0
Imagebase:	0x90000
File size:	2'960'760 bytes
MD5 hash:	3C982E3594F2F49BE9CB21C88EDA12D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	12:04:33
Start date:	12/03/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Temp\Task.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	12:04:33
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\jLh2jXNiKaCQ93A91IuQMDiC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\jLh2jXNiKaCQ93A91IuQMDiC.exe"
Imagebase:	0x400000
File size:	2'146'714 bytes
MD5 hash:	AF528677E66608860208878377380FD9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	12:04:33
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\VF98zhY4QVhDxJpNtAE2TU6d.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\VF98zhY4QVhDxJpNtAE2TU6d.exe"
Imagebase:	0x400000
File size:	4'283'784 bytes
MD5 hash:	95B643F1AB74DB2FD054852EF281577D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Glupteba, Description: Yara detected Glupteba, Source: 00000026.00000001.2270329448.0000000000843000.00000040.00000001.01000000.0000002A.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	12:04:35
Start date:	12/03/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	12:04:35
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Pictures\zKY9gVt7bugdAVV29pfHDO1J.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6ae821c8,0x6ae821d4,0x6ae821e0
Imagebase:	0x840000
File size:	2'960'760 bytes
MD5 hash:	9D6D8C23FE185D39AA9259B64543248E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	12:04:37
Start date:	12/03/2024
Path:	C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\rMuSSyE2z14xNxfrVLVv1kvs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\.opera\Opera Installer Temp\rMuSSyE2z14xNxfrVLVv1kvs.exe" --version
Imagebase:	0x20000
File size:	2'960'760 bytes
MD5 hash:	18A0C971C87F30E90DC78E5331D1643C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	12:04:37
Start date:	12/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	12:04:38
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Pictures\j1XOgROBJfvz0cRzU7rPw7NS.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6a9c21c8,0x6a9c21d4,0x6a9c21e0
Imagebase:	0x1f0000
File size:	2'960'760 bytes
MD5 hash:	6E7737F5251D3BC5CF1D0D75778589ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	12:04:39
Start date:	12/03/2024
Path:	C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Pictures\2n6aZsnLKtKXJNMzWvG8Ou1L.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.24 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2f0,0x6a5021c8,0x6a5021d4,0x6a5021e0
Imagebase:	0x90000
File size:	2'960'760 bytes
MD5 hash:	3C982E3594F2F49BE9CB21C88EDA12D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	17.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15.8%
Total number of Nodes:	1263
Total number of Limit Nodes:	28

Executed Functions

Function 00404375 Relevance: 58.1, APIs: 21, Strings: 12, Instructions: 398
comfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32 ref: 00404388
GetVersion.KERNEL32 ref: 0040438F
lstrlenA.KERNEL32 ref: 004043CC
InitCommonControls.COMCTL32(?,UXTHEME), ref: 004043F8
OleInitialize.OLE32 ref: 00404405
SHGetFileInfoA.SHELL32 ref: 0040443A
GetCommandLineA.KERNEL32(00000000,00000000), ref: 00404459
GetModuleHandleA.KERNEL32(00000000,00000000), ref: 00404478
CharNextA.USER32 ref: 004044B1

Part of subcall function 00408299: GetModuleHandleA.KERNEL32(?,?,004043E5), ref: 004082AE
Part of subcall function 00408299: GetProcAddress.KERNEL32 ref: 004082DA

GetTempPathA.KERNEL32(00000001,00000001), ref: 0040456F
DeleteFileA.KERNEL32 ref: 0040458D
GetWindowsDirectoryA.KERNEL32 ref: 004045B6
OleUninitialize.OLE32(?,00000000), ref: 0040481C
ExitProcess.KERNEL32 ref: 004049AC

Part of subcall function 004078A4: CharNextA.USER32 ref: 004078BE

GetCurrentProcess.KERNEL32(?,?,00000000,?,00000000), ref: 004048A1
ExitWindowsEx.USER32 ref: 00404953

Part of subcall function 00407CB6: lstrcpynA.KERNEL32(?,?,?,?,?,?,00404457), ref: 00407CD1

Part of subcall function 004060FD: lstrcmpiA.KERNEL32 ref: 0040627B
Part of subcall function 004060FD: GetFileAttributesA.KERNEL32 ref: 0040628A

Strings

NCRC, xrefs: 00404500
(, xrefs: 004048AD
Zj, xrefs: 0040473E, 004047A3
UXTHEME, xrefs: 004043B6, 004043E5
/D=, xrefs: 0040451A
%, xrefs: 00404969
62lP/4uOUYfKA3tfxllnPzQXGLJgRjFKHZbIa8JtXF+oMlF4/GglqDQr8FrkYyAg2UYkxW9kefTa, xrefs: 00404719
_?=, xrefs: 00404611
"C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe" , xrefs: 0040445F, 00404494, 004045FC, 0040460A
Error launching installer, xrefs: 0040462F, 00404725
NSIS Software Setup, xrefs: 0040444B
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004045DD

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: File$CharExitHandleModuleNextProcessWindows$AddressAttributesCommandCommonControlsCurrentDeleteDirectoryErrorInfoInitInitializeLineModePathProcTempUninitializeVersionlstrcmpilstrcpynlstrlen
String ID: /D=$ Zj$ _?=$"C:\Users\user\Pictures\vkIsjAzkgrOzUK7uj2IHc9JM.exe" $%$($62lP/4uOUYfKA3tfxllnPzQXGLJgRjFKHZbIa8JtXF+oMlF4/GglqDQr8FrkYyAg2UYkxW9kefTa$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$NCRC$NSIS Software Setup$UXTHEME
API String ID: 3796326152-2036101127
Opcode ID: 7881eb858f1781d71ca17bfc7dda02721ad144d0b1ac4bce1dc96693f36e737c
Instruction ID: 1612ab991b91f7509b6110098b19e500dbf275244ae378e5724325f5e1753ea3
Opcode Fuzzy Hash: 7881eb858f1781d71ca17bfc7dda02721ad144d0b1ac4bce1dc96693f36e737c
Instruction Fuzzy Hash: 34F143F0908300AFD720AF65D94876BBBE4EF85704F41887EE5C8A7291D77C58458B6A

Uniqueness

Uniqueness Score: -1.00%

Function 004085B8 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 192
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNEL32 ref: 004085D9
lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00408674
FindFirstFileA.KERNEL32 ref: 00408694
FindNextFileA.KERNELBASE(?,?,?,?,?,?,?,00000000,00000000), ref: 0040879C
FindClose.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 004087AF

Strings

C:\Users\user\AppData\Local\Temp\nsvA4F1.tmp\*.*, xrefs: 00408619, 00408638, 00408689
?, xrefs: 004086AD

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: FileFind$CloseDeleteFirstNextlstrlen
String ID: ?$C:\Users\user\AppData\Local\Temp\nsvA4F1.tmp\*.*
API String ID: 3200608346-1886783681
Opcode ID: d81ed6c38f1aba44f588852f7cd5ef506992bc62bf75eddd0eb2d587c2438939
Instruction ID: 15a94c35718d9934db7cd19974bec7e4185b96846047f3cacb9e12796964f464
Opcode Fuzzy Hash: d81ed6c38f1aba44f588852f7cd5ef506992bc62bf75eddd0eb2d587c2438939
Instruction Fuzzy Hash: 5E7175B0908344AED720AF25CE4576EBBF8AF45714F45887EE8C5A7381CB3D8844CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00408123 Relevance: 3.0, APIs: 2, Instructions: 19fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32 ref: 00408137
FindClose.KERNEL32 ref: 00408149

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 7251eaddbbfde7681b746ec47e7261ccbbd10af8bddef417e70452c4b2653847
Instruction ID: 11fd5c66118aeed7f08c7c2f326ea88146cd1b5fc0ef80ef14f89fbd5f6a2284
Opcode Fuzzy Hash: 7251eaddbbfde7681b746ec47e7261ccbbd10af8bddef417e70452c4b2653847
Instruction Fuzzy Hash: 20E0ECB5704204AFD700BFB89C4841B7AE9AB94714B84C929B9A5CB390D634C85287AA

Uniqueness

Uniqueness Score: -1.00%

Function 004060FD Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 253
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00408299: GetModuleHandleA.KERNEL32(?,?,004043E5), ref: 004082AE
Part of subcall function 00408299: GetProcAddress.KERNEL32 ref: 004082DA

lstrcmpiA.KERNEL32 ref: 0040627B
GetFileAttributesA.KERNEL32 ref: 0040628A

Part of subcall function 00407BE3: wsprintfA.USER32 ref: 00407BFE

LoadImageA.USER32(?,?,00000000,00000000), ref: 00406317
RegisterClassA.USER32 ref: 00406361
SystemParametersInfoA.USER32 ref: 00406392
CreateWindowExA.USER32 ref: 004063F7
ShowWindow.USER32 ref: 0040643E
GetClassInfoA.USER32(?,00000000), ref: 00406481
GetClassInfoA.USER32 ref: 004064A1
RegisterClassA.USER32 ref: 004064B7
DialogBoxParamA.USER32 ref: 004064ED

Strings

Zj, xrefs: 00406105
g, xrefs: 0040630C
_Nb, xrefs: 00406338
gj, xrefs: 004061F9

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcmpiwsprintf
String ID: Zj$_Nb$g$gj
API String ID: 3995538257-2529789971
Opcode ID: 2f233f64265ed054fe4a50ef783cb1e0c7b699e5a95c035f069f719471a29138
Instruction ID: 933614cd0025173359140365b9e7a590c615df7829bf1f80af9a09b402b61920
Opcode Fuzzy Hash: 2f233f64265ed054fe4a50ef783cb1e0c7b699e5a95c035f069f719471a29138
Instruction Fuzzy Hash: 75B10AB05083019FE710AF65D94872BBBE4EF44308F41892EE4D597391D7BC9895CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00403F03 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 216
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403F0F
GetModuleFileNameA.KERNEL32 ref: 00403F36

Part of subcall function 00407A78: GetFileAttributesA.KERNEL32 ref: 00407A85
Part of subcall function 00407A78: CreateFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,00403F5B), ref: 00407AC4

Part of subcall function 00407CB6: lstrcpynA.KERNEL32(?,?,?,?,?,?,00404457), ref: 00407CD1

Part of subcall function 004078CE: lstrlenA.KERNEL32 ref: 004078DB
Part of subcall function 004078CE: CharPrevA.USER32 ref: 004078F0

GetFileSize.KERNEL32(00000000,00000000,74DF3160), ref: 00403FB5

Part of subcall function 00403AE9: ReadFile.KERNEL32 ref: 00403B15

GlobalAlloc.KERNEL32 ref: 00404183
CreateFileA.KERNEL32(00000000,00000000), ref: 004041DC

Part of subcall function 004039FE: KiUserCallbackDispatcher.NTDLL ref: 00403A17

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00404168
Zj, xrefs: 00404266
Error launching installer, xrefs: 00403F68
L[j, xrefs: 004042A0
Null, xrefs: 00404082
Inst, xrefs: 00404066
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004041EB
soft, xrefs: 00404076
@, xrefs: 00404294

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: File$Create$AllocAttributesCallbackCharCountDispatcherGlobalModuleNamePrevReadSizeTickUserlstrcpynlstrlen
String ID: Zj$@$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$L[j$Null$soft
API String ID: 3955551674-26642064
Opcode ID: af66fff8b02de6d0d4a69a07544e1b2ef73cc32fad62162e2d96cd73999f7eec
Instruction ID: b38f96b7e78b57fcd3b2806388120572df800b880dbb1f433db2e5bcd9a6e09c
Opcode Fuzzy Hash: af66fff8b02de6d0d4a69a07544e1b2ef73cc32fad62162e2d96cd73999f7eec
Instruction Fuzzy Hash: 1791A4B09083048FD720AF29D98576EBBF4EF84318F41847EE584A7291D77C9985CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00401B06 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 185
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareFileTime.KERNEL32(?,00000000), ref: 00401BA1

Part of subcall function 00407CB6: lstrcpynA.KERNEL32(?,?,?,?,?,?,00404457), ref: 00407CD1

Part of subcall function 00407836: MessageBoxIndirectA.USER32 ref: 00407899

Part of subcall function 00406FCB: SetWindowTextA.USER32 ref: 00407061
Part of subcall function 00406FCB: SendMessageA.USER32 ref: 004070A1
Part of subcall function 00406FCB: SendMessageA.USER32 ref: 004070CF
Part of subcall function 00406FCB: SendMessageA.USER32 ref: 004070EE

Strings

Installed, xrefs: 00401B2F, 00401B45, 00401B6A, 00401B7C, 00401BBE, 00401BE7, 00401C3D, 00401CB5, 00401D66, 00401D78, 00401D8E, 00401DA4
SOFTWARE\BroomCleaner, xrefs: 00401C59, 00401C87
62lP/4uOUYfKA3tfxllnPzQXGLJgRjFKHZbIa8JtXF+oMlF4/GglqDQr8FrkYyAg2UYkxW9kefTa, xrefs: 00401C27, 00401C45, 00401C73

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: Message$Send$CompareFileIndirectTextTimeWindowlstrcpyn
String ID: 62lP/4uOUYfKA3tfxllnPzQXGLJgRjFKHZbIa8JtXF+oMlF4/GglqDQr8FrkYyAg2UYkxW9kefTa$Installed$SOFTWARE\BroomCleaner
API String ID: 645384303-3819460243
Opcode ID: 79a18232532a1a7469df17609bd74b415ce06eee5835288b4c7b757715615148
Instruction ID: b5f2e25a14bd4d2b29e972ea4905dfdb01325226fa6e36a277c804736715cb88
Opcode Fuzzy Hash: 79a18232532a1a7469df17609bd74b415ce06eee5835288b4c7b757715615148
Instruction Fuzzy Hash: 71614FB09087009ED710BF65CA45A6FBAF8EF80714F018A2FF4C4A7291D77C58818B6B

Uniqueness

Uniqueness Score: -1.00%

Function 00403D52 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 118
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32 ref: 00403D89
ReadFile.KERNEL32 ref: 00403DD5
WriteFile.KERNEL32 ref: 00403E44
ReadFile.KERNEL32 ref: 00403E9A
ReadFile.KERNEL32 ref: 00403EE5

Strings

PB@, xrefs: 00403D5B

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: File$Read$PointerWrite
String ID: PB@
API String ID: 2113905535-661560245
Opcode ID: c65ee0b9422e546ce60fc59843fb5b504002c352310d15ee9ec7ff5b6d871d70
Instruction ID: 6b6e275f29c4804299ca632934389f045b276b78e87a5faa28d99019ded5aa05
Opcode Fuzzy Hash: c65ee0b9422e546ce60fc59843fb5b504002c352310d15ee9ec7ff5b6d871d70
Instruction Fuzzy Hash: DC41FAB0A043059FDB10DF69C98479EBBF4FF84355F50893AE854A3290D378D9458B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00402853 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExA.KERNEL32 ref: 004028A3
GetModuleHandleA.KERNEL32 ref: 004028BB
GetProcAddress.KERNEL32 ref: 004028CF
FreeLibrary.KERNEL32(00000000), ref: 00402965

Strings

Pfo, xrefs: 0040290C
62lP/4uOUYfKA3tfxllnPzQXGLJgRjFKHZbIa8JtXF+oMlF4/GglqDQr8FrkYyAg2UYkxW9kefTa, xrefs: 00402914

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: Library$AddressFreeHandleLoadModuleProc
String ID: 62lP/4uOUYfKA3tfxllnPzQXGLJgRjFKHZbIa8JtXF+oMlF4/GglqDQr8FrkYyAg2UYkxW9kefTa$Pfo
API String ID: 1437655972-295990240
Opcode ID: ee53454a27184b2d5a0a5c0d2de0908f6b395ec73dedb038415951f2cacf38c2
Instruction ID: b62c106c84180e177253e802d98a0aa7ea229c7caaf607f5dbea50c10e3e4377
Opcode Fuzzy Hash: ee53454a27184b2d5a0a5c0d2de0908f6b395ec73dedb038415951f2cacf38c2
Instruction Fuzzy Hash: AB3170B16083009FD710AF25C94876EBBE8BF84764F51893FE485A32D0D7788986DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004039FE Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL ref: 00403A17
GetTickCount.KERNEL32 ref: 00403A48
wsprintfA.USER32 ref: 00403A83

Part of subcall function 00406FCB: SetWindowTextA.USER32 ref: 00407061
Part of subcall function 00406FCB: SendMessageA.USER32 ref: 004070A1
Part of subcall function 00406FCB: SendMessageA.USER32 ref: 004070CF
Part of subcall function 00406FCB: SendMessageA.USER32 ref: 004070EE

CreateDialogParamA.USER32 ref: 00403AC3
ShowWindow.USER32 ref: 00403ADC

Part of subcall function 0040392C: MulDiv.KERNEL32 ref: 00403953

Strings

o, xrefs: 00403AB8

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: MessageSend$Window$CallbackCountCreateDialogDispatcherParamShowTextTickUserwsprintf
String ID: o
API String ID: 3541362973-252678980
Opcode ID: c8bf9b50f24b706e34797b8f036d4915f5a4dc7d81babb649c8bf478da5301e9
Instruction ID: 81059e3b479639814b0572c15c12751123e1a1ca33ddd0d88914a755a74492f9
Opcode Fuzzy Hash: c8bf9b50f24b706e34797b8f036d4915f5a4dc7d81babb649c8bf478da5301e9
Instruction Fuzzy Hash: CB21FCB06083059FD710AF65E58875A7FE8FB44309F40843EE4C5A72A1DB798585CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040395E Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 44
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetTimer.USER32 ref: 0040398E
wsprintfA.USER32 ref: 004039C7
SetWindowTextA.USER32 ref: 004039D4

Strings

Zj, xrefs: 004039A5
verifying installer: %d%%, xrefs: 004039AC
unpacking data: %d%%, xrefs: 004039B4

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: TextTimerWindowwsprintf
String ID: Zj$unpacking data: %d%%$verifying installer: %d%%
API String ID: 2438957755-813466327
Opcode ID: bd030a2e39a026ec07ab4720bfc960c357e51ed8894618a1f4644a08019d69f6
Instruction ID: 5883a2093b31581e9909bbd4cee83827143d54294f5a20fab69da977af55eaa0
Opcode Fuzzy Hash: bd030a2e39a026ec07ab4720bfc960c357e51ed8894618a1f4644a08019d69f6
Instruction Fuzzy Hash: D9015EB0908304AFD710AF24D48525EBFE8EB48355F50C83EE58997281C7B895859B8A

Uniqueness

Uniqueness Score: -1.00%

Function 00403B63 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403B7B

Part of subcall function 00403B31: SetFilePointer.KERNEL32 ref: 00403B56

SetFilePointer.KERNEL32 ref: 00403BCB

Part of subcall function 00403AE9: ReadFile.KERNEL32 ref: 00403B15

WriteFile.KERNEL32 ref: 00403CB8
SetFilePointer.KERNEL32 ref: 00403D2F

Part of subcall function 004039FE: KiUserCallbackDispatcher.NTDLL ref: 00403A17

Strings

Zj, xrefs: 00403C2D

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: File$Pointer$CallbackCountDispatcherReadTickUserWrite
String ID: Zj
API String ID: 3615659929-708813418
Opcode ID: 4ec8380424f8b6247a32fbe8d6d1bb411ef4befcb9c6ee9025606e6af6d0a466
Instruction ID: f7083fb0e86bb6005b9bf14dc6a8331a2f5849a6e81c63e88d49bae7df8a1a75
Opcode Fuzzy Hash: 4ec8380424f8b6247a32fbe8d6d1bb411ef4befcb9c6ee9025606e6af6d0a466
Instruction Fuzzy Hash: D3514AB1A183049FD720DF29E88532A7BB4FF44355F90893EE844A72A0D7789546CF9E

Uniqueness

Uniqueness Score: -1.00%

Function 0040820E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32 ref: 00408229
wsprintfA.USER32 ref: 00408270
LoadLibraryExA.KERNEL32 ref: 00408289

Strings

\, xrefs: 0040823E
C@, xrefs: 00408211

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: \$C@
API String ID: 2200240437-1790911818
Opcode ID: c9660503d559c2df304355e59e8a4c4b93ddf83edb93a1dccef26b9b85dfc474
Instruction ID: 6c0f10e39fe67b0a46f2467a814b7d530fefee384e0f0f9ebaf92f9caf306ff0
Opcode Fuzzy Hash: c9660503d559c2df304355e59e8a4c4b93ddf83edb93a1dccef26b9b85dfc474
Instruction Fuzzy Hash: 3D014BB1508704AFD300EF68D98879EBBF4FB84308F54C83DD08996295D7789589CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00408299 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 31
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,?,004043E5), ref: 004082AE
GetProcAddress.KERNEL32 ref: 004082DA

Part of subcall function 0040820E: GetSystemDirectoryA.KERNEL32 ref: 00408229
Part of subcall function 0040820E: wsprintfA.USER32 ref: 00408270
Part of subcall function 0040820E: LoadLibraryExA.KERNEL32 ref: 00408289

Strings

UXTHEME, xrefs: 0040829D
C@, xrefs: 004082A1
C@, xrefs: 004082E2

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID: UXTHEME$C@$C@
API String ID: 2547128583-1808485004
Opcode ID: f6ce91f65d8d9bb7ee18f4d542f9107f4d6a72ffda61794c9569e264c57c3d17
Instruction ID: 23c7ce911dd590b504e17f07e60dbba2231cf2c7d4590c8d4e2d2ec4458658d6
Opcode Fuzzy Hash: f6ce91f65d8d9bb7ee18f4d542f9107f4d6a72ffda61794c9569e264c57c3d17
Instruction Fuzzy Hash: 8AF08275A00A089BD710AF65D98446FBBF8FB88750B01C47DF98493324EA3499608B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00402613 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406FCB: SetWindowTextA.USER32 ref: 00407061
Part of subcall function 00406FCB: SendMessageA.USER32 ref: 004070A1
Part of subcall function 00406FCB: SendMessageA.USER32 ref: 004070CF
Part of subcall function 00406FCB: SendMessageA.USER32 ref: 004070EE

Part of subcall function 00407779: CreateProcessA.KERNEL32 ref: 004077D6
Part of subcall function 00407779: CloseHandle.KERNEL32 ref: 004077EB

WaitForSingleObject.KERNEL32 ref: 00402661
GetExitCodeProcess.KERNEL32 ref: 00402688

Part of subcall function 00408848: PeekMessageA.USER32 ref: 00408878
Part of subcall function 00408848: DispatchMessageA.USER32 ref: 00408884

CloseHandle.KERNEL32 ref: 004026C8

Strings

d, xrefs: 00402656

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: Message$Send$CloseHandleProcess$CodeCreateDispatchExitObjectPeekSingleTextWaitWindow
String ID: d
API String ID: 3753073698-2564639436
Opcode ID: 9343e43865e4207d9138f12a8f752cf886ae069070fe727ca0ca3e2bbeffcac1
Instruction ID: ac6e98feb3a7424ea682bb54f7c96fcb1bdc6a13fb689d46f8fa2a7810285b5b
Opcode Fuzzy Hash: 9343e43865e4207d9138f12a8f752cf886ae069070fe727ca0ca3e2bbeffcac1
Instruction Fuzzy Hash: 4C218171908600DFD750AF25CD48BAEB7E5EB84315F51887EE489A3380D6795981CF2A

Uniqueness

Uniqueness Score: -1.00%

Function 004076B0 Relevance: 6.0, APIs: 4, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32 ref: 00407704
GetLastError.KERNEL32 ref: 0040771A
SetFileSecurityA.ADVAPI32 ref: 00407732
GetLastError.KERNEL32 ref: 0040773F

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: 2da82589d8da42b9739c6c0976e1894f0ad9be4ebc54cecaf41c4c862e70e725
Instruction ID: 0b729d7567636c09f29e4728680a85774f46e6e2b236e770b8bd2138b4be8b02
Opcode Fuzzy Hash: 2da82589d8da42b9739c6c0976e1894f0ad9be4ebc54cecaf41c4c862e70e725
Instruction Fuzzy Hash: 0B110CB1D04208DEDB109FA9D8447DEBFB4EF94354F10882AE944B7250D3796545CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 00408D43 Relevance: 5.5, APIs: 4, Instructions: 458
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalFree.KERNEL32(?), ref: 00408B5C
GlobalAlloc.KERNEL32 ref: 00408B7A

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: cd7b7cc6089db85a917c869ea418fe9b4336126d354651c2af7450458f0d2819
Instruction ID: 73a589aadd6280c1d4df6f0517975a2c4eda39665482ce8a8b3e558a14f083aa
Opcode Fuzzy Hash: cd7b7cc6089db85a917c869ea418fe9b4336126d354651c2af7450458f0d2819
Instruction Fuzzy Hash: FD32CF75E04269CFEB64CF28C940BA9BBB2BB48300F1581EAD889B7381D7745E85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 004093BF Relevance: 5.4, APIs: 4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96471980e818e90389b8f28b0725736ff68ec6d8f08f1ae4e00d8e9b25cb3d10
Instruction ID: 2ff6cda69edbaac919d86c53bc6808f5f303a55c6bc0211467f0ef21a37139c8
Opcode Fuzzy Hash: 96471980e818e90389b8f28b0725736ff68ec6d8f08f1ae4e00d8e9b25cb3d10
Instruction Fuzzy Hash: A7229B74E05269CBEB64CF18C980BA9BBB2BB48300F1482EAD84DB7381D7345E85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040893D Relevance: 5.4, APIs: 4, Instructions: 351memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 00408B5C
GlobalAlloc.KERNEL32 ref: 00408B7A
GlobalFree.KERNEL32 ref: 00408C4E
GlobalAlloc.KERNEL32 ref: 00408C66

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: 40efa2268de9016f5e6645c0c9238ed231c7493705202486a25610001e8f553c
Instruction ID: 196290a36a957acb70ae20b533fcf0c155bb910872d15f7e614b6225c37c67e6
Opcode Fuzzy Hash: 40efa2268de9016f5e6645c0c9238ed231c7493705202486a25610001e8f553c
Instruction Fuzzy Hash: 05026CB4D05268CFDBA4CF68C980B99BBF1BB48300F1082EAD959A7342D7349E85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00401860 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00407935: CharNextA.USER32(?,00000000,74DF3160,?,00408184,?,?,?,00000000,?,004085CF), ref: 0040794A
Part of subcall function 00407935: CharNextA.USER32(74DF3160,?,00408184,?,?,?,00000000,?,004085CF), ref: 00407952

SetCurrentDirectoryA.KERNEL32(00000000,00000000), ref: 00401930

Part of subcall function 004078A4: CharNextA.USER32 ref: 004078BE

GetFileAttributesA.KERNEL32 ref: 004018E0

Strings

\, xrefs: 00401882

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: CharNext$AttributesCurrentDirectoryFile
String ID: \
API String ID: 15404496-2967466578
Opcode ID: d78038b2043e385ee061b609f29dc6a012e38869a8f0274da12750c867810de6
Instruction ID: b3c069ff8fe5fca2169c100ba5b4309268a8952e4838bd2cd3cdfa24001796cc
Opcode Fuzzy Hash: d78038b2043e385ee061b609f29dc6a012e38869a8f0274da12750c867810de6
Instruction Fuzzy Hash: E22196B19087419ED7107F2A8C4476ABBE8AF41314F15897FE4D5A33E1D63D4581CB2B

Uniqueness

Uniqueness Score: -1.00%

Function 0040815B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407CB6: lstrcpynA.KERNEL32(?,?,?,?,?,?,00404457), ref: 00407CD1

Part of subcall function 00407935: CharNextA.USER32(?,00000000,74DF3160,?,00408184,?,?,?,00000000,?,004085CF), ref: 0040794A
Part of subcall function 00407935: CharNextA.USER32(74DF3160,?,00408184,?,?,?,00000000,?,004085CF), ref: 00407952

lstrlenA.KERNEL32(?,00000000,?,?,?,00000000,?,004085CF), ref: 004081BE
GetFileAttributesA.KERNEL32(00000000,?,?,00000000,?,?,?,00000000,?,004085CF), ref: 004081F7

Strings

C:\, xrefs: 00408166, 00408178, 004081B1, 004081B7, 004081C3, 004081DB, 004081F0

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: 2da7ec1753567bed1e155ededaacee0951334442434f81bdc17e756d419ccca8
Instruction ID: a4b91be4712b2a5abe4fc9de88cdddcc6cd402f2cf4946f98fb9fcd9c72e04c7
Opcode Fuzzy Hash: 2da7ec1753567bed1e155ededaacee0951334442434f81bdc17e756d419ccca8
Instruction Fuzzy Hash: D6118FB0508314AAD710ABA69A4167A7BD89F05354F46447FECC0AA285CB3C5852866F

Uniqueness

Uniqueness Score: -1.00%

Function 00403845 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32 ref: 004038C0
SendMessageA.USER32 ref: 004038E0

Strings

0u, xrefs: 004038AC

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: MessageSend
String ID: 0u
API String ID: 3850602802-3203441087
Opcode ID: 0f8c1266bbb926ccc1bd59e027622b1526ca312be5caf6883b3757b9e2fe7e12
Instruction ID: 587040a18b5e8d3ddabbac84dae9583a5ca4581ff6aa0f06bd791ecb2da4f76d
Opcode Fuzzy Hash: 0f8c1266bbb926ccc1bd59e027622b1526ca312be5caf6883b3757b9e2fe7e12
Instruction Fuzzy Hash: 2811B172A043009FC710BF29D88911BBFE8EB40351F50C67EF854A73A0E338D6058B99

Uniqueness

Uniqueness Score: -1.00%

Function 00407AD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00407AF2
GetTempFileNameA.KERNEL32 ref: 00407B1A

Strings

nsa, xrefs: 00407AEB

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: b0a3207c486979766b199e0870a403b1f3979b7e2f67fc1e41fde7ae102ddd2e
Instruction ID: 856d399887dd27b7ff2090b6ba205bffd5fa5b63c1769944cd833ed7d7811f75
Opcode Fuzzy Hash: b0a3207c486979766b199e0870a403b1f3979b7e2f67fc1e41fde7ae102ddd2e
Instruction Fuzzy Hash: 2CF0C272E082049FCB10AF69D88879FBFB4EF84310F00843AE95497380D6749515CB97

Uniqueness

Uniqueness Score: -1.00%

Function 004097A6 Relevance: 5.3, APIs: 4, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a578235fd7ef3aed2a2d552e65bc1af2bfd9bf356f91058c6dae311955d0e3a7
Instruction ID: 373024fc2fed516bdc636a623b7a3c01618f37309bfd328d060bf71c45cb50f6
Opcode Fuzzy Hash: a578235fd7ef3aed2a2d552e65bc1af2bfd9bf356f91058c6dae311955d0e3a7
Instruction Fuzzy Hash: 2FE18A75E05269CFEB64CF68C980B99BBB1BB48300F1081EAD84DA7381D774AE85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00409302 Relevance: 5.3, APIs: 4, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1580e02ebf7c4fca29966eb1b7433a0a3187ed73c579ff4eb24ab240cbf4b120
Instruction ID: a08f90893e9a4040dbcaa68aabc4f5c37fecb49a8b953bcbec771c1c1b16f75e
Opcode Fuzzy Hash: 1580e02ebf7c4fca29966eb1b7433a0a3187ed73c579ff4eb24ab240cbf4b120
Instruction Fuzzy Hash: D1E18974E05269CFEB64CF68C984BA9BBB1BB48300F1481EAD859B7381D7349E85CF15

Uniqueness

Uniqueness Score: -1.00%

Function 00409193 Relevance: 5.3, APIs: 4, Instructions: 274memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 00408B5C
GlobalAlloc.KERNEL32 ref: 00408B7A
GlobalFree.KERNEL32 ref: 00408C4E
GlobalAlloc.KERNEL32 ref: 00408C66

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: 1376a99fa1b3c8b711226efaa9cd125e7b0aae65b997332d787d10eea2378ea6
Instruction ID: cf37d5954fa70898b434e0d26c6706b10c8171271484cbeb9454a15f2979c00d
Opcode Fuzzy Hash: 1376a99fa1b3c8b711226efaa9cd125e7b0aae65b997332d787d10eea2378ea6
Instruction Fuzzy Hash: 58E19B74E05269CFEB64CF68C984BA9BBB1BB48300F1485EAD849A7381D7349E85CF15

Uniqueness

Uniqueness Score: -1.00%

Function 00409128 Relevance: 5.3, APIs: 4, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d3edd96235aad2e448edd85fe0051959f4d3e71b7dd2dead95b0c62df9fb41c
Instruction ID: 6ef1666d030b3683f745449ade9432935f6c1ed2423b4b2fea7fa3c30e0d11e8
Opcode Fuzzy Hash: 0d3edd96235aad2e448edd85fe0051959f4d3e71b7dd2dead95b0c62df9fb41c
Instruction Fuzzy Hash: DFD169B4D05269CFEB64CF68C984B99BBB1BB48300F1081EAD84DA7391D734AE85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00409285 Relevance: 5.2, APIs: 4, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b40b5ad18bbb895345efcde55e0179b9719697a428ab1875b5866f95c7fbef08
Instruction ID: 98c6a34e011fea02c5fd1f307661bc496968a447f3de359247ec3e7382062383
Opcode Fuzzy Hash: b40b5ad18bbb895345efcde55e0179b9719697a428ab1875b5866f95c7fbef08
Instruction Fuzzy Hash: 54D178B4D052698FEB64CF68C980B99BBB1BB48300F1481EAD84DA7381D734AE85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040925A Relevance: 5.2, APIs: 4, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d30ce3705b240a9fa9085b13145e6071c26e30a1f734f08b0bddea23f27e83
Instruction ID: bea8f09e258bf7577ce88e7167e750fa30ab14cfac5afba0003b10e989aa1f51
Opcode Fuzzy Hash: d5d30ce3705b240a9fa9085b13145e6071c26e30a1f734f08b0bddea23f27e83
Instruction Fuzzy Hash: 9FD169B4D05269CFEB64CF68C984B99BBB1BB48300F1481EAD849B7381D734AE85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00409157 Relevance: 5.2, APIs: 4, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bafe15afffcb6701d4c5351ddd9df98beec2791fc1c3a27858b249eb881a6424
Instruction ID: cf999dc1e13fdb9e3b794afb24179b6ab6f8fffdfeb4e36a57addd35a861b0c2
Opcode Fuzzy Hash: bafe15afffcb6701d4c5351ddd9df98beec2791fc1c3a27858b249eb881a6424
Instruction Fuzzy Hash: DCC17A74D05269CFEB64CF68C980B99BBB1BB48300F1481EAD849B7381D734AE85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 004096F9 Relevance: 5.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cff38268b4a69b6e7d209897343a178ab99337e8fe27efdfc199a24eb5041e59
Instruction ID: a16c7d6d65317efe9c57d887f34a02eee03e71a6b958f13de8b6000bf5c2667a
Opcode Fuzzy Hash: cff38268b4a69b6e7d209897343a178ab99337e8fe27efdfc199a24eb5041e59
Instruction Fuzzy Hash: E8C17BB4D05269CFDB64CF68C984B99BBB1BB48300F1081EAD84DA7381D734AE85CF15

Uniqueness

Uniqueness Score: -1.00%

Function 00402E4B Relevance: 4.6, APIs: 3, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNEL32 ref: 00402ED3
RegSetValueExA.KERNEL32 ref: 00402F7F
RegCloseKey.ADVAPI32 ref: 0040307E

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: CloseCreateValue
String ID:
API String ID: 1818849710-0
Opcode ID: 34cad2bc1fa3e13494afe16162c9cd95c8c0f10228bda9fb96df882e3ad3404d
Instruction ID: aa20071d88737d2ca076d9582247293cc4c89cd0404862d20b3ad10084441af9
Opcode Fuzzy Hash: 34cad2bc1fa3e13494afe16162c9cd95c8c0f10228bda9fb96df882e3ad3404d
Instruction Fuzzy Hash: 813150B09083018FD710EF25C94835ABBF4FB84315F10886EF489A7391D7799A89DF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00403AE9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32 ref: 00403B15

Strings

<@, xrefs: 00403B2A

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: FileRead
String ID: <@
API String ID: 2738559852-4072043054
Opcode ID: d6535b1fd4e4f43d190a1083287ca5501c92c386e3f1a77b6dec29ccffe7340a
Instruction ID: af84ff8d7bbf5bb76e19132ef8cd2b24e5e30c6edf1d6b1d64d2a00a1082e161
Opcode Fuzzy Hash: d6535b1fd4e4f43d190a1083287ca5501c92c386e3f1a77b6dec29ccffe7340a
Instruction Fuzzy Hash: 1EF0ACB1904309AFC700EF69C58454EBBF4AB48354F408839E85993251E734E604CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00403141 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32 ref: 00403159

Strings

62lP/4uOUYfKA3tfxllnPzQXGLJgRjFKHZbIa8JtXF+oMlF4/GglqDQr8FrkYyAg2UYkxW9kefTa, xrefs: 00403141

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID: 62lP/4uOUYfKA3tfxllnPzQXGLJgRjFKHZbIa8JtXF+oMlF4/GglqDQr8FrkYyAg2UYkxW9kefTa
API String ID: 2591292051-244690609
Opcode ID: 7220984d86149b75493436dbbda63972d97fcd78ed879eff71d07d38dd4f9017
Instruction ID: cae25ad1085ea1b7b33e0ee8e1dfa0938857f6c35aa13dd2a3c4ee0daf51729b
Opcode Fuzzy Hash: 7220984d86149b75493436dbbda63972d97fcd78ed879eff71d07d38dd4f9017
Instruction Fuzzy Hash: 1FC012B180D7519FC3016F3068494657FB06E11305756487EF8C1A6093D73845048657

Uniqueness

Uniqueness Score: -1.00%

Function 0040322E Relevance: 3.1, APIs: 2, Instructions: 85fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32 ref: 00403292
SetFilePointer.KERNEL32 ref: 00403316

Part of subcall function 00407BE3: wsprintfA.USER32 ref: 00407BFE

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: File$PointerReadwsprintf
String ID:
API String ID: 2027716870-0
Opcode ID: 2a1d3a7d486c6b86bccdea9d2ad81ee3c8c98c4cef3a960bb8e5e7f735770045
Instruction ID: 8e5637f0c6afa0013300979c193a8b9475ce08824852a7f6775797156de60d7d
Opcode Fuzzy Hash: 2a1d3a7d486c6b86bccdea9d2ad81ee3c8c98c4cef3a960bb8e5e7f735770045
Instruction Fuzzy Hash: CC31B2719082549FD721DF28C8457EABBF5BB41305F4481BFE88967381CB385A85CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 00407779 Relevance: 3.0, APIs: 2, Instructions: 29processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32 ref: 004077D6
CloseHandle.KERNEL32 ref: 004077EB

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: ecd803767c42d0115cc6630c5d6204aa1c870829ebe70ed70b47319080a31035
Instruction ID: e526153969689a3bb24f951f69113ce00b5f3314808de7d96251afda99080b29
Opcode Fuzzy Hash: ecd803767c42d0115cc6630c5d6204aa1c870829ebe70ed70b47319080a31035
Instruction Fuzzy Hash: 9F01BDB4A083058FE700DF65C55874BBBF4BB88348F40892CE984AB380D7B9D5498BDA

Uniqueness

Uniqueness Score: -1.00%

Function 00408848 Relevance: 3.0, APIs: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32 ref: 00408878
DispatchMessageA.USER32 ref: 00408884

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: Message$DispatchPeek
String ID:
API String ID: 1770753511-0
Opcode ID: f47a563196487b916b85f1db57b9f28f3a61cff97bcda7dcd8e7ae127d692a0b
Instruction ID: 14b4f48a427ee2f9703bd614fab35b4ce20e27f4ced21843c47198de5c9a507f
Opcode Fuzzy Hash: f47a563196487b916b85f1db57b9f28f3a61cff97bcda7dcd8e7ae127d692a0b
Instruction Fuzzy Hash: D3F0A0B2804304AFC700BF99D94469FBFB8EB843A0F40883EE98153241D774A444CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 00407A78 Relevance: 3.0, APIs: 2, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00407A85
CreateFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,00403F5B), ref: 00407AC4

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 426097edd153d553548d4258e2616868f6f2f385adb449bbb098b549bd1fea02
Instruction ID: df9a40891ed5a6603638aa450cb2a5da2b508cd079f162d5418714098e0b767a
Opcode Fuzzy Hash: 426097edd153d553548d4258e2616868f6f2f385adb449bbb098b549bd1fea02
Instruction Fuzzy Hash: E2F0D4B06083059FC700EF29D48874EBBF4BF88354F50892CE89987391D374D9848FA2

Uniqueness

Uniqueness Score: -1.00%

Function 00407A46 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00000000,00000000), ref: 00407A53
SetFileAttributesA.KERNEL32(?,?,00000000,00000000), ref: 00407A69

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: bbe73ec25996ed32e413a4c8f7db69d9afd32e501594e36b189c3cfe4dd8ed10
Instruction ID: 98ca1ea5d0757272cd0f040fa3ed5e2b23fe950f5b76aa7c06b1bcfd26805678
Opcode Fuzzy Hash: bbe73ec25996ed32e413a4c8f7db69d9afd32e501594e36b189c3cfe4dd8ed10
Instruction Fuzzy Hash: EAE08CB0A04708ABC710EF78CC8481EBABCAA54320B90462CF5A5C32D1C234A9408B36

Uniqueness

Uniqueness Score: -1.00%

Function 0040774B Relevance: 3.0, APIs: 2, Instructions: 16COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32 ref: 0040775F
GetLastError.KERNEL32 ref: 0040776F

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 90b9da684f5562d28c975c8ac90b4c5e18001f0206505df7b5a45aab19218db1
Instruction ID: 75174e167af6e085340da124bff1779b24b122a40ba15240be09f0de69b02ea8
Opcode Fuzzy Hash: 90b9da684f5562d28c975c8ac90b4c5e18001f0206505df7b5a45aab19218db1
Instruction Fuzzy Hash: 12D05E70B042056BC700EF78D808A1B7AF9AB90744F40C43CA985C3240FA74D8018B96

Uniqueness

Uniqueness Score: -1.00%

Function 00404316 Relevance: 2.5, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00404329
CloseHandle.KERNEL32 ref: 00404347

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 649e6f128e3e3456b5732b19daa21c0c85ead406cb5e4731a410a6a558bb4ff6
Instruction ID: dd570ae04773ec1d9248e7accc602cb5589f5768ce779b06ba6b6fcb8a9dd89b
Opcode Fuzzy Hash: 649e6f128e3e3456b5732b19daa21c0c85ead406cb5e4731a410a6a558bb4ff6
Instruction Fuzzy Hash: C2F0F8B05047049AC320BF789D4841A76A8AB81329BA44B3DF5B4E62E0D73894628B6A

Uniqueness

Uniqueness Score: -1.00%

Function 00403B31 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32 ref: 00403B56

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0f9fbaa86d6978b07d32e4ed4dfea1cd2918fff6c7b81506297058148a916158
Instruction ID: c8608c254b430b602e84f9c27618fc09d2b238f80b7c42c251c9764424cdbd58
Opcode Fuzzy Hash: 0f9fbaa86d6978b07d32e4ed4dfea1cd2918fff6c7b81506297058148a916158
Instruction Fuzzy Hash: C9D067B45043049FD300FF6CD54970ABBE4AB44344F80C828E98897251D679D4548B96

Uniqueness

Uniqueness Score: -1.00%

Function 0040183B Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32 ref: 00401855

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 930f9914d92cfff6ea62ae6309475c970d132ca45c7eec98b9a44305c1f331e0
Instruction ID: 66959b0bba6a1c3021cfc6ef215295b74c1233013eb20c9b72e5f533845a5747
Opcode Fuzzy Hash: 930f9914d92cfff6ea62ae6309475c970d132ca45c7eec98b9a44305c1f331e0
Instruction Fuzzy Hash: 33D0A7B010C201DED3006F248C0053BB6F4AF84300F20863DF0C6A31E4C334C8836B2A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040710B Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 358windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 004071E0
GetSystemMetrics.USER32 ref: 004071F2
SendMessageA.USER32 ref: 0040721E
SendMessageA.USER32 ref: 0040723E
SendMessageA.USER32 ref: 0040725E
SendMessageA.USER32 ref: 0040727A
SendMessageA.USER32 ref: 0040729F
ShowWindow.USER32 ref: 004072E7
ShowWindow.USER32(00000000,00000000), ref: 004072FF
SendMessageA.USER32 ref: 00407353
SendMessageA.USER32 ref: 0040737F
SendMessageA.USER32 ref: 0040739B
GetDlgItem.USER32 ref: 004073BB
CreateThread.KERNEL32 ref: 004073ED
CloseHandle.KERNEL32 ref: 004073F9
ShowWindow.USER32 ref: 0040742E
ShowWindow.USER32(00000000,00000000), ref: 0040743D
SendMessageA.USER32 ref: 004074E8
CreatePopupMenu.USER32 ref: 004074FC
AppendMenuA.USER32(?,?), ref: 00407531
GetWindowRect.USER32 ref: 0040754A
TrackPopupMenu.USER32 ref: 0040758E
SendMessageA.USER32 ref: 004075DA
OpenClipboard.USER32 ref: 004075F3
EmptyClipboard.USER32 ref: 004075FA
GlobalAlloc.KERNEL32 ref: 0040760B

Part of subcall function 00404C96: SendMessageA.USER32 ref: 00404CBB

GlobalLock.KERNEL32(00000001,00000001), ref: 00407618
SendMessageA.USER32 ref: 00407649
GlobalUnlock.KERNEL32 ref: 00407667
SetClipboardData.USER32(00000000), ref: 00407679
CloseClipboard.USER32 ref: 00407681

Strings

Zj, xrefs: 00407138

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: MessageSend$Window$ClipboardShow$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleItemLockMetricsOpenSystemThreadTrackUnlock
String ID: Zj
API String ID: 1085758737-708813418
Opcode ID: feee37f5bd17380af7e6bceb262dc60c434c655d728a8cbcfb2b4a38510d0af8
Instruction ID: 5e12382b9bf781896070c4bfdd92391929ae8e3bc4ad132af5f990d2ac7018d8
Opcode Fuzzy Hash: feee37f5bd17380af7e6bceb262dc60c434c655d728a8cbcfb2b4a38510d0af8
Instruction Fuzzy Hash: BAF1E5B0908304AFD710EF68D98866EBFF4FF84314F41892DE89997291D7789885CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00405C44 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 327COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00405CAA
SetWindowTextA.USER32 ref: 00405CE6

Part of subcall function 00407805: GetDlgItemTextA.USER32 ref: 00407829

Part of subcall function 00407D37: CharNextA.USER32(?,?,?,?,?,?,00000000,?,?,?,004042CE), ref: 00407D9F
Part of subcall function 00407D37: CharNextA.USER32(?,?,?,?,?,00000000,?,?,?,004042CE), ref: 00407DBE
Part of subcall function 00407D37: CharNextA.USER32(?,?,?,00000000,?,?,?,004042CE), ref: 00407DCA
Part of subcall function 00407D37: CharPrevA.USER32(?,?,00000000,?,?,?,004042CE), ref: 00407DE5

GetDiskFreeSpaceA.KERNEL32(00000000,?,?,?,?,?,?,00000000,00000000), ref: 00405FAC
MulDiv.KERNEL32 ref: 00405FD2

Strings

Zj, xrefs: 00405E0C
A, xrefs: 00405DE1
62lP/4uOUYfKA3tfxllnPzQXGLJgRjFKHZbIa8JtXF+oMlF4/GglqDQr8FrkYyAg2UYkxW9kefTa, xrefs: 00405C60

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: Char$Next$ItemText$DiskFreePrevSpaceWindow
String ID: Zj$62lP/4uOUYfKA3tfxllnPzQXGLJgRjFKHZbIa8JtXF+oMlF4/GglqDQr8FrkYyAg2UYkxW9kefTa$A
API String ID: 2917460849-2735847078
Opcode ID: 91b2ad515499cbb7123929db81fef6451cd5d901b74e1dc774021900fa226f3b
Instruction ID: 826313f772001043a55ea6ee256f7e169a774654cc20dc23f9f2a1aa091d3067
Opcode Fuzzy Hash: 91b2ad515499cbb7123929db81fef6451cd5d901b74e1dc774021900fa226f3b
Instruction Fuzzy Hash: 5FD128B09087049FDB10EF69D58466EBBF4FF44304F51893EE888A7281D7789985CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00402988 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 160comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00402A22
MultiByteToWideChar.KERNEL32(00000000), ref: 00402B6F

Strings

4A, xrefs: 004029FF

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: 4A
API String ID: 123533781-205151761
Opcode ID: ca4e342dd9a4d1c448b3aa248cf2cd94cc217ce03813331fd364ede4b0128604
Instruction ID: d305ef95405f15bde97fa7dd711ba6fc9ffd0a80db07f91d6d56198472658b67
Opcode Fuzzy Hash: ca4e342dd9a4d1c448b3aa248cf2cd94cc217ce03813331fd364ede4b0128604
Instruction Fuzzy Hash: 51614CB0A087119FD710EF69C9886AABBF4FF88314F008AADE58897391D7749885CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040342B Relevance: 1.5, APIs: 1, Instructions: 40fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32 ref: 00403445

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: fce1d974e300f46887b22a37e71dcc213f53c6413cec510bd16856115e4e31a8
Instruction ID: aef6cf25d155275a0f1f0dba3ae7dc856cfafe516e6fd3ce68bd1cca54722f2f
Opcode Fuzzy Hash: fce1d974e300f46887b22a37e71dcc213f53c6413cec510bd16856115e4e31a8
Instruction Fuzzy Hash: 8401B1B1A086009FD310DF25CC44AAAFBF8EF84314F50847FE489A3281D73456458B66

Uniqueness

Uniqueness Score: -1.00%

Function 00404FED Relevance: 51.2, APIs: 28, Strings: 1, Instructions: 461windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 0040503C
GetDlgItem.USER32(?,?), ref: 00405050
SetClassLongA.USER32 ref: 00405088
SendMessageA.USER32 ref: 00405115
GetDlgItem.USER32 ref: 004051CA
ShowWindow.USER32 ref: 004051F6
EnableMenuItem.USER32(?,?), ref: 0040526F
SendMessageA.USER32 ref: 0040529C
SendMessageA.USER32 ref: 004052CA
SetWindowTextA.USER32 ref: 00405321
SetWindowPos.USER32 ref: 00405598

Part of subcall function 00403845: MulDiv.KERNEL32 ref: 004038C0
Part of subcall function 00403845: SendMessageA.USER32 ref: 004038E0

DestroyWindow.USER32 ref: 00405382
EndDialog.USER32 ref: 0040539F

Strings

NSIS Software Setup, xrefs: 004052DD

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: ItemMessageSendWindow$ClassDestroyDialogEnableLongMenuShowText
String ID: NSIS Software Setup
API String ID: 1257292352-2653429224
Opcode ID: 292bb44675ccfa867acd3725238b8a77fc34fda148f2e8f9fca479e34ef56d7c
Instruction ID: 81f075938f45a7985b655ae660e62a259a3a74716ec96c8beebe6fa6edba758e
Opcode Fuzzy Hash: 292bb44675ccfa867acd3725238b8a77fc34fda148f2e8f9fca479e34ef56d7c
Instruction Fuzzy Hash: 4B12EDB0904700EFD720AF69D98876FBBF4EB84714F50893EE88497290D7789885DF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004057B5 Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 246windowCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32 ref: 0040586C
GetDlgItem.USER32 ref: 0040588F
SendMessageA.USER32(00000000,?), ref: 004058C3
GetSysColor.USER32 ref: 004058D9
SendMessageA.USER32 ref: 004058F7
SendMessageA.USER32 ref: 00405917
SendMessageA.USER32 ref: 00405946
SendMessageA.USER32 ref: 00405965
GetDlgItem.USER32 ref: 004059BE
SendMessageA.USER32 ref: 004059E1
GetDlgItem.USER32 ref: 00405A22
SendMessageA.USER32 ref: 00405A7F
SetCursor.USER32 ref: 00405AAD
ShellExecuteA.SHELL32 ref: 00405ADD
SetCursor.USER32 ref: 00405AFF
SendMessageA.USER32 ref: 00405B3A
SendMessageA.USER32 ref: 00405B6E

Strings

Zj, xrefs: 004058C5
#, xrefs: 00405840

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: MessageSend$Item$Cursor$ButtonCheckColorExecuteShell
String ID: Zj$#
API String ID: 3348721118-3046959613
Opcode ID: 4e383d582a9edf47cc14579e126ee2fdffe76f794733c6ee39e155195205dfec
Instruction ID: 44f7cc544d88e5f9b0c99828474254857af221e4d6201ddb95d9c50adba5cc38
Opcode Fuzzy Hash: 4e383d582a9edf47cc14579e126ee2fdffe76f794733c6ee39e155195205dfec
Instruction Fuzzy Hash: A5B1E7B0908704AFD710AF69D58876EBBF0FF44314F40892DE889A7381D779A885CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

BeginPaint.USER32 ref: 00401045
GetClientRect.USER32 ref: 00401063
CreateBrushIndirect.GDI32(?), ref: 004010F9
FillRect.USER32 ref: 00401114
DeleteObject.GDI32 ref: 00401120
CreateFontIndirectA.GDI32 ref: 00401140
SetBkMode.GDI32(?), ref: 0040116A
SetTextColor.GDI32 ref: 0040117C
DefWindowProcA.USER32 ref: 00401209

Strings

Zj, xrefs: 00401035
NSIS Software Setup, xrefs: 004011B2

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: CreateIndirectRect$BeginBrushClientColorDeleteFillFontModeObjectPaintProcTextWindow
String ID: Zj$NSIS Software Setup
API String ID: 2207649800-918659373
Opcode ID: a8582859d5a084b14097a1c6a023f97518bcb2a0ac2fe99b7e62435bc4502902
Instruction ID: 8fd51326f023e27f82ac7456779bc240a2534a06902e8bdd8a27472bfc587b1b
Opcode Fuzzy Hash: a8582859d5a084b14097a1c6a023f97518bcb2a0ac2fe99b7e62435bc4502902
Instruction Fuzzy Hash: 046115B09047089FCB24DFA9C9885AEBBF8FF88310F50892EE499D7251D734A845DF56

Uniqueness

Uniqueness Score: -1.00%

Function 00408311 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 176filememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00408299: GetModuleHandleA.KERNEL32(?,?,004043E5), ref: 004082AE
Part of subcall function 00408299: GetProcAddress.KERNEL32 ref: 004082DA

CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,00408822), ref: 00408383
GetShortPathNameA.KERNEL32 ref: 0040839D

Part of subcall function 004079B4: lstrlenA.KERNEL32 ref: 004079CC
Part of subcall function 004079B4: lstrcmpiA.KERNEL32 ref: 004079F4

GetShortPathNameA.KERNEL32 ref: 004083C8
wsprintfA.USER32 ref: 004083FF
GetFileSize.KERNEL32 ref: 0040845A
GlobalAlloc.KERNEL32 ref: 00408476
ReadFile.KERNEL32(?,?), ref: 004084A2
SetFilePointer.KERNEL32 ref: 00408568

Part of subcall function 00407A78: GetFileAttributesA.KERNEL32 ref: 00407A85
Part of subcall function 00407A78: CreateFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,00403F5B), ref: 00407AC4

WriteFile.KERNEL32 ref: 0040858B
GlobalFree.KERNEL32 ref: 00408597
CloseHandle.KERNEL32(?,?), ref: 004085A1

Strings

Zj, xrefs: 00408408

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: File$Handle$CloseGlobalNamePathShort$AddressAllocAttributesCreateFreeModulePointerProcReadSizeWritelstrcmpilstrlenwsprintf
String ID: Zj
API String ID: 1472977481-708813418
Opcode ID: 13db83d6b791d1ca6467b22e5dc8b14e389eea567c2d00f0c859e75bf8b65817
Instruction ID: 94d356f40ec1d5b6b18a4eade4987fc681b306d1f2835a3a3d653d78bc44f301
Opcode Fuzzy Hash: 13db83d6b791d1ca6467b22e5dc8b14e389eea567c2d00f0c859e75bf8b65817
Instruction Fuzzy Hash: 70710AB0908305AFD710AF65DA8866FBBF4FF84704F50C82EE9C497251DB789445CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00407E06 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?), ref: 00407EE6
GetVersion.KERNEL32 ref: 00407F25
GetSystemDirectoryA.KERNEL32 ref: 00407FC6
GetWindowsDirectoryA.KERNEL32 ref: 00407FEC
SHGetSpecialFolderLocation.SHELL32 ref: 00408018
SHGetPathFromIDListA.SHELL32 ref: 00408073
CoTaskMemFree.OLE32 ref: 00408084

Part of subcall function 00407BE3: wsprintfA.USER32 ref: 00407BFE

Strings

62lP/4uOUYfKA3tfxllnPzQXGLJgRjFKHZbIa8JtXF+oMlF4/GglqDQr8FrkYyAg2UYkxW9kefTa, xrefs: 0040809D
., xrefs: 00407F41

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrlenwsprintf
String ID: .$62lP/4uOUYfKA3tfxllnPzQXGLJgRjFKHZbIa8JtXF+oMlF4/GglqDQr8FrkYyAg2UYkxW9kefTa
API String ID: 3880481140-1911195491
Opcode ID: 41294a1091ea11e90413e40e109157ac56239d1e41f9172e6dff61212ac385df
Instruction ID: afc503830e017d1618816f2a7c40fbe451ee37b9332185e2dde12f9a903aaa14
Opcode Fuzzy Hash: 41294a1091ea11e90413e40e109157ac56239d1e41f9172e6dff61212ac385df
Instruction Fuzzy Hash: FB918E71D082149FDB20DF69C9846AEBBF4EF48300F55853EE894A7381D738A845CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00404F0F Relevance: 12.1, APIs: 8, Instructions: 77COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32 ref: 00404F3C
GetSysColor.USER32 ref: 00404F55
SetTextColor.GDI32 ref: 00404F69
SetBkMode.GDI32 ref: 00404F7B
GetSysColor.USER32 ref: 00404F92
SetBkColor.GDI32 ref: 00404FAC
DeleteObject.GDI32 ref: 00404FCA
CreateBrushIndirect.GDI32 ref: 00404FD7

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 436651d1fa7a69352c8aa546d6959dfb25c3e8832a7e8f8c86c9d969ad2feb6a
Instruction ID: 1780d8928a2120b8c11af9b20abdfd96f0510a7958c84a0cc1c987df9bbb4b6c
Opcode Fuzzy Hash: 436651d1fa7a69352c8aa546d6959dfb25c3e8832a7e8f8c86c9d969ad2feb6a
Instruction Fuzzy Hash: DF3128B09047069BDB10DFA8D988A6BBFE4BF48314F04886DFD94DB251D374D941CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00403491 Relevance: 10.6, APIs: 7, Instructions: 132filememoryCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(74DF05F0), ref: 004034EF
GlobalAlloc.KERNEL32 ref: 0040351C
CloseHandle.KERNEL32 ref: 00403653

Part of subcall function 00403B31: SetFilePointer.KERNEL32 ref: 00403B56

Part of subcall function 00403AE9: ReadFile.KERNEL32 ref: 00403B15

GlobalAlloc.KERNEL32(00000000,00000000,00000000), ref: 00403561
GlobalFree.KERNEL32 ref: 004035D6
WriteFile.KERNEL32 ref: 00403606
GlobalFree.KERNEL32 ref: 00403612

Part of subcall function 00403D52: SetFilePointer.KERNEL32 ref: 00403D89
Part of subcall function 00403D52: ReadFile.KERNEL32 ref: 00403DD5
Part of subcall function 00403D52: ReadFile.KERNEL32 ref: 00403E9A

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: File$Global$Read$AllocFreePointer$CloseDeleteHandleWrite
String ID:
API String ID: 2143033257-0
Opcode ID: 0aa6d49e2075d0b495ce51cdb1172a2f07b07b4f6215442dff9fb3ed0ec64bc4
Instruction ID: 4c510bf6e2d4d1f92ab55f121e890243c90c0ce65b69a7146e7506ad40f7442f
Opcode Fuzzy Hash: 0aa6d49e2075d0b495ce51cdb1172a2f07b07b4f6215442dff9fb3ed0ec64bc4
Instruction Fuzzy Hash: 51510BB0A087009FD710EF29C844B6EBBF4AF84315F01896EE598E7391D7389985CF56

Uniqueness

Uniqueness Score: -1.00%

Function 0040247C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00402485
GetDeviceCaps.GDI32 ref: 00402497
MulDiv.KERNEL32 ref: 004024BD
CreateFontIndirectA.GDI32 ref: 00402529

Part of subcall function 00407BE3: wsprintfA.USER32 ref: 00407BFE

Strings

H, xrefs: 004024B2
Z, xrefs: 0040248C

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectwsprintf
String ID: H$Z
API String ID: 1586071882-4221459494
Opcode ID: 27455819f521efa1bb0910034b69256412d0ed137287a206ce4bf6b66bbb16f2
Instruction ID: fe53f9027c55cc81bf00ecbd586396b11bfc2b5e7faefd45710aa59a0b9b721a
Opcode Fuzzy Hash: 27455819f521efa1bb0910034b69256412d0ed137287a206ce4bf6b66bbb16f2
Instruction Fuzzy Hash: AC218CB29092009FD310BF68DD446AABBF8FB89304F04C97EE088E3251C3B84555CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00406557 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32 ref: 00406587
GetMessagePos.USER32 ref: 00406595
ScreenToClient.USER32 ref: 004065AE
SendMessageA.USER32 ref: 004065CD

Strings

f, xrefs: 004065D2

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: f6519dfc4b30f4dc8ba30da0d317b8fe5b2658bb7498cf5162ba835f3d9dec96
Instruction ID: 922df396bf3e7088f2107368fcd68d656d94b82640ce54d584134d1287f84c7b
Opcode Fuzzy Hash: f6519dfc4b30f4dc8ba30da0d317b8fe5b2658bb7498cf5162ba835f3d9dec96
Instruction Fuzzy Hash: 1E2117B0804308EFDB10AFA9D88829EBFF4EF84314F00C91EE99557281D7B98459CF96

Uniqueness

Uniqueness Score: -1.00%

Function 004023C9 Relevance: 7.6, APIs: 5, Instructions: 50windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 004023D6
GetClientRect.USER32 ref: 004023ED
LoadImageA.USER32 ref: 0040243D
SendMessageA.USER32 ref: 0040245D
DeleteObject.GDI32 ref: 00402471

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 96058ded24dfe7affaf00118df6cbde5af697d763978f14ba464de8c35491712
Instruction ID: 8f4e6c7c9ceedfa20c72349621b66b9a182318fedd968a48d18be14dbb0e03f5
Opcode Fuzzy Hash: 96058ded24dfe7affaf00118df6cbde5af697d763978f14ba464de8c35491712
Instruction Fuzzy Hash: DC1116B19083009FD750EF69D94839EFBF4FB88315F41886EE58897260D7789985CF46

Uniqueness

Uniqueness Score: -1.00%

Function 004021E3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32 ref: 00402294
SendMessageA.USER32 ref: 004022BE

Strings

!, xrefs: 00402231

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: ae62e435266e3004bc25908d5d2ad0cb5826a6fc8d1708ba3a371f46b01cab50
Instruction ID: a790f44bbcbfc51444ab4f93a78f6104840dc0be6af6187218351783eeece817
Opcode Fuzzy Hash: ae62e435266e3004bc25908d5d2ad0cb5826a6fc8d1708ba3a371f46b01cab50
Instruction Fuzzy Hash: 044140B18083109FD715AF6AC84839EFBF4AF84344F41C4AEE488A32A1D7788981CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00406ED7 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 71windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00406F16
CallWindowProcA.USER32 ref: 00406FB8

Part of subcall function 00404BD7: SendMessageA.USER32 ref: 00404C00

Strings

62lP/4uOUYfKA3tfxllnPzQXGLJgRjFKHZbIa8JtXF+oMlF4/GglqDQr8FrkYyAg2UYkxW9kefTa, xrefs: 00406F4C, 00406F6C, 00406F8F
, xrefs: 00406EF1

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $62lP/4uOUYfKA3tfxllnPzQXGLJgRjFKHZbIa8JtXF+oMlF4/GglqDQr8FrkYyAg2UYkxW9kefTa
API String ID: 3748168415-550765199
Opcode ID: fef611bbe469a29a19d67650dfd37103651c2d078b1ca09239947b2c1c1f8b3b
Instruction ID: 9710050d3cc87503a6e3ad62db4a5623da0bea7fc0aec59e94b28eb5e14ff036
Opcode Fuzzy Hash: fef611bbe469a29a19d67650dfd37103651c2d078b1ca09239947b2c1c1f8b3b
Instruction Fuzzy Hash: 7F212CB0908315AFE710AF15E88496FBBF8EF44718F51883EF895A7281C3795851CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 004020E0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32 ref: 00402195
GlobalAlloc.KERNEL32 ref: 004021B0

Strings

Installed, xrefs: 00402131, 0040215E
Pfo, xrefs: 004020E6, 00402143, 00402159, 00402190, 004021CF, 004021D8

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: Global$AllocFree
String ID: Installed$Pfo
API String ID: 3394109436-1978309648
Opcode ID: 9eaf42be06e0d8165a7845864ac7e32df8efedfd5a489f51e2e5e30a7a8364af
Instruction ID: caab7a00c9507933a32b1cf3e7c2368a526c10743f68ba1ac9ea26b5e2cc4220
Opcode Fuzzy Hash: 9eaf42be06e0d8165a7845864ac7e32df8efedfd5a489f51e2e5e30a7a8364af
Instruction Fuzzy Hash: 23315EB2908710AFD720EF15D944A6BB7E8EB84705F01853EF985B7380D7789D41CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00406FCB Relevance: 6.1, APIs: 4, Instructions: 86windowCOMMON

Download Yara Rule

APIs

SetWindowTextA.USER32 ref: 00407061
SendMessageA.USER32 ref: 004070A1
SendMessageA.USER32 ref: 004070CF
SendMessageA.USER32 ref: 004070EE

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: MessageSend$TextWindow
String ID:
API String ID: 1596935084-0
Opcode ID: 2d215b4a7c55684c2c01937122f4af6b3fafd761fe9b14146eef76cc387a2035
Instruction ID: 83727bad7781ca9a6187a820c8695953688329d0e622d1880d2d702268a23253
Opcode Fuzzy Hash: 2d215b4a7c55684c2c01937122f4af6b3fafd761fe9b14146eef76cc387a2035
Instruction Fuzzy Hash: EF311CB1D08214AFD710AF69C84466FBBF4EF44714F00C42EE884AB380D779A8458B96

Uniqueness

Uniqueness Score: -1.00%

Function 00407D37 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,?,?,?,?,00000000,?,?,?,004042CE), ref: 00407D9F
CharNextA.USER32(?,?,?,?,?,00000000,?,?,?,004042CE), ref: 00407DBE
CharNextA.USER32(?,?,?,00000000,?,?,?,004042CE), ref: 00407DCA
CharPrevA.USER32(?,?,00000000,?,?,?,004042CE), ref: 00407DE5

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: Char$Next$Prev
String ID:
API String ID: 589700163-0
Opcode ID: 128b1f827d319e1f67624c76284cc49d88a0dabf465fa48954d28b908fb3de1d
Instruction ID: 94f009cbb2cc83b7245da44e9dca2fd274f464f9a0f55bd6391dd9b653ffba1a
Opcode Fuzzy Hash: 128b1f827d319e1f67624c76284cc49d88a0dabf465fa48954d28b908fb3de1d
Instruction Fuzzy Hash: 492194B1C082406FEB217F28988067ABFE49F85720F49847EE4849B251D3786C45CB6B

Uniqueness

Uniqueness Score: -1.00%

Function 00404AE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32 ref: 00404B97

Strings

Zj, xrefs: 00404AFD
NSIS Software Setup, xrefs: 00404B7D

Memory Dump Source

Source File: 0000000A.00000002.1999434022.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000A.00000002.1999419206.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999450557.000000000040A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999466784.000000000040B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000412000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000420000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.000000000042A000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000434000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999483140.0000000000437000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.0000000000438000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1999569805.000000000043C000.00000008.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_400000_vkIsjAzkgrOzUK7uj2IHc9JM.jbxd

Similarity

API ID: TextWindow
String ID: Zj$NSIS Software Setup
API String ID: 530164218-918659373
Opcode ID: bc2eee6d10165418753e2462cb524adf5d7b8903337a38afe12c1506d900572b
Instruction ID: 1ede243bc7e0a0f37790e6dcd7246a005d3f2f3aa806950eac8677958e19fd18
Opcode Fuzzy Hash: bc2eee6d10165418753e2462cb524adf5d7b8903337a38afe12c1506d900572b
Instruction Fuzzy Hash: 2E2187B0A046049FC714DF6AD885A6BB7F5EF88314F44853EE554D73A0E738AC41CB95

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: syncUpd.exePID: 9392, Parent PID: 8660COMMON

Execution Graph

Execution Coverage:	21.3%
Dynamic/Decrypted Code Coverage:	1.5%
Signature Coverage:	3.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	32

Executed Functions

Function 00416240 Relevance: 165.7, APIs: 110, Instructions: 674
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,0084C520), ref: 0041625D
GetProcAddress.KERNEL32(74DD0000,0084C640), ref: 00416275
GetProcAddress.KERNEL32(74DD0000,0084DA50), ref: 0041628E
GetProcAddress.KERNEL32(74DD0000,0084DA68), ref: 004162A6
GetProcAddress.KERNEL32(74DD0000,0084DA20), ref: 004162BE
GetProcAddress.KERNEL32(74DD0000,0084D9C0), ref: 004162D7
GetProcAddress.KERNEL32(74DD0000,008502E0), ref: 004162EF
GetProcAddress.KERNEL32(74DD0000,0084D9A8), ref: 00416307
GetProcAddress.KERNEL32(74DD0000,0084DA38), ref: 00416320
GetProcAddress.KERNEL32(74DD0000,0084DA08), ref: 00416338
GetProcAddress.KERNEL32(74DD0000,0084D9D8), ref: 00416350
GetProcAddress.KERNEL32(74DD0000,0084C360), ref: 00416369
GetProcAddress.KERNEL32(74DD0000,0084C3E0), ref: 00416381
GetProcAddress.KERNEL32(74DD0000,0084C660), ref: 00416399
GetProcAddress.KERNEL32(74DD0000,0084C320), ref: 004163B2
GetProcAddress.KERNEL32(74DD0000,0084D9F0), ref: 004163CA
GetProcAddress.KERNEL32(74DD0000,008547C0), ref: 004163E2
GetProcAddress.KERNEL32(74DD0000,00850128), ref: 004163FB
GetProcAddress.KERNEL32(74DD0000,0084C580), ref: 00416413
GetProcAddress.KERNEL32(74DD0000,00854808), ref: 0041642B
GetProcAddress.KERNEL32(74DD0000,008547D8), ref: 00416444
GetProcAddress.KERNEL32(74DD0000,008546E8), ref: 0041645C
GetProcAddress.KERNEL32(74DD0000,00854838), ref: 00416474
GetProcAddress.KERNEL32(74DD0000,0084C420), ref: 0041648D
GetProcAddress.KERNEL32(74DD0000,008548C8), ref: 004164A5
GetProcAddress.KERNEL32(74DD0000,00854820), ref: 004164BD
GetProcAddress.KERNEL32(74DD0000,00854850), ref: 004164D6
GetProcAddress.KERNEL32(74DD0000,008547A8), ref: 004164EE
GetProcAddress.KERNEL32(74DD0000,00854760), ref: 00416506
GetProcAddress.KERNEL32(74DD0000,008547F0), ref: 0041651F
GetProcAddress.KERNEL32(74DD0000,00854958), ref: 00416537
GetProcAddress.KERNEL32(74DD0000,008546B8), ref: 0041654F
GetProcAddress.KERNEL32(74DD0000,00854748), ref: 00416568
GetProcAddress.KERNEL32(74DD0000,0084FF00), ref: 00416580
GetProcAddress.KERNEL32(74DD0000,00854880), ref: 00416598
GetProcAddress.KERNEL32(74DD0000,00854868), ref: 004165B1
GetProcAddress.KERNEL32(74DD0000,0084C480), ref: 004165C9
GetProcAddress.KERNEL32(74DD0000,00854898), ref: 004165E1
GetProcAddress.KERNEL32(74DD0000,0084C040), ref: 004165FA
GetProcAddress.KERNEL32(74DD0000,008548B0), ref: 00416612
GetProcAddress.KERNEL32(74DD0000,00854988), ref: 0041662A
GetProcAddress.KERNEL32(74DD0000,0084BEC0), ref: 00416643
GetProcAddress.KERNEL32(74DD0000,0084C1E0), ref: 0041665B
LoadLibraryA.KERNEL32(00854928,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 0041666D
LoadLibraryA.KERNEL32(008548E0,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 0041667E
LoadLibraryA.KERNEL32(008548F8,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 00416690
LoadLibraryA.KERNEL32(00854910,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166A2
LoadLibraryA.KERNEL32(00854940,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166B3
LoadLibraryA.KERNEL32(00854970,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166C5
LoadLibraryA.KERNEL32(00854730,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166D7
LoadLibraryA.KERNEL32(008549A0,?,00412CC6,?,00000030,00000064,004132C0,?,0000002C,00000064,00413260,?,00000030,00000064,Function_00013160,?), ref: 004166E8
GetProcAddress.KERNEL32(75290000,0084C220), ref: 0041670A
GetProcAddress.KERNEL32(75290000,008546D0), ref: 00416722
GetProcAddress.KERNEL32(75290000,0084DE10), ref: 0041673A
GetProcAddress.KERNEL32(75290000,00854700), ref: 00416753
GetProcAddress.KERNEL32(75290000,0084C260), ref: 0041676B
GetProcAddress.KERNEL32(73B70000,008502B8), ref: 00416790
GetProcAddress.KERNEL32(73B70000,0084C1C0), ref: 004167A9
GetProcAddress.KERNEL32(73B70000,008501A0), ref: 004167C1
GetProcAddress.KERNEL32(73B70000,00854718), ref: 004167D9
GetProcAddress.KERNEL32(73B70000,00854778), ref: 004167F2
GetProcAddress.KERNEL32(73B70000,0084C180), ref: 0041680A
GetProcAddress.KERNEL32(73B70000,0084C100), ref: 00416822
GetProcAddress.KERNEL32(73B70000,00854790), ref: 0041683B
GetProcAddress.KERNEL32(752C0000,0084BEE0), ref: 0041685C
GetProcAddress.KERNEL32(752C0000,0084C1A0), ref: 00416874
GetProcAddress.KERNEL32(752C0000,00854A78), ref: 0041688D
GetProcAddress.KERNEL32(752C0000,008549D0), ref: 004168A5
GetProcAddress.KERNEL32(752C0000,0084C080), ref: 004168BD
GetProcAddress.KERNEL32(74EC0000,008501C8), ref: 004168E3
GetProcAddress.KERNEL32(74EC0000,00850218), ref: 004168FB
GetProcAddress.KERNEL32(74EC0000,00854A60), ref: 00416913
GetProcAddress.KERNEL32(74EC0000,0084C200), ref: 0041692C
GetProcAddress.KERNEL32(74EC0000,0084BF00), ref: 00416944
GetProcAddress.KERNEL32(74EC0000,00850240), ref: 0041695C
GetProcAddress.KERNEL32(75BD0000,00854A48), ref: 00416982
GetProcAddress.KERNEL32(75BD0000,0084C240), ref: 0041699A
GetProcAddress.KERNEL32(75BD0000,0084DD80), ref: 004169B2
GetProcAddress.KERNEL32(75BD0000,008549E8), ref: 004169CB
GetProcAddress.KERNEL32(75BD0000,008549B8), ref: 004169E3
GetProcAddress.KERNEL32(75BD0000,0084C060), ref: 004169FB
GetProcAddress.KERNEL32(75BD0000,0084C280), ref: 00416A14
GetProcAddress.KERNEL32(75BD0000,00854A00), ref: 00416A2C
GetProcAddress.KERNEL32(75BD0000,00854A18), ref: 00416A44
GetProcAddress.KERNEL32(75A70000,0084C2A0), ref: 00416A66
GetProcAddress.KERNEL32(75A70000,00854A30), ref: 00416A7E
GetProcAddress.KERNEL32(75A70000,00854B98), ref: 00416A96
GetProcAddress.KERNEL32(75A70000,00854D00), ref: 00416AAF
GetProcAddress.KERNEL32(75A70000,00854D78), ref: 00416AC7
GetProcAddress.KERNEL32(75450000,0084BF20), ref: 00416AE8
GetProcAddress.KERNEL32(75450000,0084BF40), ref: 00416B01
GetProcAddress.KERNEL32(75DA0000,0084BFE0), ref: 00416B22
GetProcAddress.KERNEL32(75DA0000,00854C70), ref: 00416B3A
GetProcAddress.KERNEL32(6F090000,0084BF60), ref: 00416B60
GetProcAddress.KERNEL32(6F090000,0084BF80), ref: 00416B78
GetProcAddress.KERNEL32(6F090000,0084BFA0), ref: 00416B90
GetProcAddress.KERNEL32(6F090000,00854DA8), ref: 00416BA9
GetProcAddress.KERNEL32(6F090000,0084BFC0), ref: 00416BC1
GetProcAddress.KERNEL32(6F090000,0084C000), ref: 00416BD9
GetProcAddress.KERNEL32(6F090000,0084C160), ref: 00416BF2
GetProcAddress.KERNEL32(6F090000,0084C0A0), ref: 00416C0A
GetProcAddress.KERNEL32(75AF0000,00854AF0), ref: 00416C2B
GetProcAddress.KERNEL32(75AF0000,0084DE20), ref: 00416C44
GetProcAddress.KERNEL32(75AF0000,00854AC0), ref: 00416C5C
GetProcAddress.KERNEL32(75AF0000,00854AD8), ref: 00416C74
GetProcAddress.KERNEL32(75D90000,0084C020), ref: 00416C96
GetProcAddress.KERNEL32(6B8F0000,00854B50), ref: 00416CB7
GetProcAddress.KERNEL32(6B8F0000,0084C0C0), ref: 00416CCF
GetProcAddress.KERNEL32(6B8F0000,00854C88), ref: 00416CE8
GetProcAddress.KERNEL32(6B8F0000,00854CB8), ref: 00416D00

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: ce70c898548f88182f5d017b929846a165f52d01e2510d34cdd7b30da02966dd
Instruction ID: 6fdcbfc83a7e6ced85b92bf4002cf1d70b18d179e1e2f66c0d1faa926a602d30
Opcode Fuzzy Hash: ce70c898548f88182f5d017b929846a165f52d01e2510d34cdd7b30da02966dd
Instruction Fuzzy Hash: 6E623EB5510E10AFC374DFA8FE88A1637ABBBCC311311A519A60AC72A4DF759483CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00411650 Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 237
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00411669
FindFirstFileA.KERNEL32(?,?), ref: 00411680
lstrcat.KERNEL32(?,?), ref: 004116D2
StrCmpCA.SHLWAPI(?,0041D7F8), ref: 004116E4
StrCmpCA.SHLWAPI(?,0041D7FC), ref: 004116FA
FindNextFileA.KERNELBASE(000000FF,?), ref: 00411980
FindClose.KERNEL32(000000FF), ref: 00411995

Strings

%s\*, xrefs: 0041165D
%s%s, xrefs: 00411838
%s\%s\%s, xrefs: 004117DB
%s\%s, xrefs: 00411714
%s\%s, xrefs: 004117FD

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: dc165bfe059858b008f46a8c8689db8cb5fddec1d4dee71b8375d3b2251b46db
Instruction ID: 56f1237c2d7c520c90c98f1ce5fb3a6d9b51b415e2d0c2f733ce4a2014328567
Opcode Fuzzy Hash: dc165bfe059858b008f46a8c8689db8cb5fddec1d4dee71b8375d3b2251b46db
Instruction Fuzzy Hash: AE9172B19006189BDB24EFA4DC85FEA737DBF88300F044589F61A92191DB789AC5CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040B610 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,0041D71A,0041D717,00000000,?,?,?,0041DB54,0041D716), ref: 0040B695
StrCmpCA.SHLWAPI(?,0041DB58), ref: 0040B6ED
StrCmpCA.SHLWAPI(?,0041DB5C), ref: 0040B703
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040BF3B
FindClose.KERNEL32(000000FF), ref: 0040BF4D

Strings

\Brave\Preferences, xrefs: 0040B97B
Google Chrome, xrefs: 0040BDB9
Brave, xrefs: 0040B8A2
Preferences, xrefs: 0040B8BE

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: d3a0959b4ba69f342173dac8db500810829cb5fa07dcce1045c24a54adfa1a5b
Instruction ID: 76d401781d3fce7c968e745dc043d6a6225f477281f2400f678919b217ba5a4c
Opcode Fuzzy Hash: d3a0959b4ba69f342173dac8db500810829cb5fa07dcce1045c24a54adfa1a5b
Instruction Fuzzy Hash: 0F423572A0010457CF14FB61DC56EEE773DAF84304F41455EF90AA6181EE38AB89CBE9

Uniqueness

Uniqueness Score: -1.00%

Function 00412570 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00412589
FindFirstFileA.KERNELBASE(?,?), ref: 004125A0
StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
FindClose.KERNEL32(000000FF), ref: 004127CE

Strings

%s\%s, xrefs: 0041264F
%s\%s, xrefs: 004125FE
%s\*, xrefs: 0041257D

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 70f66335c68ee9bee9e93ad0ea58b8d0e5d9bc99c8bb7c2902da79831dca3d0c
Instruction ID: 16fd5a9597efbfb91ed0225017393bb16e0f77851f83799e5682f8bc7922baf0
Opcode Fuzzy Hash: 70f66335c68ee9bee9e93ad0ea58b8d0e5d9bc99c8bb7c2902da79831dca3d0c
Instruction Fuzzy Hash: 676156B2900618ABCB24EBE0DD99EEA737DBF58701F00458DB61A96140EF74DB85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00411B80 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00411B9D
FindFirstFileA.KERNELBASE(?,?), ref: 00411BB4
StrCmpCA.SHLWAPI(?,0041D834), ref: 00411BE2
StrCmpCA.SHLWAPI(?,0041D838), ref: 00411BF8
FindNextFileA.KERNEL32(000000FF,?), ref: 00411D3D
FindClose.KERNEL32(000000FF), ref: 00411D52

Strings

%s\%s, xrefs: 00411B91

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 8a2a5c367229f5874a14f57b428850a66a498e63ff653c6488f4aaaa7e785072
Instruction ID: 1beca0db89a34a7d9f561fb59a57ff38f1a0216f2a844ef05cbde65d1a44dc5a
Opcode Fuzzy Hash: 8a2a5c367229f5874a14f57b428850a66a498e63ff653c6488f4aaaa7e785072
Instruction Fuzzy Hash: D75168B5900618ABCB24EBB0DC85EEA737DBB48304F40458DB65A96050EB79ABC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00404C70 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00404C8A
RtlAllocateHeap.NTDLL(00000000), ref: 00404C91
InternetOpenA.WININET(0041D79B,00000000,00000000,00000000,00000000), ref: 00404CAA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00404CD1
InternetReadFile.WININET(c.A,?,00000400,00000000), ref: 00404D01
InternetCloseHandle.WININET(c.A), ref: 00404D75
InternetCloseHandle.WININET(?), ref: 00404D82

Strings

c.A, xrefs: 00404CC1, 00404DA0
c.A, xrefs: 00404D71, 00404CFD, 00404D00, 00404D74

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID: c.A$c.A
API String ID: 3066467675-270182787
Opcode ID: ff34e455916cb5254e18773c9340263e729f543755462a643926861e0345f7f7
Instruction ID: 93472a029acc8278824907ab7d145ea178407da7df790c597300061c638fc298
Opcode Fuzzy Hash: ff34e455916cb5254e18773c9340263e729f543755462a643926861e0345f7f7
Instruction Fuzzy Hash: 3731F8F4A00218ABDB20DF54DD85BDDB7B5BB88304F5081D9F709A7280DB746AC58F98

Uniqueness

Uniqueness Score: -1.00%

Function 004015C0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215C4,?,00401E03,?,004215C8,?,?,00000000,?,00000000), ref: 00401813
StrCmpCA.SHLWAPI(?,004215CC), ref: 00401863
StrCmpCA.SHLWAPI(?,004215D0), ref: 00401879
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401C30
DeleteFileA.KERNEL32(00000000), ref: 00401CB4
FindNextFileA.KERNEL32(000000FF,?), ref: 00401D0A
FindClose.KERNEL32(000000FF), ref: 00401D1C

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Strings

\*.*, xrefs: 004016E1

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 97e85b43c552c4dbc7e919695e7538a28509a809179b5093773488ee34a19d07
Instruction ID: 3aa4ae790513c502dab12fd0122e5550b13815c0fff8c800b600eb4522263f51
Opcode Fuzzy Hash: 97e85b43c552c4dbc7e919695e7538a28509a809179b5093773488ee34a19d07
Instruction Fuzzy Hash: D41225759102189BCB15FB61DC56EEE7739AF54308F41419EB10A62091EF38AFC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1C0 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0041DC10,0041D73F), ref: 0040D22B
StrCmpCA.SHLWAPI(?,0041DC14), ref: 0040D273
StrCmpCA.SHLWAPI(?,0041DC18), ref: 0040D289
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040D4EE
FindClose.KERNEL32(000000FF), ref: 0040D500

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 2180551a0c4e3207b4f81c37398090c946739d52e866aa5511909d8f45e6d684
Instruction ID: a7e743a2a4f5118c59e4eb5b7e6cabc454f6fbff0e67e47d23a58287cf68124a
Opcode Fuzzy Hash: 2180551a0c4e3207b4f81c37398090c946739d52e866aa5511909d8f45e6d684
Instruction Fuzzy Hash: 63913B72A0020497CB14FFB1EC569EE777DAB84308F41466EF90A96581EE38D788CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00414570 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

GetKeyboardLayoutList.USER32(00000000,00000000,0041D146), ref: 0041459E
LocalAlloc.KERNEL32(00000040,?), ref: 004145B6
GetKeyboardLayoutList.USER32(?,00000000), ref: 004145CA
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0041461F
LocalFree.KERNEL32(00000000), ref: 004146DF

Strings

/ , xrefs: 0041463C

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 60cf60d2bbf8d4e1dd8499e92edbdcdf2f75013254280117aef3c6c3a611279e
Instruction ID: e4a09482d03fe0ac07b2aa12fe49ef9b635f824a972481fa3f662a7a2871ed61
Opcode Fuzzy Hash: 60cf60d2bbf8d4e1dd8499e92edbdcdf2f75013254280117aef3c6c3a611279e
Instruction Fuzzy Hash: D5413B74940218ABCB24DF50DC89BEDB775BB54308F2042DAE10A66191DB786FC5CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB60 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,0041D74E), ref: 0040DBD2
StrCmpCA.SHLWAPI(?,0041DC58), ref: 0040DC22
StrCmpCA.SHLWAPI(?,0041DC5C), ref: 0040DC38
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E306

Strings

\*.*, xrefs: 0040DB7D

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 510a3fe4409e4a79a5de15435b416e118e0949a0d8a30a31cf4802c67fceaeac
Instruction ID: 8f23b39e961a58df861ec407c7814dc8b58ae9c3eb94c511c30fb23e96a564a4
Opcode Fuzzy Hash: 510a3fe4409e4a79a5de15435b416e118e0949a0d8a30a31cf4802c67fceaeac
Instruction Fuzzy Hash: 88126771A002145ACB14FB61DC56EED7739AF54308F4142AEB50A66091EF389FC8CFE8

Uniqueness

Uniqueness Score: -1.00%

Function 004155A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,>N@,40000001,00000000,00000000), ref: 004155C0

Strings

>N@, xrefs: 004155B8, 00415614, 004155BB, 00415617

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID: >N@
API String ID: 80407269-3381801619
Opcode ID: 718bb6be1b75e617e987197471ae693474da6023ddc0167bf927d0320b7ad6f5
Instruction ID: 37622f5e64546725dbf22d4b9568f407ee9b467eb6af981ec2fff7c5b56759cd
Opcode Fuzzy Hash: 718bb6be1b75e617e987197471ae693474da6023ddc0167bf927d0320b7ad6f5
Instruction Fuzzy Hash: 73110D74200A04FFDB10CFA4E844FEB37AABF89310F509549F9098B254D775E881DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00415D00 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00415D1E
Process32First.KERNEL32(0041D599,00000128), ref: 00415D32
Process32Next.KERNEL32(0041D599,00000128), ref: 00415D47
StrCmpCA.SHLWAPI(?,00000000), ref: 00415D5C
CloseHandle.KERNEL32(0041D599), ref: 00415D7A

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: f6d0f21b7cc225942ebaf2b71921687e4bacd107d031d79921886f9976f157bb
Instruction ID: 4a4bbd9776da2ad99231b6c5471aa9e11f786ff18f9e7f574f496e4dc08d41d8
Opcode Fuzzy Hash: f6d0f21b7cc225942ebaf2b71921687e4bacd107d031d79921886f9976f157bb
Instruction Fuzzy Hash: 53012575A00608EBDB24DF94DD58BDEB7B9BF88304F108189E90597250DB749B81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 004144B0 Relevance: 6.0, APIs: 4, Instructions: 32memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?,00854FD0,00000000,?,0041D758,00000000,?,00000000,00000000,?,00855568,00000000), ref: 004144C0
HeapAlloc.KERNEL32(00000000), ref: 004144C7
GetTimeZoneInformation.KERNEL32(?), ref: 004144DA
wsprintfA.USER32 ref: 00414514

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: 3e8ee039c0baa52381bc867147264b9e0472758f99ecf5fc77eb662dd471fe6c
Instruction ID: 63b956e3650aea0bdd01ac085b80a838c67200ff8d98e36f2a49cf33a9f6a1bd
Opcode Fuzzy Hash: 3e8ee039c0baa52381bc867147264b9e0472758f99ecf5fc77eb662dd471fe6c
Instruction Fuzzy Hash: C7F06770E047289BDB309B64DD49FA9737ABB44311F0002D5EA0AE3291DB749E858F97

Uniqueness

Uniqueness Score: -1.00%

Function 00409540 Relevance: 4.5, APIs: 3, Instructions: 49memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409564
LocalAlloc.KERNEL32(00000040,00000000), ref: 00409583
LocalFree.KERNEL32(?), ref: 004095AF

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 22788d86bb0e3b36a7a96175dcc17964957ca332b329b0ec9e9903d4a9c63904
Instruction ID: 845aa5354f8c35be15d3c308e338542aeef751caf2e905b87ee6994bb5fcaacd
Opcode Fuzzy Hash: 22788d86bb0e3b36a7a96175dcc17964957ca332b329b0ec9e9903d4a9c63904
Instruction Fuzzy Hash: 2B11B7B8A00609EFCB04DF94C984AAEB7B5FF88301F104559E915A7390D774AE51CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 004143C0 Relevance: 4.5, APIs: 3, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00401177,0084DCB0,004136EB,0041D6E3), ref: 004143CD
HeapAlloc.KERNEL32(00000000), ref: 004143D4
GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 19f43c5935948d257337b5cfe167422182bb8e9e8b16b88c7073f3e19bcb2857
Instruction ID: fd22aaf49eebc4deedfa71bce2fb200d05227bfc9b63873cd8cb515d50d954e6
Opcode Fuzzy Hash: 19f43c5935948d257337b5cfe167422182bb8e9e8b16b88c7073f3e19bcb2857
Instruction Fuzzy Hash: 2CE08CB490070CFFCB20EFE4DC49E9CBBB8AB08312F000184FA09E3280DB7056848B91

Uniqueness

Uniqueness Score: -1.00%

Function 00401120 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004136D7,0041D6E3), ref: 0040112A
ExitProcess.KERNEL32 ref: 0040113E

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 0c78e0eb242a3f19764e03ad46aab426447ce2b04c76b8959ffb9729e3075d63
Instruction ID: 30efb513975bfe185fa80fb3a8f84b393628ccfbb0aa9170a1b214bc368b0093
Opcode Fuzzy Hash: 0c78e0eb242a3f19764e03ad46aab426447ce2b04c76b8959ffb9729e3075d63
Instruction Fuzzy Hash: B6D05E7490020C8BCB14DFE09A496DDBBB9AB8D711F001455DD0572240DA305441CA65

Uniqueness

Uniqueness Score: -1.00%

Function 006A092B Relevance: 2.6, Strings: 2, Instructions: 90COMMON

Download Yara Rule

Strings

GetProcAddress., xrefs: 006A09DC, 006A09DF, 006A09E4
., xrefs: 006A095F

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.
API String ID: 0-2443869724
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 950ca7b9e5abbbfde5366c66b5014f758a29023b43122d8a2dbe4e0272f0e847
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 5B3137B6900609DFEB10DF99C880AAEBBF6FF49324F24504AD441A7311D771EA45CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 004070E0 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00413068,?), ref: 004070F4
RtlAllocateHeap.NTDLL(00000000,?,00413068,?), ref: 004070FB
lstrcat.KERNEL32(?,008515A8), ref: 004072AB
lstrcat.KERNEL32(?,?), ref: 004072BF
lstrcat.KERNEL32(?,?), ref: 004072D3
lstrcat.KERNEL32(?,?), ref: 004072E7
lstrcat.KERNEL32(?,00855180), ref: 004072FB
lstrcat.KERNEL32(?,00855138), ref: 0040730F
lstrcat.KERNEL32(?,00855240), ref: 00407322
lstrcat.KERNEL32(?,00855198), ref: 00407336
lstrcat.KERNEL32(?,00851630), ref: 0040734A
lstrcat.KERNEL32(?,?), ref: 0040735E
lstrcat.KERNEL32(?,?), ref: 00407372
lstrcat.KERNEL32(?,?), ref: 00407386
lstrcat.KERNEL32(?,00855180), ref: 00407399
lstrcat.KERNEL32(?,00855138), ref: 004073AD
lstrcat.KERNEL32(?,00855240), ref: 004073C1
lstrcat.KERNEL32(?,00855198), ref: 004073D4
lstrcat.KERNEL32(?,00851698), ref: 004073E8
lstrcat.KERNEL32(?,?), ref: 004073FC
lstrcat.KERNEL32(?,?), ref: 00407410
lstrcat.KERNEL32(?,?), ref: 00407424
lstrcat.KERNEL32(?,00855180), ref: 00407438
lstrcat.KERNEL32(?,00855138), ref: 0040744B
lstrcat.KERNEL32(?,00855240), ref: 0040745F
lstrcat.KERNEL32(?,00855198), ref: 00407473
lstrcat.KERNEL32(?,00851700), ref: 00407486
lstrcat.KERNEL32(?,?), ref: 0040749A
lstrcat.KERNEL32(?,?), ref: 004074AE
lstrcat.KERNEL32(?,?), ref: 004074C2
lstrcat.KERNEL32(?,00855180), ref: 004074D6
lstrcat.KERNEL32(?,00855138), ref: 004074EA
lstrcat.KERNEL32(?,00855240), ref: 004074FD
lstrcat.KERNEL32(?,00855198), ref: 00407511
lstrcat.KERNEL32(?,00855FE8), ref: 00407525
lstrcat.KERNEL32(?,?), ref: 00407539
lstrcat.KERNEL32(?,?), ref: 0040754D
lstrcat.KERNEL32(?,?), ref: 00407561
lstrcat.KERNEL32(?,00855180), ref: 00407574
lstrcat.KERNEL32(?,00855138), ref: 00407588
lstrcat.KERNEL32(?,00855240), ref: 0040759C
lstrcat.KERNEL32(?,00855198), ref: 004075AF
lstrcat.KERNEL32(?,00856050), ref: 004075C3
lstrcat.KERNEL32(?,?), ref: 004075D7
lstrcat.KERNEL32(?,?), ref: 004075EB
lstrcat.KERNEL32(?,?), ref: 004075FF
lstrcat.KERNEL32(?,00855180), ref: 00407613
lstrcat.KERNEL32(?,00855138), ref: 00407626
lstrcat.KERNEL32(?,00855240), ref: 0040763A
lstrcat.KERNEL32(?,00855198), ref: 0040764E

Part of subcall function 00406FA0: lstrcat.KERNEL32(2D1F9020,0041DEB8), ref: 00406FD6
Part of subcall function 00406FA0: lstrcat.KERNEL32(2D1F9020,00000000), ref: 00407018
Part of subcall function 00406FA0: lstrcat.KERNEL32(2D1F9020, : ), ref: 0040702A
Part of subcall function 00406FA0: lstrcat.KERNEL32(2D1F9020,00000000), ref: 0040705F
Part of subcall function 00406FA0: lstrcat.KERNEL32(2D1F9020,0041DEC0), ref: 00407070
Part of subcall function 00406FA0: lstrcat.KERNEL32(2D1F9020,00000000), ref: 004070A3
Part of subcall function 00406FA0: lstrcat.KERNEL32(2D1F9020,0041DEC4), ref: 004070BD
Part of subcall function 00406FA0: task.LIBCPMTD ref: 004070CB

lstrcat.KERNEL32(?,0084DAD0), ref: 004077DB
lstrcat.KERNEL32(?,008553E8), ref: 004077EE
lstrlen.KERNEL32(2D1F9020), ref: 004077FB
lstrlen.KERNEL32(2D1F9020), ref: 0040780B

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,0084DAE0), ref: 00404ED9

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$Heap$AllocateInternetOpenProcesslstrcpytask
String ID:
API String ID: 3958002797-0
Opcode ID: 1deb68fe007c3a931c0a137675a9dba7412e12439f4df884cae112fa19bd3d59
Instruction ID: 3e78b0701875fb024adfa953bd7607f570b92d72e3b87f8e208063dda3fe5bd2
Opcode Fuzzy Hash: 1deb68fe007c3a931c0a137675a9dba7412e12439f4df884cae112fa19bd3d59
Instruction Fuzzy Hash: D33234B6D01A14ABCB35EBA0DC89DDE737DAB48704F404699B20A66090DF78E7C5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA90 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

strtok_s.MSVCRT ref: 0040EB5B
GetProcessHeap.KERNEL32(00000000,000F423F,0041D77A,0041D777,0041D776,0041D773), ref: 0040EBA2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040EBA9
StrStrA.SHLWAPI(00000000,<Host>), ref: 0040EBC5
lstrlen.KERNEL32(00000000), ref: 0040EBD3

Part of subcall function 00414FA0: malloc.MSVCRT ref: 00414FA8
Part of subcall function 00414FA0: strncpy.MSVCRT ref: 00414FC3

StrStrA.SHLWAPI(00000000,<Port>), ref: 0040EC0F
lstrlen.KERNEL32(00000000), ref: 0040EC1D
StrStrA.SHLWAPI(00000000,<User>), ref: 0040EC59
lstrlen.KERNEL32(00000000), ref: 0040EC67
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 0040ECA3
lstrlen.KERNEL32(00000000), ref: 0040ECB5
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040ED42
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED5A
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED72
lstrlen.KERNEL32(00000000,?,?,00000000), ref: 0040ED8A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 0040EDA2
lstrcat.KERNEL32(?,profile: null), ref: 0040EDB1
lstrcat.KERNEL32(?,url: ), ref: 0040EDC0
lstrcat.KERNEL32(?,00000000), ref: 0040EDD3
lstrcat.KERNEL32(?,0041DD34), ref: 0040EDE2
lstrcat.KERNEL32(?,00000000), ref: 0040EDF5
lstrcat.KERNEL32(?,0041DD38), ref: 0040EE04
lstrcat.KERNEL32(?,login: ), ref: 0040EE13
lstrcat.KERNEL32(?,00000000), ref: 0040EE26
lstrcat.KERNEL32(?,0041DD44), ref: 0040EE35
lstrcat.KERNEL32(?,password: ), ref: 0040EE44
lstrcat.KERNEL32(?,00000000), ref: 0040EE57
lstrcat.KERNEL32(?,0041DD54), ref: 0040EE66
lstrcat.KERNEL32(?,0041DD58), ref: 0040EE75
strtok_s.MSVCRT ref: 0040EEB9
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 0040EECE
memset.MSVCRT ref: 0040EF17

Strings

\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 0040EAE4
browser: FileZilla, xrefs: 0040ED99
<Host>, xrefs: 0040EBBC
<User>, xrefs: 0040EC50
<Pass encoding="base64">, xrefs: 0040EC9A
login: , xrefs: 0040EE0A
password: , xrefs: 0040EE3B
<Port>, xrefs: 0040EC06
url: , xrefs: 0040EDB7
profile: null, xrefs: 0040EDA8

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$ChangeCloseCreateFindFolderFreeNotificationPathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1266801029-555421843
Opcode ID: 554274b7f4d5cfbdb4e49c16870704ee869b999299c8ac7ceaf80640ec420baa
Instruction ID: d9186ee441f73b04c887f2efee86d04259a2264df0fa853aa1509dbc15227f06
Opcode Fuzzy Hash: 554274b7f4d5cfbdb4e49c16870704ee869b999299c8ac7ceaf80640ec420baa
Instruction Fuzzy Hash: 3FD174B5D00208ABCB14EBF1DD56EEE7739AF44304F50851EF106B6095DF38AA85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00415ED0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00832940), ref: 00415F11
GetProcAddress.KERNEL32(74DD0000,00832958), ref: 00415F2A
GetProcAddress.KERNEL32(74DD0000,00832970), ref: 00415F42
GetProcAddress.KERNEL32(74DD0000,008329A0), ref: 00415F5A
GetProcAddress.KERNEL32(74DD0000,008328E0), ref: 00415F73
GetProcAddress.KERNEL32(74DD0000,0084A880), ref: 00415F8B
GetProcAddress.KERNEL32(74DD0000,0084C600), ref: 00415FA3
GetProcAddress.KERNEL32(74DD0000,0084C5A0), ref: 00415FBC
GetProcAddress.KERNEL32(74DD0000,00832988), ref: 00415FD4
GetProcAddress.KERNEL32(74DD0000,00832910), ref: 00415FEC
GetProcAddress.KERNEL32(74DD0000,008328F8), ref: 00416005
GetProcAddress.KERNEL32(74DD0000,0084D720), ref: 0041601D
GetProcAddress.KERNEL32(74DD0000,0084C5C0), ref: 00416035
GetProcAddress.KERNEL32(74DD0000,0084D930), ref: 0041604E
GetProcAddress.KERNEL32(74DD0000,0084D6C0), ref: 00416066
GetProcAddress.KERNEL32(74DD0000,0084C5E0), ref: 0041607E
GetProcAddress.KERNEL32(74DD0000,0084D7B0), ref: 00416097
GetProcAddress.KERNEL32(74DD0000,0084D960), ref: 004160AF
GetProcAddress.KERNEL32(74DD0000,0084C460), ref: 004160C7
GetProcAddress.KERNEL32(74DD0000,0084D8E8), ref: 004160E0
GetProcAddress.KERNEL32(74DD0000,0084C340), ref: 004160F8
LoadLibraryA.KERNEL32(0084D990,?,004136C0), ref: 0041610A
LoadLibraryA.KERNEL32(0084D978,?,004136C0), ref: 0041611B
LoadLibraryA.KERNEL32(0084D8B8,?,004136C0), ref: 0041612D
LoadLibraryA.KERNEL32(0084D858,?,004136C0), ref: 0041613F
LoadLibraryA.KERNEL32(0084D738,?,004136C0), ref: 00416150
GetProcAddress.KERNEL32(75A70000,0084D6D8), ref: 00416172
GetProcAddress.KERNEL32(75290000,0084D8D0), ref: 00416193
GetProcAddress.KERNEL32(75290000,0084D6A8), ref: 004161AB
GetProcAddress.KERNEL32(75BD0000,0084D750), ref: 004161CD
GetProcAddress.KERNEL32(75450000,0084C4C0), ref: 004161EE
GetProcAddress.KERNEL32(76E90000,0084A8A0), ref: 0041620F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00416226

Strings

NtQueryInformationProcess, xrefs: 0041621A

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 4bf4faa6d80337b6a8c58e308678245154ae8b5c2676724c8d6fcdc68551e2bc
Instruction ID: 1024ce913f91588aaf476b7e35ab3ad31cc185c195c2877b0ef9f81f7e935ec9
Opcode Fuzzy Hash: 4bf4faa6d80337b6a8c58e308678245154ae8b5c2676724c8d6fcdc68551e2bc
Instruction Fuzzy Hash: 4CA16FB5910E10AFC374DFA8FE88A1637BBBBCC3117116519A60AC72A0DF759482CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404DC0 Relevance: 54.8, APIs: 22, Strings: 9, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

lstrlen.KERNEL32(00000000), ref: 00404E4A

Part of subcall function 004155A0: CryptBinaryToStringA.CRYPT32(00000000,>N@,40000001,00000000,00000000), ref: 004155C0

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
StrCmpCA.SHLWAPI(?,0084DAE0), ref: 00404ED9
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404FF4
HttpOpenRequestA.WININET(00000000,0084DAF0,?,008563D0,00000000,00000000,00400100,00000000), ref: 00405058

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

lstrlen.KERNEL32(00000000,00000000,?,",00000000,?,0084DB80,00000000,?,0084FF60,00000000,?,0041E098,00000000,?,00410996), ref: 004053EB
lstrlen.KERNEL32(00000000), ref: 004053FF
GetProcessHeap.KERNEL32(00000000,?), ref: 00405410
RtlAllocateHeap.NTDLL(00000000), ref: 00405417
lstrlen.KERNEL32(00000000), ref: 0040542C
memcpy.MSVCRT ref: 00405443
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 0040545D
memcpy.MSVCRT ref: 0040546A
lstrlen.KERNEL32(00000000), ref: 0040547C
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405495
memcpy.MSVCRT ref: 004054A5
lstrlen.KERNEL32(00000000,?,?), ref: 004054C2
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 004054D6
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00405501
InternetCloseHandle.WININET(00000000), ref: 00405565
InternetCloseHandle.WININET(00000000), ref: 00405572
InternetCloseHandle.WININET(00000000), ref: 0040557C

Strings

------, xrefs: 0040506B
", xrefs: 00405136
", xrefs: 004053BA
--, xrefs: 00404F34
", xrefs: 00405278
------, xrefs: 00404F4B
------, xrefs: 004052EF
------, xrefs: 004051AD
8me, xrefs: 00405029

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocateBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------$8me
API String ID: 1133489818-4183386520
Opcode ID: 1066e747bb6cfdc7909146bc39ca82586c6501d0e4a54034875a6500624c53ea
Instruction ID: 5eac6181e64dcc8a416a420aa9bf91bf90c69560f183aa6c55bc1ab780bc5ff6
Opcode Fuzzy Hash: 1066e747bb6cfdc7909146bc39ca82586c6501d0e4a54034875a6500624c53ea
Instruction Fuzzy Hash: 55324375920218ABCB14EBA1DC51FEEB779BF54704F40419EF10662091DF38AB89CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00405610 Relevance: 47.7, APIs: 19, Strings: 8, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004056A8
StrCmpCA.SHLWAPI(?,0084DAE0), ref: 004056C3
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405843
lstrlen.KERNEL32(00000000,00000000,?,?,00000000,?,",00000000,?,0084DBF0,00000000,?,0084FF60,00000000,?,0041E0D8), ref: 00405B1E
lstrlen.KERNEL32(00000000), ref: 00405B2F
GetProcessHeap.KERNEL32(00000000,?), ref: 00405B40
HeapAlloc.KERNEL32(00000000), ref: 00405B47
lstrlen.KERNEL32(00000000), ref: 00405B5C
memcpy.MSVCRT ref: 00405B73
lstrlen.KERNEL32(00000000), ref: 00405B85
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00405B9E
memcpy.MSVCRT ref: 00405BAB
lstrlen.KERNEL32(00000000,?,?), ref: 00405BC8
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405BDC
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405BF9
InternetCloseHandle.WININET(00000000), ref: 00405C5D
InternetCloseHandle.WININET(00000000), ref: 00405C6A
HttpOpenRequestA.WININET(00000000,0084DAF0,?,008563D0,00000000,00000000,00400100,00000000), ref: 004058A8

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

InternetCloseHandle.WININET(00000000), ref: 00405C74

Strings

------, xrefs: 00405746
------, xrefs: 004058BB
------, xrefs: 004059FC
", xrefs: 00405985
", xrefs: 00405AC6
-A, xrefs: 0040566F, 00405D14, 004056F7, 00405700, 0040576E, 004057E5, 004058E3, 00405A24, 00405771, 004057E8, 004058E6, 00405A27
8me, xrefs: 00405878
-A, xrefs: 00405620, 00405D27, 00405623

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$8me$-A$-A
API String ID: 148854478-3677574302
Opcode ID: 4d0b476ab2120ceddf4f5dfa0215a68186662df7c57feb437a4b4ec8f2f01245
Instruction ID: 38116f3ce93ed53bffdba46f35b2307ef6cb7c9f678a3856a9fc947e80efe624
Opcode Fuzzy Hash: 4d0b476ab2120ceddf4f5dfa0215a68186662df7c57feb437a4b4ec8f2f01245
Instruction Fuzzy Hash: A0125175920218AACB14EBA1DC95FDEB739BF14304F41429EF10A63091DF386B89CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0040A030 Relevance: 32.0, APIs: 21, Instructions: 494
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00417070: StrCmpCA.SHLWAPI(00000000,0041DBD0,0040C8F2,0041DBD0,00000000), ref: 0041708F

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040A362
RtlAllocateHeap.NTDLL(00000000), ref: 0040A369
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040A14A

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,0084A930,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrcat.KERNEL32(?,00000000), ref: 0040A4AA
lstrcat.KERNEL32(?,0041DA80), ref: 0040A4B9
lstrcat.KERNEL32(?,00000000), ref: 0040A4CC
lstrcat.KERNEL32(?,0041DA84), ref: 0040A4DB
lstrcat.KERNEL32(?,00000000), ref: 0040A4EE
lstrcat.KERNEL32(?,0041DA88), ref: 0040A4FD
lstrcat.KERNEL32(?,00000000), ref: 0040A510
lstrcat.KERNEL32(?,0041DA8C), ref: 0040A51F
lstrcat.KERNEL32(?,00000000), ref: 0040A532
lstrcat.KERNEL32(?,0041DA90), ref: 0040A541
lstrcat.KERNEL32(?,00000000), ref: 0040A554
lstrcat.KERNEL32(?,0041DA94), ref: 0040A563

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrcat.KERNEL32(?,00000000), ref: 0040A5AC
lstrcat.KERNEL32(?,0041DA98), ref: 0040A5C6
lstrlen.KERNEL32(?), ref: 0040A605
lstrlen.KERNEL32(?), ref: 0040A614
memset.MSVCRT ref: 0040A65D

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

DeleteFileA.KERNEL32(00000000), ref: 0040A689

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: 2355c065e26fced5803864f167aefd6f9b55cf79a39c65a2aacedebb5eb6c006
Instruction ID: c7be15c6cc4abab23e8f274795eadccbdda502ec8511485448b77053ecd04baf
Opcode Fuzzy Hash: 2355c065e26fced5803864f167aefd6f9b55cf79a39c65a2aacedebb5eb6c006
Instruction Fuzzy Hash: B0029475900208ABCB14EBA1DC96EEE773ABF14305F11415EF507B6091DF38AE85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C640 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,0084FF90,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040C6D3
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040C817
RtlAllocateHeap.NTDLL(00000000), ref: 0040C81E
lstrcat.KERNEL32(?,00000000), ref: 0040C958
lstrcat.KERNEL32(?,0041DBD8), ref: 0040C967
lstrcat.KERNEL32(?,00000000), ref: 0040C97A
lstrcat.KERNEL32(?,0041DBDC), ref: 0040C989
lstrcat.KERNEL32(?,00000000), ref: 0040C99C
lstrcat.KERNEL32(?,0041DBE0), ref: 0040C9AB
lstrcat.KERNEL32(?,00000000), ref: 0040C9BE
lstrcat.KERNEL32(?,0041DBE4), ref: 0040C9CD
lstrcat.KERNEL32(?,00000000), ref: 0040C9E0
lstrcat.KERNEL32(?,0041DBE8), ref: 0040C9EF
lstrcat.KERNEL32(?,00000000), ref: 0040CA02
lstrcat.KERNEL32(?,0041DBEC), ref: 0040CA11
lstrcat.KERNEL32(?,00000000), ref: 0040CA24
lstrcat.KERNEL32(?,0041DBF0), ref: 0040CA33

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,0084A930,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

lstrlen.KERNEL32(?), ref: 0040CA7A
lstrlen.KERNEL32(?), ref: 0040CA89
memset.MSVCRT ref: 0040CAD2

Part of subcall function 00417070: StrCmpCA.SHLWAPI(00000000,0041DBD0,0040C8F2,0041DBD0,00000000), ref: 0041708F

DeleteFileA.KERNEL32(00000000), ref: 0040CAFE

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 864de1e7452f1a057137727f9e932b628b9b3bcdc5dceea8be44cc60f45b8d94
Instruction ID: d19a215fe10c8d685073d70632a82ede6d900fe39af11de2b9913f634a463049
Opcode Fuzzy Hash: 864de1e7452f1a057137727f9e932b628b9b3bcdc5dceea8be44cc60f45b8d94
Instruction Fuzzy Hash: B1E15275910208ABCB14EBA1DD96EEE773ABF14305F11415EF107B6091DF38AE85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404540 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004045D5
StrCmpCA.SHLWAPI(?,0084DAE0), ref: 004045FA
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040477A
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,0041D797,00000000,?,?,00000000,?,",00000000,?,0084DB30), ref: 00404AA8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00404AC4
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404AD8
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404B09
InternetCloseHandle.WININET(00000000), ref: 00404B6D
InternetCloseHandle.WININET(00000000), ref: 00404B85
HttpOpenRequestA.WININET(00000000,0084DAF0,?,008563D0,00000000,00000000,00400100,00000000), ref: 004047D5

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

InternetCloseHandle.WININET(00000000), ref: 00404B8F

Strings

", xrefs: 004048B2
------, xrefs: 004047E8
------, xrefs: 0040467D
------, xrefs: 00404929
", xrefs: 004049F3
8me, xrefs: 004047A5

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------$8me
API String ID: 460715078-2873308080
Opcode ID: 853a4cbacb1dee6eb8c2f9915093d98e07e2b8056c9e0bbb2b53a05045891e61
Instruction ID: e2fbf7176fc7eb33215a1d8fdd4a82cafc16ed7ff926df7fa74fdc4e30892001
Opcode Fuzzy Hash: 853a4cbacb1dee6eb8c2f9915093d98e07e2b8056c9e0bbb2b53a05045891e61
Instruction Fuzzy Hash: F21252769102189ACB14EB91DC92FDEB739AF54308F51419EF10672491DF38AF89CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00414AE0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 179
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

RegOpenKeyExA.KERNEL32(00000000,00852E88,00000000,00020019,00000000,0041D289), ref: 00414B41
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
wsprintfA.USER32 ref: 00414BF6
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
RegCloseKey.ADVAPI32(00000000), ref: 00414C29
RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Strings

%s\%s, xrefs: 00414BEA
- , xrefs: 00414D40
?, xrefs: 00414B17

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 3e9fb061c04a9605c9a65a09a1dbda51e218e145c49de32192a0627cbf0d7212
Instruction ID: fbc8112ab3bfbfb2fdc98052a2813d45c496b4d84dbcb1503bfdf8522ef193f5
Opcode Fuzzy Hash: 3e9fb061c04a9605c9a65a09a1dbda51e218e145c49de32192a0627cbf0d7212
Instruction Fuzzy Hash: F1712A7590021C9BDB64DB60DD91FDA77B9BF88304F0086D9A109A6180DF74AFCACF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040F630 Relevance: 19.8, APIs: 13, Instructions: 298
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strtok_s.MSVCRT ref: 0040F667
strtok_s.MSVCRT ref: 0040FA8F

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,0084A930,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: bfa52de86468f06c75ce6d1a715682b1cd9076c0a6941fb9bd0619d7694f907c
Instruction ID: 2b3dd8003c7db60ae6f20250f168b485c10b0cdbdb2f80ad8031a0e3e82ebbeb
Opcode Fuzzy Hash: bfa52de86468f06c75ce6d1a715682b1cd9076c0a6941fb9bd0619d7694f907c
Instruction Fuzzy Hash: B4C1A7B5900619DBCB24EF60DC89FDA7779AF58304F00459EE40DA7191DB34AAC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004012D0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004012E7

Part of subcall function 00401260: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 00401274
Part of subcall function 00401260: HeapAlloc.KERNEL32(00000000), ref: 0040127B
Part of subcall function 00401260: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00401297
Part of subcall function 00401260: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012B5
Part of subcall function 00401260: RegCloseKey.ADVAPI32(?), ref: 004012BF

lstrcat.KERNEL32(?,00000000), ref: 0040130F
lstrlen.KERNEL32(?), ref: 0040131C
lstrcat.KERNEL32(?,.keys), ref: 00401337

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,0084FF90,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401425

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

DeleteFileA.KERNEL32(00000000), ref: 004014A9
memset.MSVCRT ref: 004014D0

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,0084DAE0), ref: 00404ED9

Strings

.keys, xrefs: 0040132B
SOFTWARE\monero-project\monero-core, xrefs: 004012F5
wallet_path, xrefs: 004012F0
\Monero\wallet.keys, xrefs: 0040134D

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$lstrlen$AllocCloseHeapLocalOpenmemset$ChangeCopyCreateDeleteFindFreeInternetNotificationProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 2054947926-218353709
Opcode ID: 9ae588697d4344aac403a7a24d8629294b3db2b46eacc33d10e068d7cf86aa98
Instruction ID: 465d6e3be360dc7981781b6de12631b9db2cd28431e3bfe2701297f35846b4c8
Opcode Fuzzy Hash: 9ae588697d4344aac403a7a24d8629294b3db2b46eacc33d10e068d7cf86aa98
Instruction Fuzzy Hash: DD5123B195021897CB15EB61DD92BED773D9F54304F4041EDB60A62091DE385BC5CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00406FA0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406CA0: memset.MSVCRT ref: 00406CE4
Part of subcall function 00406CA0: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00406D0A
Part of subcall function 00406CA0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00406D81
Part of subcall function 00406CA0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00406DDD
Part of subcall function 00406CA0: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E22
Part of subcall function 00406CA0: HeapFree.KERNEL32(00000000,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E29

lstrcat.KERNEL32(2D1F9020,0041DEB8), ref: 00406FD6
lstrcat.KERNEL32(2D1F9020,00000000), ref: 00407018
lstrcat.KERNEL32(2D1F9020, : ), ref: 0040702A
lstrcat.KERNEL32(2D1F9020,00000000), ref: 0040705F
lstrcat.KERNEL32(2D1F9020,0041DEC0), ref: 00407070
lstrcat.KERNEL32(2D1F9020,00000000), ref: 004070A3
lstrcat.KERNEL32(2D1F9020,0041DEC4), ref: 004070BD
task.LIBCPMTD ref: 004070CB

Strings

`v@, xrefs: 00406FAF, 004070C8, 00406FFE, 00407034, 0040707C, 00407045, 00406FB2
h0A, xrefs: 00406FA6, 00406FA9
: , xrefs: 0040701E

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: : $`v@$h0A
API String ID: 3191641157-3559972273
Opcode ID: 22c65c759e4008ac886b6aeda8a47d70719bcccf3909e077351c77a1654b374d
Instruction ID: d9fe8ddf8edd41d5d79e2c2aa3549d60ad86c8a123fe42dd1537da3b5299582f
Opcode Fuzzy Hash: 22c65c759e4008ac886b6aeda8a47d70719bcccf3909e077351c77a1654b374d
Instruction Fuzzy Hash: 4B318371E05504ABCB14EBA0DD99EFF7B75BF44305B104519F102BB290DA38BD46CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00415710 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

image/jpeg, xrefs: 00415836

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID:
String ID: image/jpeg
API String ID: 0-3785015651
Opcode ID: ebc458d2954fa87928cbffb1aa81fa40cba8a6fc2b0c4bc732e2d226e351cda2
Instruction ID: 4e1e11a2c406ea1305e74ab4ef0d66e5904d243d4ada77d8c1e4b1ca7303bf9d
Opcode Fuzzy Hash: ebc458d2954fa87928cbffb1aa81fa40cba8a6fc2b0c4bc732e2d226e351cda2
Instruction Fuzzy Hash: 30714CB5910608EBDB14EFE4EC85FEEB7B9BF48300F108509F515A7290DB38A945CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00406CA0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00406CE4
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00406D0A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00406D81
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00406DDD
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E22
HeapFree.KERNEL32(00000000,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406E29

Part of subcall function 00408C20: vsprintf_s.MSVCRT ref: 00408C3B

task.LIBCPMTD ref: 00406F25

Strings

Password, xrefs: 00406DD1

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: e5b433d59e683e3853dabaec4553a197e9f76ed1b5df22dde85a26ca8bf12c56
Instruction ID: 212e66a44237aadac39c144ffd634e87161c2b2b5cb707631054264fe3c499ea
Opcode Fuzzy Hash: e5b433d59e683e3853dabaec4553a197e9f76ed1b5df22dde85a26ca8bf12c56
Instruction Fuzzy Hash: 4F613FB5D042589BDB24DB50CC45BDAB7B8BF44304F0081EAE64AA6281DF746FC9CF95

Uniqueness

Uniqueness Score: -1.00%

Function 004141C0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004141DF
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041421C
GetProcessHeap.KERNEL32(00000000,00000104), ref: 004142A0
HeapAlloc.KERNEL32(00000000), ref: 004142A7
wsprintfA.USER32 ref: 004142DD

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Strings

:, xrefs: 004141F9
\, xrefs: 004141FD
C, xrefs: 004141E9

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 6ca11245975395cfb749b767d31339a8af53aa26318921bdecc0eb4ed934f432
Instruction ID: 52054a8b39965f6583c41ffabf349f0ba0ed2356e3a02770a6039194ee1378f4
Opcode Fuzzy Hash: 6ca11245975395cfb749b767d31339a8af53aa26318921bdecc0eb4ed934f432
Instruction Fuzzy Hash: BA3194B0D00258EBDF20DFA4DC45BEE77B4AF48304F104099F5496B281DB78AAD5CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004093A0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
LocalAlloc.KERNEL32(00000040,?), ref: 00409411
ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
LocalFree.KERNEL32('@), ref: 00409470
FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Strings

'@, xrefs: 004093C3, 00409486
'@, xrefs: 00409426, 00409449, 00409429, 0040946F

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: File$Local$AllocChangeCloseCreateFindFreeNotificationReadSize
String ID: '@$'@
API String ID: 1815715184-345573653
Opcode ID: 48f4b7413470cb3276c60afe27c6050599c7e1b25b920e3e6a5c65917fe61f9c
Instruction ID: e17ca2bf8fb39da35cf654cfb04ed30359ebe63801e33f8f777122e55a65d6c5
Opcode Fuzzy Hash: 48f4b7413470cb3276c60afe27c6050599c7e1b25b920e3e6a5c65917fe61f9c
Instruction Fuzzy Hash: 0B31EA74A00209EFDB24DF94C885BAEB7B5BF48314F108169E915A73D0D778AD42CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414960 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,00854E50,00000000,?,0041D774,00000000,?,00000000,00000000,?,00855060), ref: 0041496D
HeapAlloc.KERNEL32(00000000), ref: 00414974
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00414995
__aulldiv.LIBCMT ref: 004149AF
__aulldiv.LIBCMT ref: 004149BD
wsprintfA.USER32 ref: 004149E9

Strings

@, xrefs: 0041498A
%d MB, xrefs: 004149E0

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: f62cb7ad2578be9c21b89e6e1bf921e4f1007482674ad6998ac9b57a816d1492
Instruction ID: f510475f390b20142bb5ad9b480526056b42ea6839ab7368ec165d8bd78ed5c1
Opcode Fuzzy Hash: f62cb7ad2578be9c21b89e6e1bf921e4f1007482674ad6998ac9b57a816d1492
Instruction Fuzzy Hash: 84111EB0D40208ABDB10DFE4CC49FAE77B8BB48704F104549F715BB284D7B8A9418B99

Uniqueness

Uniqueness Score: -1.00%

Function 00405D40 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404470: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
Part of subcall function 00404470: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

InternetOpenA.WININET(0041D7D3,00000001,00000000,00000000,00000000), ref: 00405DAF
StrCmpCA.SHLWAPI(?,0084DAE0), ref: 00405DE7
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00405E2F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00405E53
InternetReadFile.WININET(00410E73,?,00000400,?), ref: 00405E7C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00405EAA
CloseHandle.KERNEL32(?,?,00000400), ref: 00405EE9
InternetCloseHandle.WININET(00410E73), ref: 00405EF3
InternetCloseHandle.WININET(00000000), ref: 00405F00

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 8d9a3180b18a5efc90efd9d912cec60318239b29a62a7d3eda4b771ff523c89c
Instruction ID: 46018c2d0393d599e49b8942d3c4f4431f3cc1562104312217daf3d911a1fc92
Opcode Fuzzy Hash: 8d9a3180b18a5efc90efd9d912cec60318239b29a62a7d3eda4b771ff523c89c
Instruction Fuzzy Hash: DB514471A00618ABDB20DF51CC45BEF7779EB44305F1081AAB645B71C0DB78AB85CF99

Uniqueness

Uniqueness Score: -1.00%

Function 006A003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 006A024D

Strings

cess, xrefs: 006A018D
kernel32.dll, xrefs: 006A008F, 006A0095

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: edfa6b35737d46774f892f9e838a511c53124eeea6e349ba935a860513cbf214
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 0A526874A01229DFDB64CF58C985BA8BBB1BF09304F1480D9E94DAB351DB30AE95DF14

Uniqueness

Uniqueness Score: -1.00%

Function 00413D90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 00413D9E

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

OpenProcess.KERNEL32(001FFFFF,00000000,00413FCD,0041D28B), ref: 00413DDC
memset.MSVCRT ref: 00413E2A
??_V@YAXPAX@Z.MSVCRT ref: 00413F7E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00413E4C

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 136f340d3def94dd6f6bc6e7af2fbddae3deb45c6c7debbe56f20a408c524ea1
Instruction ID: ba4a912f34a6ab240f03399ec897c117189ceb9282cc0eaf369c81769a73d46f
Opcode Fuzzy Hash: 136f340d3def94dd6f6bc6e7af2fbddae3deb45c6c7debbe56f20a408c524ea1
Instruction Fuzzy Hash: 35513DB0D003189BDB24EF51DC45BEEBB75AB48309F5041AEE11966281DB386BC9CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040B250 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000), ref: 0040B44D

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040B47B
lstrlen.KERNEL32(00000000), ref: 0040B553
lstrlen.KERNEL32(00000000), ref: 0040B567

Strings

AccountId, xrefs: 0040B472
AccountTokens, xrefs: 0040B28A
SELECT service, encrypted_token FROM token_service, xrefs: 0040B3BB
AccountTokens, xrefs: 0040B319

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 2910778473-1079375795
Opcode ID: 4543dbf0c65a3e582f23e9b3de31716e87e77f40ab74fd4f2cb5c096989306e6
Instruction ID: df2f8e8a8ca21c55da42a3c6f19f5118b3684059388f817d0631ea5bb79e5354
Opcode Fuzzy Hash: 4543dbf0c65a3e582f23e9b3de31716e87e77f40ab74fd4f2cb5c096989306e6
Instruction Fuzzy Hash: 07A164759102089BCF14FBA1DC52EEE7739BF54308F51416EF506B2191EF38AA85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004136B0 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,00832940), ref: 00415F11
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,00832958), ref: 00415F2A
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,00832970), ref: 00415F42
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,008329A0), ref: 00415F5A
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,008328E0), ref: 00415F73
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,0084A880), ref: 00415F8B
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,0084C600), ref: 00415FA3
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,0084C5A0), ref: 00415FBC
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,00832988), ref: 00415FD4
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,00832910), ref: 00415FEC
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,008328F8), ref: 00416005
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,0084D720), ref: 0041601D
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,0084C5C0), ref: 00416035
Part of subcall function 00415ED0: GetProcAddress.KERNEL32(74DD0000,0084D930), ref: 0041604E

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011D1

Part of subcall function 00401120: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,004136D7,0041D6E3), ref: 0040112A
Part of subcall function 00401120: ExitProcess.KERNEL32 ref: 0040113E

Part of subcall function 004010D0: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004136DC), ref: 004010EB
Part of subcall function 004010D0: VirtualAllocExNuma.KERNEL32(00000000,?,?,004136DC), ref: 004010F2
Part of subcall function 004010D0: ExitProcess.KERNEL32 ref: 00401103

Part of subcall function 004011E0: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004011FE
Part of subcall function 004011E0: __aulldiv.LIBCMT ref: 00401218
Part of subcall function 004011E0: __aulldiv.LIBCMT ref: 00401226
Part of subcall function 004011E0: ExitProcess.KERNEL32 ref: 00401254

Part of subcall function 00413430: GetUserDefaultLangID.KERNEL32(?,?,004136E6,0041D6E3), ref: 00413434

GetUserDefaultLangID.KERNEL32 ref: 004136E6

Part of subcall function 00401150: ExitProcess.KERNEL32 ref: 00401186

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,0084DCB0,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,0084A930,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 0041378A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004137A8
CloseHandle.KERNEL32(00000000), ref: 004137B9
Sleep.KERNEL32(00001770), ref: 004137C4
CloseHandle.KERNEL32(?,00000000,?,0084A930,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 004137DA
ExitProcess.KERNEL32 ref: 004137E2

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleLangName__aulldiv$ComputerCreateCurrentGlobalInfoMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 1125299040-0
Opcode ID: 5486d5c946202db060aa549aabbb0e31a90ba7885bf774990f2204c0f83205b9
Instruction ID: 0037ec1138340b95bb434dc328289296f16cab3c571637fdb93d627daa89b4d0
Opcode Fuzzy Hash: 5486d5c946202db060aa549aabbb0e31a90ba7885bf774990f2204c0f83205b9
Instruction Fuzzy Hash: 7E318270A00204AADB04FBF2DC56BEE7779AF08708F10451EF112A61D2DF789A85C7AD

Uniqueness

Uniqueness Score: -1.00%

Function 00414B79 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 59registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
wsprintfA.USER32 ref: 00414BF6
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
RegCloseKey.ADVAPI32(00000000), ref: 00414C29
RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

RegQueryValueExA.KERNEL32(00000000,008550A8,00000000,000F003F,?,00000400), ref: 00414C89
lstrlen.KERNEL32(?), ref: 00414C9E
RegQueryValueExA.KERNEL32(00000000,00855090,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,0041D4B4), ref: 00414D36
RegCloseKey.KERNEL32(00000000), ref: 00414DA5
RegCloseKey.ADVAPI32(00000000), ref: 00414DB7

Strings

%s\%s, xrefs: 00414BEA

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 49bd180f3d19f789d073d9977c9b899b153d1fd3672ba65f9cf7a2d2756c86b8
Instruction ID: d244d91c33a18a5b0a6d9a0a642cdc181f43283702d6765b4fd500d7f5e12fa2
Opcode Fuzzy Hash: 49bd180f3d19f789d073d9977c9b899b153d1fd3672ba65f9cf7a2d2756c86b8
Instruction Fuzzy Hash: 59213875A0021CABDB64CB50DC85FE973B9BF88300F0085D9A649A6180DF74AAC6CFE4

Uniqueness

Uniqueness Score: -1.00%

Function 00411D80 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00411DA5
RegOpenKeyExA.ADVAPI32(80000001,008555A8,00000000,00020119,?), ref: 00411DC4
RegQueryValueExA.ADVAPI32(?,008561F0,00000000,00000000,00000000,000000FF), ref: 00411DE8
RegCloseKey.ADVAPI32(?), ref: 00411DF2
lstrcat.KERNEL32(?,00000000), ref: 00411E17
lstrcat.KERNEL32(?,00856160), ref: 00411E2B

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: bf11c5f64fb992b3c772fe614ac28ac6fc491ab679ab64900ab2a626250608f3
Instruction ID: 8aed71b150b2ed53c6c52757a29982c6d8c6785b9d22af2673d92710ece34b21
Opcode Fuzzy Hash: bf11c5f64fb992b3c772fe614ac28ac6fc491ab679ab64900ab2a626250608f3
Instruction Fuzzy Hash: F641B4B2900108BBCB15EBE0DC86FEE733EAB88745F00454DF71A5A191EE7467848BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00409B30 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,0084FF90,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00409BB1
lstrlen.KERNEL32(00000000), ref: 00409F6A

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000,00000000), ref: 00409CAD
DeleteFileA.KERNEL32(00000000), ref: 00409FEB

Strings

X@, xrefs: 00409BC4, 00409BF0, 00409FCD, 00409BC7, 00409BF3, 00409FD0

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID: X@
API String ID: 3258613111-2850556465
Opcode ID: e5a3001f3296a231038eb4ec53be552a03ebdcb7715211663cf3d4af6234eac9
Instruction ID: 70962d3f4e1e977daa55f2855abdfba287f36735b870bb76fdd61a7d9847a281
Opcode Fuzzy Hash: e5a3001f3296a231038eb4ec53be552a03ebdcb7715211663cf3d4af6234eac9
Instruction Fuzzy Hash: BCD10376D101089ACB14FBA5DC91EEE7739BF14304F51825EF51672091EF38AA89CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 00410FA0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 251COMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,0084FF90,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

ShellExecuteEx.SHELL32(0000003C), ref: 00411307

Strings

C:\Windows\system32\rundll32.dll, xrefs: 004110BF
"" , xrefs: 004111DC
.dll, xrefs: 00411054
<, xrefs: 004112AC

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteFolderPathShellSystemTimelstrlen
String ID: "" $.dll$<$C:\Windows\system32\rundll32.dll
API String ID: 672783590-3078973353
Opcode ID: a07d57ab626bec1e9bb91ae9fe6835728cf1383923805aea1beb085de4d55527
Instruction ID: ff393b419b3d9cd89bf84e2a65158e8723a283ad60ef2a05342f0777a40cb69c
Opcode Fuzzy Hash: a07d57ab626bec1e9bb91ae9fe6835728cf1383923805aea1beb085de4d55527
Instruction Fuzzy Hash: 19A124759101089ACB15FB91DC92FDEB739AF14304F51425FE10666095EF38ABCACFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004123F0 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00855108), ref: 0041244B

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 00412471
lstrcat.KERNEL32(?,?), ref: 00412490
lstrcat.KERNEL32(?,?), ref: 004124A4
lstrcat.KERNEL32(?,00850268), ref: 004124B7
lstrcat.KERNEL32(?,?), ref: 004124CB
lstrcat.KERNEL32(?,00855588), ref: 004124DF

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00415490: GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041549F

Part of subcall function 004121F0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00412200
Part of subcall function 004121F0: HeapAlloc.KERNEL32(00000000), ref: 00412207
Part of subcall function 004121F0: wsprintfA.USER32 ref: 00412223
Part of subcall function 004121F0: FindFirstFileA.KERNEL32(?,?), ref: 0041223A

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: a8cdaff6348467220e46ecbe5bbad888972f2388953b3a41efaa7fa85cce1e20
Instruction ID: 26a05e4f659b4c4b868bb0234a0ad995871bbc4a3af1f84cd303f322fad0653f
Opcode Fuzzy Hash: a8cdaff6348467220e46ecbe5bbad888972f2388953b3a41efaa7fa85cce1e20
Instruction Fuzzy Hash: 083164B6900608A7CB20FBB0DC95EE9773DAB48704F40458EB3469A051EA7897C8CFD8

Uniqueness

Uniqueness Score: -1.00%

Function 004011E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004011FE
__aulldiv.LIBCMT ref: 00401218
__aulldiv.LIBCMT ref: 00401226
ExitProcess.KERNEL32 ref: 00401254

Strings

@, xrefs: 004011F3

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: bb81cb4acda70f26030c3c2501203c3bf716c46d07ed01ddf58a3b899f1b5564
Instruction ID: 7bcd30568b3a9749f5c78c38f6ef54fea4689c821e8202ed383253ad67bcf250
Opcode Fuzzy Hash: bb81cb4acda70f26030c3c2501203c3bf716c46d07ed01ddf58a3b899f1b5564
Instruction Fuzzy Hash: 8601FFB0940208EADB10EFD0CD4AB9EBBB8AB54705F204059E705B62D0D6785545875D

Uniqueness

Uniqueness Score: -1.00%

Function 00412980 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 004129BA
lstrcat.KERNEL32(?,0041D888), ref: 004129D7
lstrcat.KERNEL32(?,0084DB10), ref: 004129EB
lstrcat.KERNEL32(?,0041D88C), ref: 004129FD

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNELBASE(?,?), ref: 004125A0

Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
Part of subcall function 00412570: FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
Part of subcall function 00412570: FindClose.KERNEL32(000000FF), ref: 004127CE

Strings

L0A, xrefs: 00412A22, 00412A51, 00412A73, 00412A25, 00412A54

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID: L0A
API String ID: 2667927680-1482484291
Opcode ID: 2d500382a6aefc514482708f61bb6bbe5345368defb784e312ba9a838cac8a8b
Instruction ID: f34e92357168eddbedcb052ffd5f2c6281475bb6170069d81cff4dd89e8051f4
Opcode Fuzzy Hash: 2d500382a6aefc514482708f61bb6bbe5345368defb784e312ba9a838cac8a8b
Instruction Fuzzy Hash: A621CCBA9005087BC724FBA0DD46EDA373E9B54745F00058AB64956081EE7867C48BD5

Uniqueness

Uniqueness Score: -1.00%

Function 00401260 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 00401274
HeapAlloc.KERNEL32(00000000), ref: 0040127B
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 00401297
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012B5
RegCloseKey.ADVAPI32(?), ref: 004012BF

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: df6da7dedf044903e367d3d8a7ae0c03a7d74832a2c3d67e0360b54011cb2cfc
Instruction ID: 7bc2c45b39987af01ac2684a9b0918313f40fb8da876f9e4b9d967da472c28c8
Opcode Fuzzy Hash: df6da7dedf044903e367d3d8a7ae0c03a7d74832a2c3d67e0360b54011cb2cfc
Instruction Fuzzy Hash: 3C011D79A40608BFDB20DFE0DD49FAEB779AB88700F008159FA05E7280DA749A018B90

Uniqueness

Uniqueness Score: -1.00%

Function 00414740 Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414754
HeapAlloc.KERNEL32(00000000), ref: 0041475B
RegOpenKeyExA.KERNEL32(80000002,00850918,00000000,00020119,00000000), ref: 0041477B
RegQueryValueExA.KERNEL32(00000000,008552E8,00000000,00000000,000000FF,000000FF), ref: 0041479C
RegCloseKey.ADVAPI32(00000000), ref: 004147A6

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 3dd853a6faa74efcafe4ce3258c312c5c269cfcf31c2ef5712d88dc1f31cf0da
Instruction ID: 520453153fef2218f7e1f18e9bcc50e310f062f1fe861ea372c3465721436b4a
Opcode Fuzzy Hash: 3dd853a6faa74efcafe4ce3258c312c5c269cfcf31c2ef5712d88dc1f31cf0da
Instruction Fuzzy Hash: 62013C79A40608FFDB20DBE4ED49FAEB779EB88700F108159FA05A6290DB705A018F90

Uniqueness

Uniqueness Score: -1.00%

Function 00414300 Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414314
HeapAlloc.KERNEL32(00000000), ref: 0041431B
RegOpenKeyExA.KERNEL32(80000002,00850BB8,00000000,00020119,00000000), ref: 0041433B
RegQueryValueExA.KERNEL32(00000000,00854DD8,00000000,00000000,000000FF,000000FF), ref: 0041435C
RegCloseKey.ADVAPI32(00000000), ref: 00414366

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 423f413abd2b9c08310d568d7ed0a8882adbdfbf2920ff6ae677e6fc83315809
Instruction ID: 8a55c6bb4586fa39bc5dd89715e436abefd5940c4b9bd8db073c1251d6bd8ac1
Opcode Fuzzy Hash: 423f413abd2b9c08310d568d7ed0a8882adbdfbf2920ff6ae677e6fc83315809
Instruction Fuzzy Hash: E3014FB5A40608BFDB20DBE4ED49FAEB77DEB88701F005154FA05E7290DB70AA01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00409970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(0084DDD0,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,0040EA16), ref: 0040998D
LoadLibraryA.KERNEL32(00855308,?,?,?,?,?,?,?,?,?,?,?,0040EA16), ref: 00409A16

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,0084A930,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

SetEnvironmentVariableA.KERNEL32(0084DDD0,00000000,00000000,?,0041DA4C,?,0040EA16,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0041D6EF), ref: 00409A02

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 00409982, 00409996, 004099AC

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 55accc08cbdc497e5ef70485d8de4a58ce1b26e6e6fc77b12ff6cea411d4f92c
Instruction ID: 6647cd3c00128b620a4a232c7fbe97fce3d03bd073b05a107f0d1bf2b4fd60a8
Opcode Fuzzy Hash: 55accc08cbdc497e5ef70485d8de4a58ce1b26e6e6fc77b12ff6cea411d4f92c
Instruction Fuzzy Hash: 134196B5900A009BDB24DFA4FD85AAE37B6BB44305F01512EF405A72E2DFB89D46CF54

Uniqueness

Uniqueness Score: -1.00%

Function 004065D0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,@:h@,@:h@), ref: 0040668F

Strings

@:h@, xrefs: 00406670, 00406673
:h@, xrefs: 0040660D, 00406629, 00406678, 00406688, 004065F4, 00406618, 00406623
:h@, xrefs: 004065DD, 004065FD, 0040667F

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: :h@$:h@$@:h@
API String ID: 544645111-3492212131
Opcode ID: 3a0ba57e5e1d9d33aaf5f8e161c54dbb9d0ff39d4d0ab0475c83cdde206519fc
Instruction ID: 05c83ec730d02739dc9afbe7597ff905435882b08ae1c12394b3aafa6fe5c026
Opcode Fuzzy Hash: 3a0ba57e5e1d9d33aaf5f8e161c54dbb9d0ff39d4d0ab0475c83cdde206519fc
Instruction Fuzzy Hash: 272131B4A00208EFDB04CF85C544BAEBBB1FF48304F1185AAD406AB381D3399A91DF85

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEC0 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,0084FF90,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CF41
lstrlen.KERNEL32(00000000), ref: 0040D0DF
lstrlen.KERNEL32(00000000), ref: 0040D0F3
DeleteFileA.KERNEL32(00000000), ref: 0040D16C

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: d2c18f3acca398f1c1ec1da5f645802634ed54c89a853db2e742029b066f7987
Instruction ID: 64a31cdf4344fffa4b83296b1621afa9cae3fe45de11617b70f8002e61f1a089
Opcode Fuzzy Hash: d2c18f3acca398f1c1ec1da5f645802634ed54c89a853db2e742029b066f7987
Instruction Fuzzy Hash: 758147769102049BCB14FBA1DC52EEE7739BF54308F51411EF516B6091EF38AA89CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD10 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004141C0: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004141DF
Part of subcall function 004141C0: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041421C
Part of subcall function 004141C0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004142A0
Part of subcall function 004141C0: HeapAlloc.KERNEL32(00000000), ref: 004142A7

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00414300: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414314
Part of subcall function 00414300: HeapAlloc.KERNEL32(00000000), ref: 0041431B
Part of subcall function 00414300: RegOpenKeyExA.KERNEL32(80000002,00850BB8,00000000,00020119,00000000), ref: 0041433B
Part of subcall function 00414300: RegQueryValueExA.KERNEL32(00000000,00854DD8,00000000,00000000,000000FF,000000FF), ref: 0041435C
Part of subcall function 00414300: RegCloseKey.ADVAPI32(00000000), ref: 00414366

Part of subcall function 00414380: GetCurrentProcess.KERNEL32(00000000,?,?,0040FF99,00000000,?,00855388,00000000,?,0041D74C,00000000,?,00000000,00000000,?,0084DB60), ref: 0041438F
Part of subcall function 00414380: IsWow64Process.KERNEL32(00000000,?,?,0040FF99,00000000,?,00855388,00000000,?,0041D74C,00000000,?,00000000,00000000,?,0084DB60), ref: 00414396

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,0084DCB0,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 00414450: GetProcessHeap.KERNEL32(00000000,00000104,?,0041D748,00000000,?,00000000,0041D2B1), ref: 0041445D
Part of subcall function 00414450: HeapAlloc.KERNEL32(00000000), ref: 00414464
Part of subcall function 00414450: GetLocalTime.KERNEL32(?), ref: 00414471
Part of subcall function 00414450: wsprintfA.USER32 ref: 004144A0

Part of subcall function 004144B0: GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?,00854FD0,00000000,?,0041D758,00000000,?,00000000,00000000,?,00855568,00000000), ref: 004144C0
Part of subcall function 004144B0: HeapAlloc.KERNEL32(00000000), ref: 004144C7
Part of subcall function 004144B0: GetTimeZoneInformation.KERNEL32(?), ref: 004144DA

Part of subcall function 00414530: GetUserDefaultLocaleName.KERNEL32(00000000,00000055,00000000,00000000,?,00854FD0,00000000,?,0041D758,00000000,?,00000000,00000000,?,00855568,00000000), ref: 00414542

Part of subcall function 00414570: GetKeyboardLayoutList.USER32(00000000,00000000,0041D146), ref: 0041459E
Part of subcall function 00414570: LocalAlloc.KERNEL32(00000040,?), ref: 004145B6
Part of subcall function 00414570: GetKeyboardLayoutList.USER32(?,00000000), ref: 004145CA
Part of subcall function 00414570: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 0041461F
Part of subcall function 00414570: LocalFree.KERNEL32(00000000), ref: 004146DF

Part of subcall function 00414710: GetSystemPowerStatus.KERNEL32(00000000), ref: 0041471A

GetCurrentProcessId.KERNEL32(00000000,?,00855468,00000000,?,0041D76C,00000000,?,00000000,00000000,?,00854EE0,00000000,?,0041D768,00000000), ref: 0041037E

Part of subcall function 00415B70: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00415B84
Part of subcall function 00415B70: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00415BA5
Part of subcall function 00415B70: CloseHandle.KERNEL32(00000000), ref: 00415BAF

Part of subcall function 00414740: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00414754
Part of subcall function 00414740: HeapAlloc.KERNEL32(00000000), ref: 0041475B
Part of subcall function 00414740: RegOpenKeyExA.KERNEL32(80000002,00850918,00000000,00020119,00000000), ref: 0041477B
Part of subcall function 00414740: RegQueryValueExA.KERNEL32(00000000,008552E8,00000000,00000000,000000FF,000000FF), ref: 0041479C
Part of subcall function 00414740: RegCloseKey.ADVAPI32(00000000), ref: 004147A6

Part of subcall function 00414800: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00414846
Part of subcall function 00414800: GetLastError.KERNEL32 ref: 00414855

Part of subcall function 004147C0: GetSystemInfo.KERNEL32(00000000), ref: 004147CD
Part of subcall function 004147C0: wsprintfA.USER32 ref: 004147E3

Part of subcall function 00414960: GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,00854E50,00000000,?,0041D774,00000000,?,00000000,00000000,?,00855060), ref: 0041496D
Part of subcall function 00414960: HeapAlloc.KERNEL32(00000000), ref: 00414974
Part of subcall function 00414960: GlobalMemoryStatusEx.KERNEL32(00000040), ref: 00414995
Part of subcall function 00414960: __aulldiv.LIBCMT ref: 004149AF
Part of subcall function 00414960: __aulldiv.LIBCMT ref: 004149BD
Part of subcall function 00414960: wsprintfA.USER32 ref: 004149E9

Part of subcall function 00414ED0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00414F1C
Part of subcall function 00414ED0: HeapAlloc.KERNEL32(00000000), ref: 00414F23
Part of subcall function 00414ED0: wsprintfA.USER32 ref: 00414F3D

Part of subcall function 00414AE0: RegOpenKeyExA.KERNEL32(00000000,00852E88,00000000,00020019,00000000,0041D289), ref: 00414B41

Part of subcall function 00414AE0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00414BC3
Part of subcall function 00414AE0: wsprintfA.USER32 ref: 00414BF6
Part of subcall function 00414AE0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 00414C18
Part of subcall function 00414AE0: RegCloseKey.ADVAPI32(00000000), ref: 00414C29
Part of subcall function 00414AE0: RegCloseKey.ADVAPI32(00000000), ref: 00414C36

Part of subcall function 00414DE0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414E07
Part of subcall function 00414DE0: Process32First.KERNEL32(00000000,00000128), ref: 00414E1B
Part of subcall function 00414DE0: Process32Next.KERNEL32(00000000,00000128), ref: 00414E30
Part of subcall function 00414DE0: FindCloseChangeNotification.KERNEL32(00000000), ref: 00414E9E

lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041095B

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,0084DAE0), ref: 00404ED9

Strings

E.A, xrefs: 00410981, 004109AC, 00410984

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$CloseOpen$wsprintf$Namelstrcpy$InformationLocallstrlen$CurrentInfoKeyboardLayoutListLocaleProcess32QueryStatusSystemTimeUserValue__aulldivlstrcat$ChangeComputerCreateDefaultDirectoryEnumErrorFileFindFirstFreeGlobalHandleInternetLastLogicalMemoryModuleNextNotificationPowerProcessorSnapshotToolhelp32VolumeWindowsWow64Zone
String ID: E.A
API String ID: 1035121393-2211245587
Opcode ID: 983d53c0af656efc5d0e0a69acdfd826c7a20c936c2a3bd6d84d146e4394a727
Instruction ID: c29c4d19e1a1d8256a8b8cfc17993bd3f91cdea4a247a897ffed86f061f16859
Opcode Fuzzy Hash: 983d53c0af656efc5d0e0a69acdfd826c7a20c936c2a3bd6d84d146e4394a727
Instruction Fuzzy Hash: 9372B076D10118AACB15FB91EC91EDEB73DAF14308F51439FB01662491EF346B89CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00411350 Relevance: 6.1, APIs: 4, Instructions: 100stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00411378

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

strtok_s.MSVCRT ref: 0041146F

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,0084A930,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: b32dbd48fef6c991f24393565f536ea1b201fd5407d7c8f9d1c6b670b0949385
Instruction ID: bc44fb65e395c18893d79e2daadfc8d7f4384440e0cba23ba4018ddaa6f79c9f
Opcode Fuzzy Hash: b32dbd48fef6c991f24393565f536ea1b201fd5407d7c8f9d1c6b670b0949385
Instruction Fuzzy Hash: 04417175D00208DBCB04EFE5D855AEEBB75BF48304F00811EE51177290EB38AA85CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004096C0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415530: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00415552

StrStrA.SHLWAPI(00000000,00854B38), ref: 0040971B

Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 004094CF
Part of subcall function 004094A0: LocalAlloc.KERNEL32(00000040,?,?,?,00404BAE,00000000,?), ref: 004094E1
Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 0040950A
Part of subcall function 004094A0: LocalFree.KERNEL32(?,?,?,?,00404BAE,00000000,?), ref: 0040951F

memcmp.MSVCRT ref: 00409774

Part of subcall function 00409540: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409564
Part of subcall function 00409540: LocalAlloc.KERNEL32(00000040,00000000), ref: 00409583
Part of subcall function 00409540: LocalFree.KERNEL32(?), ref: 004095AF

Strings

, xrefs: 004097A3
DPAPI, xrefs: 0040976B

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$ChangeCloseCreateDataFindNotificationReadSizeUnprotectlstrcpymemcmp
String ID: $DPAPI
API String ID: 2647593125-1819349886
Opcode ID: 0f5c4bf38f16a5dc7c6c7dc1d4b3af3428d24ec323dc2f9b096cad114df4e3c7
Instruction ID: 25d6f3248392bfa9bca68fd769027b68fff5740b7e0b7820d89104a1b18a6e16
Opcode Fuzzy Hash: 0f5c4bf38f16a5dc7c6c7dc1d4b3af3428d24ec323dc2f9b096cad114df4e3c7
Instruction Fuzzy Hash: 493141B6D10108EBCF04DF94DC45AEFB7B9AF48704F14452DE905B3292E7389A44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00414DE0 Relevance: 6.1, APIs: 4, Instructions: 60processCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00414E07
Process32First.KERNEL32(00000000,00000128), ref: 00414E1B
Process32Next.KERNEL32(00000000,00000128), ref: 00414E30

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindCloseChangeNotification.KERNEL32(00000000), ref: 00414E9E

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 3491751439-0
Opcode ID: b8759d5154ae2d28bcbc99cc88bbe7149ec19c0eac80e712cea3ae222087789a
Instruction ID: b51d58226d22fc07b4aaea4bdcaba1b12d12dab42e387443cd86e66b2ce9f1c4
Opcode Fuzzy Hash: b8759d5154ae2d28bcbc99cc88bbe7149ec19c0eac80e712cea3ae222087789a
Instruction Fuzzy Hash: ED211D759002189BCB24EB61DC95FDEB779AF54304F1041DAA50A66190DF38AFC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004159E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00411879,80000000,00000003,00000000,00000003,00000080,00000000,?,00411879,?), ref: 004159FC
GetFileSizeEx.KERNEL32(000000FF,00411879), ref: 00415A19
CloseHandle.KERNEL32(000000FF), ref: 00415A27

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: f3a5877fc348a9a64368c001e27037213673241a1fda354ede690d4ee948c5a4
Instruction ID: adbcd47bb22ca6d6b42933acd4cabc8e10c5a14c322029dfd4b487fe3fd33794
Opcode Fuzzy Hash: f3a5877fc348a9a64368c001e27037213673241a1fda354ede690d4ee948c5a4
Instruction Fuzzy Hash: C9F03139F44604FBDB20DBF0DC85BDE7779BF44710F118255B951A7280DA7496428B44

Uniqueness

Uniqueness Score: -1.00%

Function 004137B3 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,0084A930,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 0041378A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 004137A8
CloseHandle.KERNEL32(00000000), ref: 004137B9
Sleep.KERNEL32(00001770), ref: 004137C4
CloseHandle.KERNEL32(?,00000000,?,0084A930,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 004137DA
ExitProcess.KERNEL32 ref: 004137E2

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: b72d18ed1bdfc85c434ab68d1be83dc3fedaf905ff30e20f0e2c3bf58e55dee1
Instruction ID: 00ad45554361a1bf9ffb836df5d455c5d00fe00f471bf70531fad30136aebd8c
Opcode Fuzzy Hash: b72d18ed1bdfc85c434ab68d1be83dc3fedaf905ff30e20f0e2c3bf58e55dee1
Instruction Fuzzy Hash: 5FF054B0944206AAE720AFA1DD05BFE7675BB08B46F10851AF612951C0DBB856818A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00406730 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

Pi@, xrefs: 0040684E, 0040689F, 00406884, 004067C2, 0040679E

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID:
String ID: Pi@
API String ID: 0-1360946908
Opcode ID: 8cfa37973c56b3597612bf0eabde1d0c10c792fef38bbd1cab651f123bbbde38
Instruction ID: 3e1b1374d11ee30af11b8018be346ecc1401931fa3badc01db0dac5c56ce0c6a
Opcode Fuzzy Hash: 8cfa37973c56b3597612bf0eabde1d0c10c792fef38bbd1cab651f123bbbde38
Instruction Fuzzy Hash: 756105B5D00208DBDB14DF94D984BEEB7B0AB48304F1185AAE80677380D739AEA5DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00404470 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 00414FF0: malloc.MSVCRT ref: 00414FF8

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004044F6
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404506

Strings

<, xrefs: 00404489

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlenmalloc
String ID: <
API String ID: 3848002758-4251816714
Opcode ID: 687962ccc4eae67d17fcff549de06531ab168f4bf6ac0391c2f29faedae00af7
Instruction ID: 4ed07355fbd84ea2b0e25782c0c6f45789bb77a73037a8222357df496ca5bcbd
Opcode Fuzzy Hash: 687962ccc4eae67d17fcff549de06531ab168f4bf6ac0391c2f29faedae00af7
Instruction Fuzzy Hash: 52216DB1D00208ABDF10EFA5E845BDD7B74AB44324F008229FA25B72C0EB346A46CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF80 Relevance: 4.7, APIs: 3, Instructions: 197COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0084DE60), ref: 0040EFCE
StrCmpCA.SHLWAPI(00000000,0084DC50), ref: 0040F06F
StrCmpCA.SHLWAPI(00000000,0084DC80), ref: 0040F17E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 58e117ed942178d4e2b5918e720374e4b364d4b0e00a122cb00bcdae5759889d
Instruction ID: 4355cab003f180362ea4467312be264c8b2230b95154913c46dc9b5fce20c885
Opcode Fuzzy Hash: 58e117ed942178d4e2b5918e720374e4b364d4b0e00a122cb00bcdae5759889d
Instruction Fuzzy Hash: 8D719871B002099BCF08FF75D9929EEB77AAF94304B10852EF4099B285EA34DE45CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF9F Relevance: 4.7, APIs: 3, Instructions: 177COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0084DE60), ref: 0040EFCE
StrCmpCA.SHLWAPI(00000000,0084DC50), ref: 0040F06F
StrCmpCA.SHLWAPI(00000000,0084DC80), ref: 0040F17E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: bc4ca7363e0b186544a0861cbad811f215054c7319252584685de8f5c7f9862e
Instruction ID: f0c51ec5e8e6f52f2f367cc82315d09f99f950b48122d5325302ee48485a66a2
Opcode Fuzzy Hash: bc4ca7363e0b186544a0861cbad811f215054c7319252584685de8f5c7f9862e
Instruction Fuzzy Hash: 03618A71B002099FCF08EF75D9929EEB77AAF94304B10852EF4099B295DA34EE45CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 004127E0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 0041281A
lstrcat.KERNEL32(?,008553A8), ref: 00412838

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNELBASE(?,?), ref: 004125A0

Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D864), ref: 004125CE
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D868), ref: 004125E4
Part of subcall function 00412570: FindNextFileA.KERNEL32(000000FF,?), ref: 004127B9
Part of subcall function 00412570: FindClose.KERNEL32(000000FF), ref: 004127CE

Part of subcall function 00412570: wsprintfA.USER32 ref: 0041260A
Part of subcall function 00412570: StrCmpCA.SHLWAPI(?,0041D4B2), ref: 0041261C
Part of subcall function 00412570: wsprintfA.USER32 ref: 00412639
Part of subcall function 00412570: PathMatchSpecA.SHLWAPI(?,?), ref: 0041266F
Part of subcall function 00412570: lstrcat.KERNEL32(?,0084DAD0), ref: 0041269B
Part of subcall function 00412570: lstrcat.KERNEL32(?,0041D880), ref: 004126AD
Part of subcall function 00412570: lstrcat.KERNEL32(?,?), ref: 004126BE
Part of subcall function 00412570: lstrcat.KERNEL32(?,0041D884), ref: 004126D0
Part of subcall function 00412570: lstrcat.KERNEL32(?,?), ref: 004126E4
Part of subcall function 00412570: CopyFileA.KERNEL32(?,?,00000001), ref: 004126FA
Part of subcall function 00412570: DeleteFileA.KERNEL32(?), ref: 00412779

Part of subcall function 00412570: wsprintfA.USER32 ref: 0041265B

Strings

00A, xrefs: 0041285C, 0041288B, 004128BB, 004128EA, 0041291A, 00412949, 0041296B, 0041285F, 0041288E, 004128BE, 004128ED, 0041291D, 0041294C

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: 00A
API String ID: 2104210347-95910775
Opcode ID: aee14ac10de1ece76b3008eda533a8383be3bc2d628396bcb6b319180cdda7cd
Instruction ID: 9a839e9be304faf39bc4facc08b08f26c4420ed68fa3aa933a56f5c5bfc0aac5
Opcode Fuzzy Hash: aee14ac10de1ece76b3008eda533a8383be3bc2d628396bcb6b319180cdda7cd
Instruction Fuzzy Hash: 6441ABB7A001047BCB24FBE0DC92EEA377E9B94705F00424DB55987191ED74A7D48BD9

Uniqueness

Uniqueness Score: -1.00%

Function 00415B70 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00415B84
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00415BA5
CloseHandle.KERNEL32(00000000), ref: 00415BAF

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 97fc9d568dab5260ce1fa1a51ba1ebaf2853d767a04b83f08cd6b5726440208b
Instruction ID: b12b055c0fde6327b7bfc42128d307bcca402a5100f46dd347d8d84938e244fe
Opcode Fuzzy Hash: 97fc9d568dab5260ce1fa1a51ba1ebaf2853d767a04b83f08cd6b5726440208b
Instruction Fuzzy Hash: C5F05475A0010CFBDB14DFA4DC4AFED7778BB08300F004499BA0597280D6B06E85CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00414400 Relevance: 4.5, APIs: 3, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
HeapAlloc.KERNEL32(00000000), ref: 00414414
GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 6e220fa814439a9a47cb0e7b1b891ce31241d7c627682025937d03601ca1af04
Instruction ID: 2ac30a00ccf60c4f43266989ac8565747831d88261cb92d9c694311de33eed43
Opcode Fuzzy Hash: 6e220fa814439a9a47cb0e7b1b891ce31241d7c627682025937d03601ca1af04
Instruction Fuzzy Hash: F1E0D8B0A00608FBCB20DFE4DD48BDD77BCAB04305F100055FA05D3240D7749A458B96

Uniqueness

Uniqueness Score: -1.00%

Function 004010D0 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,004136DC), ref: 004010EB
VirtualAllocExNuma.KERNEL32(00000000,?,?,004136DC), ref: 004010F2
ExitProcess.KERNEL32 ref: 00401103

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: b1c8d233814077f36e701fc9dcba40fcf29c53b912e4e1fc8df77dce1fb5e496
Instruction ID: b86936f0f7b92ad6105a5e8d9325c57b614f4cde8fc05540e07f2d0ff83aec39
Opcode Fuzzy Hash: b1c8d233814077f36e701fc9dcba40fcf29c53b912e4e1fc8df77dce1fb5e496
Instruction Fuzzy Hash: 1BE0867098570CBBE7309BA0DD0AB1976689B08B06F101055F7097A1D0C6B425008699

Uniqueness

Uniqueness Score: -1.00%

Function 004119B0 Relevance: 3.1, APIs: 2, Instructions: 66stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004119C8

Part of subcall function 00411650: wsprintfA.USER32 ref: 00411669
Part of subcall function 00411650: FindFirstFileA.KERNEL32(?,?), ref: 00411680

strtok_s.MSVCRT ref: 00411A4D

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: strtok_s$FileFindFirstwsprintf
String ID:
API String ID: 3409980764-0
Opcode ID: 975833a798ef07385fb740c26f6e35f7306421425023d288693ea324a83a39c3
Instruction ID: 5fc3070f54b5ba386e916c7c3ae22cc6ad81f817c7a7f871d2ab45b9afc63085
Opcode Fuzzy Hash: 975833a798ef07385fb740c26f6e35f7306421425023d288693ea324a83a39c3
Instruction Fuzzy Hash: 19215471900108EBCB14FFA5CC55FED7B79AF44345F10805AF51A97151EB386B84CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00833D66 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00833D8E
Module32First.KERNEL32(00000000,00000224), ref: 00833DAE

Memory Dump Source

Source File: 0000000F.00000002.2877662329.0000000000833000.00000040.00000020.00020000.00000000.sdmp, Offset: 00833000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_833000_syncUpd.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: c60f21d246ac1a0c81adfc21883826f6346cb1ceb32601ea0eebfdc1e848ea46
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: C3F06231500714AFD7203AF9988DAAA76F8FF89725F10052CE642D50C0DA70ED454AA1

Uniqueness

Uniqueness Score: -1.00%

Function 00412B30 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,0084A930,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

lstrlen.KERNEL32(00000000,00000000,0041D599,?,?,?,?,?,?,00412FF8,?), ref: 00412B5A

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,0084DAE0), ref: 00404ED9

Strings

steam_tokens.txt, xrefs: 00412B6F

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$InternetOpen
String ID: steam_tokens.txt
API String ID: 2934705399-401951677
Opcode ID: 82664073c78b14407ff2a65fb01a5e155cda0900eabfa95e0a657889640af93c
Instruction ID: 10dd2298c38adeb5e36390c5bfe4eda46295fd03d88468a146a299c80adb3810
Opcode Fuzzy Hash: 82664073c78b14407ff2a65fb01a5e155cda0900eabfa95e0a657889640af93c
Instruction Fuzzy Hash: 18F08175D1020866CB18FBB2EC539ED773D9E54348B00425EF81662491EF38A788C6E9

Uniqueness

Uniqueness Score: -1.00%

Function 004147C0 Relevance: 3.0, APIs: 2, Instructions: 17COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00000000), ref: 004147CD
wsprintfA.USER32 ref: 004147E3

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: ae5762f0629c30c52eb39fe9d29b6f6254fbc8fd6ef0ba27fd947bac7523c98c
Instruction ID: d87a4f6b3ea3f44bdf221dc5e2fa01f01132d118a4d77551e5f155a4815ada85
Opcode Fuzzy Hash: ae5762f0629c30c52eb39fe9d29b6f6254fbc8fd6ef0ba27fd947bac7523c98c
Instruction Fuzzy Hash: FAD012B580020C5BD720DBD0ED49AE9B77DBB44204F4049A5EE1492140EBB96AD58AA5

Uniqueness

Uniqueness Score: -1.00%

Function 006A0E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000400,?,?,006A0223,?,?), ref: 006A0E19
SetErrorMode.KERNEL32(00000000,?,?,006A0223,?,?), ref: 006A0E1E

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: a812bd8a4e5226da291cda7890492f087020d928e330f1a56def5d4e73e5cff5
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 90D0123114512877DB003A94DC09BCD7B1CDF09B62F008451FB0DD9180C770994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACE0 Relevance: 2.9, APIs: 2, Instructions: 387stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrlen.KERNEL32(00000000), ref: 0040B190
lstrlen.KERNEL32(00000000), ref: 0040B1A4

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,0084DAE0), ref: 00404ED9

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocInternetLocalOpenmemcmpmemset
String ID:
API String ID: 574041509-0
Opcode ID: e0f77cc08d5d98a81d5571f042e1975c36a177702bc22a8723e8cc4c4f1379ca
Instruction ID: df99340f366afcb3d937a345db0e295b6fae9bf0b5ece921659d29683b3ff0c0
Opcode Fuzzy Hash: e0f77cc08d5d98a81d5571f042e1975c36a177702bc22a8723e8cc4c4f1379ca
Instruction Fuzzy Hash: 6CE114769101189BCF15EBA1DC92EEE773DBF54308F41415EF10676091EF38AA89CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A6E0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrlen.KERNEL32(00000000), ref: 0040A95A
lstrlen.KERNEL32(00000000), ref: 0040A96E

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,0084DAE0), ref: 00404ED9

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$InternetOpen
String ID:
API String ID: 3635112192-0
Opcode ID: 426461e22e03d3a32bea80746e852e19c4b3e87e43e2b072224c81007b217974
Instruction ID: 9f23dc4c71334aa449457ef7a0e8bbad4682aa92b3b7ddf60c673b4dae8ee631
Opcode Fuzzy Hash: 426461e22e03d3a32bea80746e852e19c4b3e87e43e2b072224c81007b217974
Instruction Fuzzy Hash: FC9149729102049BCF14FBA1DC51EEE773DBF54308F41425EF50666091EF38AA89CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA20 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

lstrlen.KERNEL32(00000000), ref: 0040AC1E
lstrlen.KERNEL32(00000000), ref: 0040AC32

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Part of subcall function 00404DC0: lstrlen.KERNEL32(00000000), ref: 00404E4A
Part of subcall function 00404DC0: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404EBB
Part of subcall function 00404DC0: StrCmpCA.SHLWAPI(?,0084DAE0), ref: 00404ED9

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$InternetOpen
String ID:
API String ID: 3635112192-0
Opcode ID: 72d2e3c97768df07163b87ec7f4638decbffd7336422c539a1f638d6c2c4a225
Instruction ID: 57c8c1270dba92ae3db9aa8e51dd660502e79bf125d10b7c0566732e7217b02b
Opcode Fuzzy Hash: 72d2e3c97768df07163b87ec7f4638decbffd7336422c539a1f638d6c2c4a225
Instruction Fuzzy Hash: C07153759102049BCF14FBA1DC52DEE7739BF54308F41422EF506A7191EF38AA89CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004114C0 Relevance: 2.6, APIs: 2, Instructions: 100COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00411550

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 46fcbcde96b391d8a91c7de27c3ae99c7866997ac8e62baa93d065818f15697d
Instruction ID: 8f9af232e05b2939ec69b712380268a2006cbed21c6953bc19412128f28bf8b7
Opcode Fuzzy Hash: 46fcbcde96b391d8a91c7de27c3ae99c7866997ac8e62baa93d065818f15697d
Instruction Fuzzy Hash: 0641F770A00A289FDB24DB58CC95BDBB7B5BB48702F4091C9A618A72E0D7716EC6CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00406050 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(004067AE,004067AE,00003000,00000040), ref: 004060F6
VirtualAlloc.KERNEL32(00000000,004067AE,00003000,00000040), ref: 00406143

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a813d0be407c7e97fb4ae0c443796924326960eff0d044c67b11f739482c465e
Instruction ID: 5341a9e810d76a35e886a0404415562c2a616bd51e9685e0b668c9c894d7d0dc
Opcode Fuzzy Hash: a813d0be407c7e97fb4ae0c443796924326960eff0d044c67b11f739482c465e
Instruction Fuzzy Hash: 8341DE34A00209EFCB54CF58C494BADBBB1FF44314F1482A9E95AAB395C735AA91CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00412A80 Relevance: 2.5, APIs: 2, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 00412ABA
lstrcat.KERNEL32(?,008551C8), ref: 00412AD8

Part of subcall function 00412570: wsprintfA.USER32 ref: 00412589
Part of subcall function 00412570: FindFirstFileA.KERNELBASE(?,?), ref: 004125A0

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID:
API String ID: 2699682494-0
Opcode ID: 1d26accb574f515a2d7fe8c0f6acd20ad4040f4671a96e47e9b6da3715607b39
Instruction ID: bcc253f25bf78e1a0e90404f031f6467c50b05fa57c941630bc3dd144581bb5c
Opcode Fuzzy Hash: 1d26accb574f515a2d7fe8c0f6acd20ad4040f4671a96e47e9b6da3715607b39
Instruction Fuzzy Hash: 8701B97A900608B7CB24FBB0DC47EDA773D9B54705F404189B64956091EE78AAC4CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00401060 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040110E,?,?,004136DC), ref: 00401073
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040110E,?,?,004136DC), ref: 004010B7

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 1fafdb83e91c72df66fc5e0dfbe5cc959ff82812f546fe48c521c8e5e261a801
Instruction ID: a2913bed729a6fe358320823385779fc3d8f71f1cc7b0a13f7ab4b92dd49de4a
Opcode Fuzzy Hash: 1fafdb83e91c72df66fc5e0dfbe5cc959ff82812f546fe48c521c8e5e261a801
Instruction Fuzzy Hash: 42F027B1641208BBE724DAF4AC59FAFF79CA745B05F304559F980E3390DA719F00CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 00415490 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041549F

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d7bf405bd421a40d19a8bf3ca1e3b15e31b56f02cda8d4317b7777f73d14c9f2
Instruction ID: 7a99a0210fb0b6ed6de77f6d22eec219e0a4aedfc9bcf57955c7481c69c901e8
Opcode Fuzzy Hash: d7bf405bd421a40d19a8bf3ca1e3b15e31b56f02cda8d4317b7777f73d14c9f2
Instruction Fuzzy Hash: 9BF01C70C00608EBCB10EF94C9457DDBB74AF44315F10829AD82957380DB395A85CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004154E0 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: c4deb19243b673a040dfd5fdc436edaecc4a41164842cb033ff61c0adf53a60f
Instruction ID: a2db4f6e5da6e8fb8430e81bb17b8e7aa1674d593408b434fe95881a23a64460
Opcode Fuzzy Hash: c4deb19243b673a040dfd5fdc436edaecc4a41164842cb033ff61c0adf53a60f
Instruction Fuzzy Hash: A8E01231A4034CABDB61DB90DC96FDD776C9B44B05F004295BA0C5A1C0DA70AB858BD1

Uniqueness

Uniqueness Score: -1.00%

Function 00401150 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00414400: GetProcessHeap.KERNEL32(00000000,00000104,004136EB,0041D6E3), ref: 0041440D
Part of subcall function 00414400: HeapAlloc.KERNEL32(00000000), ref: 00414414
Part of subcall function 00414400: GetComputerNameA.KERNEL32(?,00000104), ref: 0041442C

Part of subcall function 004143C0: GetProcessHeap.KERNEL32(00000000,00000104,00401177,0084DCB0,004136EB,0041D6E3), ref: 004143CD
Part of subcall function 004143C0: HeapAlloc.KERNEL32(00000000), ref: 004143D4
Part of subcall function 004143C0: GetUserNameA.ADVAPI32(?,00000104), ref: 004143EC

ExitProcess.KERNEL32 ref: 00401186

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: c5f9d553daa3d293cc675e83c5a49a4e0c2af81821706314cf681e3291f30800
Instruction ID: 69e00d56220517d966a61d162f3bbf9e0969f4784ba4f73569e39f9695f87914
Opcode Fuzzy Hash: c5f9d553daa3d293cc675e83c5a49a4e0c2af81821706314cf681e3291f30800
Instruction Fuzzy Hash: 78E012B5E1070462CA1573B27E06BD7729D5F9930EF40142AFE0497253FD2DE45145BD

Uniqueness

Uniqueness Score: -1.00%

Function 006A0920 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 006A0929

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: cf8f02fdaed65286ce872f3570c8b88d6c4cb2f13aa03d0d20e57ddf82142f08
Instruction ID: c020644df524c2f76e0858e256880dd47cc8058b9a19a2f123197d7715fd106d
Opcode Fuzzy Hash: cf8f02fdaed65286ce872f3570c8b88d6c4cb2f13aa03d0d20e57ddf82142f08
Instruction Fuzzy Hash: DA90026024516011D820259D0C01B5500122747634F3117507270B92D1C44197004115

Uniqueness

Uniqueness Score: -1.00%

Function 00833A25 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 00833A76

Memory Dump Source

Source File: 0000000F.00000002.2877662329.0000000000833000.00000040.00000020.00020000.00000000.sdmp, Offset: 00833000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_833000_syncUpd.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 84670bebcf2d5992cfedbf0a3e1acc7f87a1bcb8b9231231495b339531608a8d
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: DB112B79A00208EFDB01DF98C985E99BBF5EF08351F058094F9889B362D371EA90DF80

Uniqueness

Uniqueness Score: -1.00%

Function 00414FF0 Relevance: 1.3, APIs: 1, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

malloc.MSVCRT ref: 00414FF8

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: e14bb29f5c634f52acde74c2c6c6ee0589a433b3a794b1f7692ac0cd2af21e16
Instruction ID: 71a24ea012b18c325b39d17d5ea825459b0100de2daa219f1012b17ed67d7128
Opcode Fuzzy Hash: e14bb29f5c634f52acde74c2c6c6ee0589a433b3a794b1f7692ac0cd2af21e16
Instruction Fuzzy Hash: 1CC012B090410CEB8B00CF98EC0588A7BECDB08200B0041A4FC0DC3300D631AE1087D5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 006B18B7 Relevance: 30.2, APIs: 20, Instructions: 237filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006B18D0
FindFirstFileA.KERNEL32(?,?), ref: 006B18E7
lstrcat.KERNEL32(?,?), ref: 006B1939
StrCmpCA.SHLWAPI(?,0041D7F8), ref: 006B194B
StrCmpCA.SHLWAPI(?,0041D7FC), ref: 006B1961
FindNextFileA.KERNEL32(000000FF,?), ref: 006B1BE7
FindClose.KERNEL32(000000FF), ref: 006B1BFC

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID:
API String ID: 1125553467-0
Opcode ID: ad035d2452cfe8c571d31484953574fcc576d20caed83110d92fb8222da88d5d
Instruction ID: 89347dd9b28abfc16a4a47b28049f2bc9dbcdd0ff56060e62f4654289d23f15b
Opcode Fuzzy Hash: ad035d2452cfe8c571d31484953574fcc576d20caed83110d92fb8222da88d5d
Instruction Fuzzy Hash: A39181B1900618ABDB24EFA0CC95FEA737EBF44300F44458DB51A96180EB749BC5CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 004121F0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00412200
HeapAlloc.KERNEL32(00000000), ref: 00412207
wsprintfA.USER32 ref: 00412223
FindFirstFileA.KERNEL32(?,?), ref: 0041223A
StrCmpCA.SHLWAPI(?,0041D84C), ref: 00412268
StrCmpCA.SHLWAPI(?,0041D850), ref: 0041227E
FindNextFileA.KERNEL32(000000FF,?), ref: 004122FF
FindClose.KERNEL32(000000FF), ref: 00412314
lstrcat.KERNEL32(?,0084DAD0), ref: 00412339
lstrcat.KERNEL32(?,008555C8), ref: 0041234C
lstrlen.KERNEL32(?), ref: 00412359
lstrlen.KERNEL32(?), ref: 0041236A

Strings

%s\*, xrefs: 00412217
%s\%s, xrefs: 00412295

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 13328894-2848263008
Opcode ID: 0a12d10b0853cdca75f850272d177170673b34ecfbac75b41269a42e2db7d2f4
Instruction ID: 68eafe57ffc654504e5fb8166b756e3a47007b1446461b295be9b39175aa6662
Opcode Fuzzy Hash: 0a12d10b0853cdca75f850272d177170673b34ecfbac75b41269a42e2db7d2f4
Instruction Fuzzy Hash: 5551A6B5940618ABCB20EBB0DC89FEE737DAB98300F404689F61A96150DF749BC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 006B27D7 Relevance: 27.2, APIs: 18, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006B27F0
FindFirstFileA.KERNEL32(?,?), ref: 006B2807
StrCmpCA.SHLWAPI(?,0041D864), ref: 006B2835
StrCmpCA.SHLWAPI(?,0041D868), ref: 006B284B
FindNextFileA.KERNEL32(000000FF,?), ref: 006B2A20
FindClose.KERNEL32(000000FF), ref: 006B2A35

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 26faf157f702507331b55cdccac807b87ca62a28b2772986770582c89584f0b0
Instruction ID: 13ee6f75d8b980f5a253bd62fb50f09483b0778bbcfbbfc68423c45aff7fe0d7
Opcode Fuzzy Hash: 26faf157f702507331b55cdccac807b87ca62a28b2772986770582c89584f0b0
Instruction Fuzzy Hash: 156156B1900619ABDB24EBA0DD59EEA73BABF48700F00458DB60A96140EF749BC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 006B2457 Relevance: 22.6, APIs: 15, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 006B2467
RtlAllocateHeap.NTDLL(00000000), ref: 006B246E
wsprintfA.USER32 ref: 006B248A
FindFirstFileA.KERNEL32(?,?), ref: 006B24A1
StrCmpCA.SHLWAPI(?,0041D84C), ref: 006B24CF
StrCmpCA.SHLWAPI(?,0041D850), ref: 006B24E5
FindNextFileA.KERNEL32(000000FF,?), ref: 006B2566
FindClose.KERNEL32(000000FF), ref: 006B257B
lstrcat.KERNEL32(?,00624D04), ref: 006B25A0
lstrcat.KERNEL32(?,00624A28), ref: 006B25B3
lstrlen.KERNEL32(?), ref: 006B25C0
lstrlen.KERNEL32(?), ref: 006B25D1

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID:
API String ID: 671575355-0
Opcode ID: 3f2a756cd69fb0cc8e6f9d651b08e7a90b6bdcd432788a9239540e0f9b24c74c
Instruction ID: d1b5e8c4967cc82528fbced9fe7d6392b4e3bf03cd3c71c7ec5dc7f50039a826
Opcode Fuzzy Hash: 3f2a756cd69fb0cc8e6f9d651b08e7a90b6bdcd432788a9239540e0f9b24c74c
Instruction Fuzzy Hash: 0851A3B1940618ABCB20EBB0DC99FED777AAF58700F40458CB61A96180EF749BC5CF90

Uniqueness

Uniqueness Score: -1.00%

Function 006B1DE7 Relevance: 18.1, APIs: 12, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006B1E04
FindFirstFileA.KERNEL32(?,?), ref: 006B1E1B
StrCmpCA.SHLWAPI(?,0041D834), ref: 006B1E49
StrCmpCA.SHLWAPI(?,0041D838), ref: 006B1E5F
FindNextFileA.KERNEL32(000000FF,?), ref: 006B1FA4
FindClose.KERNEL32(000000FF), ref: 006B1FB9

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID:
API String ID: 180737720-0
Opcode ID: 292caba338b0fc5bb838edf58517bb1a85efe24c0dbfe2b158fc0bf7dc417963
Instruction ID: 11255693f0671b25663b878a7c5f58297fca237eba33228224dd1cead897673d
Opcode Fuzzy Hash: 292caba338b0fc5bb838edf58517bb1a85efe24c0dbfe2b158fc0bf7dc417963
Instruction Fuzzy Hash: CC516EF6900618BBCB24EBA0DC99EEA737EBF44300F44458DB65A96080DB759BC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0040D540 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,0041D746), ref: 0040D58E
StrCmpCA.SHLWAPI(?,0041DC28), ref: 0040D5DE
StrCmpCA.SHLWAPI(?,0041DC2C), ref: 0040D5F4
FindNextFileA.KERNEL32(000000FF,?), ref: 0040DB0A
FindClose.KERNEL32(000000FF), ref: 0040DB1C

Strings

\*.*, xrefs: 0040D556
[@, xrefs: 0040D562, 0040DB2A, 0040D623, 0040D5A5, 0040D626

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: [@$\*.*
API String ID: 2325840235-1445036518
Opcode ID: 76b44a9666336130cdde6967a73e8c7233724310df9b4d5251fd17b6a3714468
Instruction ID: 5086e1dd9f189559ddbff5738d7534b81ef4efc7c2da90a7a59429af0ff5c2f4
Opcode Fuzzy Hash: 76b44a9666336130cdde6967a73e8c7233724310df9b4d5251fd17b6a3714468
Instruction Fuzzy Hash: 27F1E3759142189ACB15FB61DC91EDE7739AF54304F8142DFA40A62091EF34AFC9CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 006AD427 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

Part of subcall function 006B7187: lstrcpy.KERNEL32(00000000,?), ref: 006B71D9
Part of subcall function 006B7187: lstrcat.KERNEL32(00000000), ref: 006B71E9

Part of subcall function 006B7217: lstrlen.KERNEL32(?,006249EC,?,004215A4,0041D7D6), ref: 006B722C
Part of subcall function 006B7217: lstrcpy.KERNEL32(00000000), ref: 006B726B
Part of subcall function 006B7217: lstrcat.KERNEL32(00000000,00000000), ref: 006B7279

Part of subcall function 006B7107: lstrcpy.KERNEL32(?,0041D7D6), ref: 006B716C

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0041DC10,0041D73F), ref: 006AD492
StrCmpCA.SHLWAPI(?,0041DC14), ref: 006AD4DA
StrCmpCA.SHLWAPI(?,0041DC18), ref: 006AD4F0
FindNextFileA.KERNEL32(000000FF,?), ref: 006AD755
FindClose.KERNEL32(000000FF), ref: 006AD767

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 9b431ad17454946b517c4100d9e0b82599836ab309f1ed7ac4e13ba255db2222
Instruction ID: 27bc989ab8586be0ea3f13d62276abb350b965e97ef93e8837cd00ce6ae4111f
Opcode Fuzzy Hash: 9b431ad17454946b517c4100d9e0b82599836ab309f1ed7ac4e13ba255db2222
Instruction Fuzzy Hash: 83916CB29042089BCB54FBB0DD569EE737AABC5300F00466DF90A96145EE34EB888B95

Uniqueness

Uniqueness Score: -1.00%

Function 006A1827 Relevance: 11.0, APIs: 7, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215C4,?,?,?,004215C8,?,?,00000000,?,00000000), ref: 006A1A7A
StrCmpCA.SHLWAPI(?,004215CC), ref: 006A1ACA
StrCmpCA.SHLWAPI(?,004215D0), ref: 006A1AE0
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006A1E97
DeleteFileA.KERNEL32(00000000), ref: 006A1F1B
FindNextFileA.KERNEL32(000000FF,?), ref: 006A1F71
FindClose.KERNEL32(000000FF), ref: 006A1F83

Part of subcall function 006B7187: lstrcpy.KERNEL32(00000000,?), ref: 006B71D9
Part of subcall function 006B7187: lstrcat.KERNEL32(00000000), ref: 006B71E9

Part of subcall function 006B7217: lstrlen.KERNEL32(?,006249EC,?,004215A4,0041D7D6), ref: 006B722C
Part of subcall function 006B7217: lstrcpy.KERNEL32(00000000), ref: 006B726B
Part of subcall function 006B7217: lstrcat.KERNEL32(00000000,00000000), ref: 006B7279

Part of subcall function 006B7107: lstrcpy.KERNEL32(?,0041D7D6), ref: 006B716C

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID:
API String ID: 1415058207-0
Opcode ID: 7951ecb2c0469ab767370ba59687eaf2907cca6d851c199fd70eeed7a365bc93
Instruction ID: 21bd51bd24482a2ffe85e31d7d6ecb8b2e504f6a5f6bb9325065ea174298e066
Opcode Fuzzy Hash: 7951ecb2c0469ab767370ba59687eaf2907cca6d851c199fd70eeed7a365bc93
Instruction Fuzzy Hash: B312DCF1904218AACB59FB60CCA6EED737AAF94300F40459EB10A66191EF346FC9CF55

Uniqueness

Uniqueness Score: -1.00%

Function 006AD7A7 Relevance: 10.9, APIs: 7, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

Part of subcall function 006B7217: lstrlen.KERNEL32(?,006249EC,?,004215A4,0041D7D6), ref: 006B722C
Part of subcall function 006B7217: lstrcpy.KERNEL32(00000000), ref: 006B726B
Part of subcall function 006B7217: lstrcat.KERNEL32(00000000,00000000), ref: 006B7279

Part of subcall function 006B7107: lstrcpy.KERNEL32(?,0041D7D6), ref: 006B716C

FindFirstFileA.KERNEL32(00000000,?,00000000,?,0041DC20,0041D746), ref: 006AD7F5
StrCmpCA.SHLWAPI(?,0041DC28), ref: 006AD845
StrCmpCA.SHLWAPI(?,0041DC2C), ref: 006AD85B
FindNextFileA.KERNEL32(000000FF,?), ref: 006ADD71
FindClose.KERNEL32(000000FF), ref: 006ADD83

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID:
API String ID: 2325840235-0
Opcode ID: 1c60eba5c1c612e8b874372a12ebe7f309e66199d256779a4c52d734630b5e89
Instruction ID: 7487e80663b68f1a260807f285454c89b2ca63daf4a22a0766e0172687d42bf1
Opcode Fuzzy Hash: 1c60eba5c1c612e8b874372a12ebe7f309e66199d256779a4c52d734630b5e89
Instruction Fuzzy Hash: 04F19DB18182189ACB65FB60DCA5EEE733ABF94300F40559EB15A62191EF305FC9CF64

Uniqueness

Uniqueness Score: -1.00%

Function 006AC1F7 Relevance: 10.6, APIs: 7, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 006AC22A
lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 006AC248
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 006AC253
memcpy.MSVCRT ref: 006AC2E9
lstrcat.KERNEL32(?,0041D726), ref: 006AC31A
lstrcat.KERNEL32(?,0041D727), ref: 006AC32E
lstrcat.KERNEL32(?,0041D72A), ref: 006AC34F

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlenmemcpymemset
String ID:
API String ID: 1498829745-0
Opcode ID: bced4611a23089cc8d92494cfdba6022e88a94dece1429bef504adb33600c636
Instruction ID: 91fda898cf67234f73b223b6ab1052e3d653a4385babd0460aab8208964aa693
Opcode Fuzzy Hash: bced4611a23089cc8d92494cfdba6022e88a94dece1429bef504adb33600c636
Instruction Fuzzy Hash: 53417E75D0420A9BDB20DF94DD88BEEB7B9BF48340F1081A8E605A7280DB745A84CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF90 Relevance: 10.6, APIs: 7, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040BFC3
lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,0084DE70), ref: 0040BFE1
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040BFEC
memcpy.MSVCRT ref: 0040C082
lstrcat.KERNEL32(?,0041D726), ref: 0040C0B3
lstrcat.KERNEL32(?,0041D727), ref: 0040C0C7
lstrcat.KERNEL32(?,0041D72A), ref: 0040C0E8

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlenmemcpymemset
String ID:
API String ID: 1498829745-0
Opcode ID: 52605990ea01bca17d675fac138a1e19a7de02da9981d5b01ff6e8c7352eb267
Instruction ID: c615a08a89d19efff62b5a0e6981dcd2a682f0599fa2db432923c9597831d409
Opcode Fuzzy Hash: 52605990ea01bca17d675fac138a1e19a7de02da9981d5b01ff6e8c7352eb267
Instruction Fuzzy Hash: 22417E75D0420ADBDB20CF90DD88BEEBBB9BB48340F1041A9E605A72C0DB745A84CF95

Uniqueness

Uniqueness Score: -1.00%

Function 006B47D7 Relevance: 7.6, APIs: 5, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

GetKeyboardLayoutList.USER32(00000000,00000000,0041D146), ref: 006B4805
LocalAlloc.KERNEL32(00000040,?), ref: 006B481D
GetKeyboardLayoutList.USER32(?,00000000), ref: 006B4831
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 006B4886
LocalFree.KERNEL32(00000000), ref: 006B4946

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID:
API String ID: 3090951853-0
Opcode ID: b2544f40f224b76a8b2ddf093633d274dfd3fb81cf13fe2008bce11d3b2ea03e
Instruction ID: 7df7f021a7037ef1c59bbad75a2a6a8a575a98d1ff8c8e3d17251d80211a8a5e
Opcode Fuzzy Hash: b2544f40f224b76a8b2ddf093633d274dfd3fb81cf13fe2008bce11d3b2ea03e
Instruction Fuzzy Hash: F9414AB494022CABCB64EB50DC99BEDB376BB94300F2041D9E11A66292DB706FC5CF54

Uniqueness

Uniqueness Score: -1.00%

Function 006B7DB5 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 006B90AD
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 006B90C2
UnhandledExceptionFilter.KERNEL32(0041C690), ref: 006B90CD
GetCurrentProcess.KERNEL32(C0000409), ref: 006B90E9
TerminateProcess.KERNEL32(00000000), ref: 006B90F0

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1485600a89bc27f1a0a21c1cb01dd845070ad6051d0655c0ebfcb599f372d5e6
Instruction ID: 0482e66fbaf62859c42e0f5fdbd6d45b171f949d0145e9b43a0c206ced252b0b
Opcode Fuzzy Hash: 1485600a89bc27f1a0a21c1cb01dd845070ad6051d0655c0ebfcb599f372d5e6
Instruction Fuzzy Hash: 6421C0B8A01204EFC761EF54F944B943BB4FB8C305F91907AE65887260E7B45686CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 00417B4E Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00418E46
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00418E5B
UnhandledExceptionFilter.KERNEL32(0041C690), ref: 00418E66
GetCurrentProcess.KERNEL32(C0000409), ref: 00418E82
TerminateProcess.KERNEL32(00000000), ref: 00418E89

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 1485600a89bc27f1a0a21c1cb01dd845070ad6051d0655c0ebfcb599f372d5e6
Instruction ID: 5828a94612e18b022276c58097a982c86e574ee0b254963d5fd3238681fe770b
Opcode Fuzzy Hash: 1485600a89bc27f1a0a21c1cb01dd845070ad6051d0655c0ebfcb599f372d5e6
Instruction Fuzzy Hash: 2D21C274A01304EFC721EF54F944B843BB4FB8C309F91907AE64987260E7B456868F9D

Uniqueness

Uniqueness Score: -1.00%

Function 006A6E77 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 006A6E84
RtlAllocateHeap.NTDLL(00000000), ref: 006A6E8B
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 006A6EB8
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 006A6EDB
LocalFree.KERNEL32(?), ref: 006A6EE5

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 325183e0ff294f6bc8ca0bae0d01f1e1eb9720b9252a7c44d145ca839e0966ea
Instruction ID: 93f1707b1031326072115585041de2d4eebbed23871167acef83ef59c2e59f79
Opcode Fuzzy Hash: 325183e0ff294f6bc8ca0bae0d01f1e1eb9720b9252a7c44d145ca839e0966ea
Instruction Fuzzy Hash: D7010075A40708BBDB20DB94DD45F9E7779AB44B05F104154F705AB2C0DAB0AA018B95

Uniqueness

Uniqueness Score: -1.00%

Function 00406C10 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660), ref: 00406C1D
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406C24
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00406C51
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,`v@,80000001,h0A), ref: 00406C74
LocalFree.KERNEL32(?,?,?,?,?,?,`v@,80000001,h0A,?,?,?,?,?,00407660,?), ref: 00406C7E

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 325183e0ff294f6bc8ca0bae0d01f1e1eb9720b9252a7c44d145ca839e0966ea
Instruction ID: a62b9dfe9577ca48fe2f29d604933a8f18b811f44e231435f7e1fa1bbfb2df61
Opcode Fuzzy Hash: 325183e0ff294f6bc8ca0bae0d01f1e1eb9720b9252a7c44d145ca839e0966ea
Instruction Fuzzy Hash: 01011275A40708BBEB20DF94CD45F9E7779EB44B05F104155F706FB2C0D670AA118BA9

Uniqueness

Uniqueness Score: -1.00%

Function 006B5F67 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 006B5F85
Process32First.KERNEL32(0041D599,00000128), ref: 006B5F99
Process32Next.KERNEL32(0041D599,00000128), ref: 006B5FAE
StrCmpCA.SHLWAPI(?,00000000), ref: 006B5FC3
CloseHandle.KERNEL32(0041D599), ref: 006B5FE1

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: f6d0f21b7cc225942ebaf2b71921687e4bacd107d031d79921886f9976f157bb
Instruction ID: fae39af772901f2a540a3edf2847226e48650d4d86393639617b24ade02a115f
Opcode Fuzzy Hash: f6d0f21b7cc225942ebaf2b71921687e4bacd107d031d79921886f9976f157bb
Instruction Fuzzy Hash: 55011EB5A10608EBDB20DFA4DD98BEDF7B9BB48300F104189A906D7280DB709B81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 006B5807 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,006A50A5,40000001,00000000,00000000), ref: 006B5827

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 718bb6be1b75e617e987197471ae693474da6023ddc0167bf927d0320b7ad6f5
Instruction ID: 486878e02c857ba78604fa5a9ee0e587c035da60435a9d466a3bc1ecc72f3867
Opcode Fuzzy Hash: 718bb6be1b75e617e987197471ae693474da6023ddc0167bf927d0320b7ad6f5
Instruction Fuzzy Hash: 9D110AB0604A08FFDB10CFA4D844FE633AABF89310F109558F91A8B251D775E882DB60

Uniqueness

Uniqueness Score: -1.00%

Function 006A9707 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,006A4E15,00000000,00000000), ref: 006A9736
LocalAlloc.KERNEL32(00000040,?,?,?,006A4E15,00000000,?), ref: 006A9748
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,006A4E15,00000000,00000000), ref: 006A9771
LocalFree.KERNEL32(?,?,?,?,006A4E15,00000000,?), ref: 006A9786

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: eb8266b658b0a36e64dba83ee5fc04eec02a97dd996390432438c79c58cdc735
Instruction ID: dd94606d00c50ffd731780ff6760bbf5aa0584077c39a6d88a32f3f50d2fcba2
Opcode Fuzzy Hash: eb8266b658b0a36e64dba83ee5fc04eec02a97dd996390432438c79c58cdc735
Instruction Fuzzy Hash: F3119074240308AFEB10DF64CC95FAA77B6EB89711F208459FA159B3D0C7B1A941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 004094A0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 004094CF
LocalAlloc.KERNEL32(00000040,?,?,?,00404BAE,00000000,?), ref: 004094E1
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 0040950A
LocalFree.KERNEL32(?,?,?,?,00404BAE,00000000,?), ref: 0040951F

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: eb8266b658b0a36e64dba83ee5fc04eec02a97dd996390432438c79c58cdc735
Instruction ID: 8ba321113e6e4d0cf3898c04bf9160a1f44f8cb9f34d86efd4b3c4bff5612467
Opcode Fuzzy Hash: eb8266b658b0a36e64dba83ee5fc04eec02a97dd996390432438c79c58cdc735
Instruction Fuzzy Hash: AA119074240308AFEB14CF64CC95FAA77B6FB89711F208059FA159B3D0C7B5AA41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00414450 Relevance: 6.0, APIs: 4, Instructions: 34memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,0041D748,00000000,?,00000000,0041D2B1), ref: 0041445D
HeapAlloc.KERNEL32(00000000), ref: 00414464
GetLocalTime.KERNEL32(?), ref: 00414471
wsprintfA.USER32 ref: 004144A0

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: ecd3a08835dc28e24e172d3ec6c3ea9534f2ed94b9f2de78f98134f4a4fefc06
Instruction ID: 4df586b6dc15b0ab72eaa90ec8b013cc5aca6a98c8dd6c86bd1e3c66c74c2495
Opcode Fuzzy Hash: ecd3a08835dc28e24e172d3ec6c3ea9534f2ed94b9f2de78f98134f4a4fefc06
Instruction Fuzzy Hash: 1FF06DB6804618ABCB20DBD9DD48DBFB3FDBF4CB02F000549FA46A2180E6384A41D7B1

Uniqueness

Uniqueness Score: -1.00%

Function 006A97A7 Relevance: 4.5, APIs: 3, Instructions: 49memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 006A97CB
LocalAlloc.KERNEL32(00000040,00000000), ref: 006A97EA
LocalFree.KERNEL32(?), ref: 006A9816

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 22788d86bb0e3b36a7a96175dcc17964957ca332b329b0ec9e9903d4a9c63904
Instruction ID: b5bc4c86ed24e2065da87f4b1f84e5108eaf790673cf6a90260c4d76444b98c1
Opcode Fuzzy Hash: 22788d86bb0e3b36a7a96175dcc17964957ca332b329b0ec9e9903d4a9c63904
Instruction Fuzzy Hash: 7711B7B8A00209EFCB04DF94C984EAEB7B6FF89301F108558E915A7390D774AE51CF61

Uniqueness

Uniqueness Score: -1.00%

Function 006BA02E Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00419D85), ref: 006BA033

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 070a293f5fd72a4302476959d8ba9f25930c1a77546e2223ef40415f4a224816
Instruction ID: a2f7eb20247afb77339b0084df5ee2fab041c51b9664aeb6610f0aa757957e44
Opcode Fuzzy Hash: 070a293f5fd72a4302476959d8ba9f25930c1a77546e2223ef40415f4a224816
Instruction Fuzzy Hash: 0290027069124446460057B06C1D6966A95AA8C60679144E5E125C405DEB644448555D

Uniqueness

Uniqueness Score: -1.00%

Function 00419DC7 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00019D85), ref: 00419DCC

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 070a293f5fd72a4302476959d8ba9f25930c1a77546e2223ef40415f4a224816
Instruction ID: a2f7eb20247afb77339b0084df5ee2fab041c51b9664aeb6610f0aa757957e44
Opcode Fuzzy Hash: 070a293f5fd72a4302476959d8ba9f25930c1a77546e2223ef40415f4a224816
Instruction Fuzzy Hash: 0290027069124446460057B06C1D6966A95AA8C60679144E5E125C405DEB644448555D

Uniqueness

Uniqueness Score: -1.00%

Function 00833643 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2877662329.0000000000833000.00000040.00000020.00020000.00000000.sdmp, Offset: 00833000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_833000_syncUpd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: fddd44ec0dc7b9a878226453f0ca058cd75c376ee73447fa2db1cb6339534f80
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: F9118E72340104AFD744DF59DC82EA673EAFB99320B298065ED08CB352E675ED41D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 006A0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 9670c6dc6782615957e8167651f040a8d9d68a0a5bd5790f4f5c73451d1e142f
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 7E0184766016048FEB21EF64C804BEA33E6FF87315F4544A5D50697242E774AD418F90

Uniqueness

Uniqueness Score: -1.00%

Function 006B6027 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Uniqueness

Uniqueness Score: -1.00%

Function 00415DC0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Uniqueness

Uniqueness Score: -1.00%

Function 006B9791 Relevance: 129.2, APIs: 86, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 006B97A5

Part of subcall function 006B74AE: HeapFree.KERNEL32(00000000,00000000,?,006B73BF,?,?,006A6DBF), ref: 006B74C4
Part of subcall function 006B74AE: GetLastError.KERNEL32(?,?,006B73BF,?,?,006A6DBF), ref: 006B74D6

_free.LIBCMT ref: 006B97AD
_free.LIBCMT ref: 006B97B5
_free.LIBCMT ref: 006B97BD
_free.LIBCMT ref: 006B97C5
_free.LIBCMT ref: 006B97CD
_free.LIBCMT ref: 006B97D4
_free.LIBCMT ref: 006B97DC
_free.LIBCMT ref: 006B97E4
_free.LIBCMT ref: 006B97EC
_free.LIBCMT ref: 006B97F4
_free.LIBCMT ref: 006B97FC
_free.LIBCMT ref: 006B9804
_free.LIBCMT ref: 006B980C
_free.LIBCMT ref: 006B9814
_free.LIBCMT ref: 006B981C
_free.LIBCMT ref: 006B9827
_free.LIBCMT ref: 006B982F
_free.LIBCMT ref: 006B9837
_free.LIBCMT ref: 006B983F
_free.LIBCMT ref: 006B9847
_free.LIBCMT ref: 006B984F
_free.LIBCMT ref: 006B9857
_free.LIBCMT ref: 006B985F
_free.LIBCMT ref: 006B9867
_free.LIBCMT ref: 006B986F
_free.LIBCMT ref: 006B9877
_free.LIBCMT ref: 006B987F
_free.LIBCMT ref: 006B9887
_free.LIBCMT ref: 006B988F
_free.LIBCMT ref: 006B9897
_free.LIBCMT ref: 006B989F
_free.LIBCMT ref: 006B98AD
_free.LIBCMT ref: 006B98B8
_free.LIBCMT ref: 006B98C3
_free.LIBCMT ref: 006B98CE
_free.LIBCMT ref: 006B98D9
_free.LIBCMT ref: 006B98E4
_free.LIBCMT ref: 006B98EF
_free.LIBCMT ref: 006B98FA
_free.LIBCMT ref: 006B9905
_free.LIBCMT ref: 006B9910
_free.LIBCMT ref: 006B991B
_free.LIBCMT ref: 006B9926
_free.LIBCMT ref: 006B9931
_free.LIBCMT ref: 006B993C
_free.LIBCMT ref: 006B9947
_free.LIBCMT ref: 006B9952
_free.LIBCMT ref: 006B9960
_free.LIBCMT ref: 006B996B
_free.LIBCMT ref: 006B9976
_free.LIBCMT ref: 006B9981
_free.LIBCMT ref: 006B998C
_free.LIBCMT ref: 006B9997
_free.LIBCMT ref: 006B99A2
_free.LIBCMT ref: 006B99AD
_free.LIBCMT ref: 006B99B8
_free.LIBCMT ref: 006B99C3
_free.LIBCMT ref: 006B99CE
_free.LIBCMT ref: 006B99D9
_free.LIBCMT ref: 006B99E4
_free.LIBCMT ref: 006B99EF
_free.LIBCMT ref: 006B99FA
_free.LIBCMT ref: 006B9A05
_free.LIBCMT ref: 006B9A13
_free.LIBCMT ref: 006B9A1E
_free.LIBCMT ref: 006B9A29
_free.LIBCMT ref: 006B9A34
_free.LIBCMT ref: 006B9A3F
_free.LIBCMT ref: 006B9A4A
_free.LIBCMT ref: 006B9A55
_free.LIBCMT ref: 006B9A60
_free.LIBCMT ref: 006B9A6B
_free.LIBCMT ref: 006B9A76
_free.LIBCMT ref: 006B9A81
_free.LIBCMT ref: 006B9A8C
_free.LIBCMT ref: 006B9A97
_free.LIBCMT ref: 006B9AA2
_free.LIBCMT ref: 006B9AAD
_free.LIBCMT ref: 006B9AB8
_free.LIBCMT ref: 006B9AC6
_free.LIBCMT ref: 006B9AD1
_free.LIBCMT ref: 006B9ADC
_free.LIBCMT ref: 006B9AE7
_free.LIBCMT ref: 006B9AF2
_free.LIBCMT ref: 006B9AFD

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 55745e4d8ffa3bcd4bae6bd50e23aa08e34946fc70669168e917a1c48e4fa5ed
Instruction ID: 5c14e1f57bdad54baa4df8bfc03c2c5b5dcae8bb9d16ad7d2002ad6d4da05fd0
Opcode Fuzzy Hash: 55745e4d8ffa3bcd4bae6bd50e23aa08e34946fc70669168e917a1c48e4fa5ed
Instruction Fuzzy Hash: DF71C0B1415E249ED7A23B31DF03AD97EE37F84321F21C93CB1B620D329A2268E59755

Uniqueness

Uniqueness Score: -1.00%

Function 0041952A Relevance: 129.2, APIs: 86, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0041953E

Part of subcall function 00417247: HeapFree.KERNEL32(00000000,00000000,?,00417158,00000000,00421AC0,0041719F,?,?,?,0041720F,00421AC0,?,?,00419FD3,00421AC0), ref: 0041725D
Part of subcall function 00417247: GetLastError.KERNEL32(?,?,00417158,00000000,00421AC0,0041719F,?,?,?,0041720F,00421AC0,?,?,00419FD3,00421AC0), ref: 0041726F

_free.LIBCMT ref: 00419546
_free.LIBCMT ref: 0041954E
_free.LIBCMT ref: 00419556
_free.LIBCMT ref: 0041955E
_free.LIBCMT ref: 00419566
_free.LIBCMT ref: 0041956D
_free.LIBCMT ref: 00419575
_free.LIBCMT ref: 0041957D
_free.LIBCMT ref: 00419585
_free.LIBCMT ref: 0041958D
_free.LIBCMT ref: 00419595
_free.LIBCMT ref: 0041959D
_free.LIBCMT ref: 004195A5
_free.LIBCMT ref: 004195AD
_free.LIBCMT ref: 004195B5
_free.LIBCMT ref: 004195C0
_free.LIBCMT ref: 004195C8
_free.LIBCMT ref: 004195D0
_free.LIBCMT ref: 004195D8
_free.LIBCMT ref: 004195E0
_free.LIBCMT ref: 004195E8
_free.LIBCMT ref: 004195F0
_free.LIBCMT ref: 004195F8
_free.LIBCMT ref: 00419600
_free.LIBCMT ref: 00419608
_free.LIBCMT ref: 00419610
_free.LIBCMT ref: 00419618
_free.LIBCMT ref: 00419620
_free.LIBCMT ref: 00419628
_free.LIBCMT ref: 00419630
_free.LIBCMT ref: 00419638
_free.LIBCMT ref: 00419646
_free.LIBCMT ref: 00419651
_free.LIBCMT ref: 0041965C
_free.LIBCMT ref: 00419667
_free.LIBCMT ref: 00419672
_free.LIBCMT ref: 0041967D
_free.LIBCMT ref: 00419688
_free.LIBCMT ref: 00419693
_free.LIBCMT ref: 0041969E
_free.LIBCMT ref: 004196A9
_free.LIBCMT ref: 004196B4
_free.LIBCMT ref: 004196BF
_free.LIBCMT ref: 004196CA
_free.LIBCMT ref: 004196D5
_free.LIBCMT ref: 004196E0
_free.LIBCMT ref: 004196EB
_free.LIBCMT ref: 004196F9
_free.LIBCMT ref: 00419704
_free.LIBCMT ref: 0041970F
_free.LIBCMT ref: 0041971A
_free.LIBCMT ref: 00419725
_free.LIBCMT ref: 00419730
_free.LIBCMT ref: 0041973B
_free.LIBCMT ref: 00419746
_free.LIBCMT ref: 00419751
_free.LIBCMT ref: 0041975C
_free.LIBCMT ref: 00419767
_free.LIBCMT ref: 00419772
_free.LIBCMT ref: 0041977D
_free.LIBCMT ref: 00419788
_free.LIBCMT ref: 00419793
_free.LIBCMT ref: 0041979E
_free.LIBCMT ref: 004197AC
_free.LIBCMT ref: 004197B7
_free.LIBCMT ref: 004197C2
_free.LIBCMT ref: 004197CD
_free.LIBCMT ref: 004197D8
_free.LIBCMT ref: 004197E3
_free.LIBCMT ref: 004197EE
_free.LIBCMT ref: 004197F9
_free.LIBCMT ref: 00419804
_free.LIBCMT ref: 0041980F
_free.LIBCMT ref: 0041981A
_free.LIBCMT ref: 00419825
_free.LIBCMT ref: 00419830
_free.LIBCMT ref: 0041983B
_free.LIBCMT ref: 00419846
_free.LIBCMT ref: 00419851
_free.LIBCMT ref: 0041985F
_free.LIBCMT ref: 0041986A
_free.LIBCMT ref: 00419875
_free.LIBCMT ref: 00419880
_free.LIBCMT ref: 0041988B
_free.LIBCMT ref: 00419896

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 55745e4d8ffa3bcd4bae6bd50e23aa08e34946fc70669168e917a1c48e4fa5ed
Instruction ID: 5df7b21d12798ad2dd02b2714939a7e9e3589bb161cd2ca89e36415dbd51ea28
Opcode Fuzzy Hash: 55745e4d8ffa3bcd4bae6bd50e23aa08e34946fc70669168e917a1c48e4fa5ed
Instruction Fuzzy Hash: AE71E331494B009BD7633B32DD03ADA7AB27F04304F10596EB1FB20632DA3678E79A59

Uniqueness

Uniqueness Score: -1.00%

Function 006B6137 Relevance: 49.7, APIs: 33, Instructions: 212libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00625074,00624A00), ref: 006B6178
GetProcAddress.KERNEL32(00625074,00624DA4), ref: 006B6191
GetProcAddress.KERNEL32(00625074,00624E10), ref: 006B61A9
GetProcAddress.KERNEL32(00625074,00624A60), ref: 006B61C1
GetProcAddress.KERNEL32(00625074,00624A4C), ref: 006B61DA
GetProcAddress.KERNEL32(00625074,00624AEC), ref: 006B61F2
GetProcAddress.KERNEL32(00625074,00624CB8), ref: 006B620A
GetProcAddress.KERNEL32(00625074,00624B30), ref: 006B6223
GetProcAddress.KERNEL32(00625074,00624D84), ref: 006B623B
GetProcAddress.KERNEL32(00625074,00624D28), ref: 006B6253
GetProcAddress.KERNEL32(00625074,00624BAC), ref: 006B626C
GetProcAddress.KERNEL32(00625074,00624AE0), ref: 006B6284
GetProcAddress.KERNEL32(00625074,00624DD8), ref: 006B629C
GetProcAddress.KERNEL32(00625074,006248B0), ref: 006B62B5
GetProcAddress.KERNEL32(00625074,00624D7C), ref: 006B62CD
GetProcAddress.KERNEL32(00625074,00624A20), ref: 006B62E5
GetProcAddress.KERNEL32(00625074,00624C08), ref: 006B62FE
GetProcAddress.KERNEL32(00625074,00624E00), ref: 006B6316
GetProcAddress.KERNEL32(00625074,006248BC), ref: 006B632E
GetProcAddress.KERNEL32(00625074,00624928), ref: 006B6347
GetProcAddress.KERNEL32(00625074,00624AAC), ref: 006B635F
LoadLibraryA.KERNEL32(00624D30,?,006B3927), ref: 006B6371
LoadLibraryA.KERNEL32(00624978,?,006B3927), ref: 006B6382
LoadLibraryA.KERNEL32(00624900,?,006B3927), ref: 006B6394
LoadLibraryA.KERNEL32(006249D8,?,006B3927), ref: 006B63A6
LoadLibraryA.KERNEL32(00624B1C,?,006B3927), ref: 006B63B7
GetProcAddress.KERNEL32(00624E98,00624C94), ref: 006B63D9
GetProcAddress.KERNEL32(00624FB8,00624C14), ref: 006B63FA
GetProcAddress.KERNEL32(00624FB8,006249C8), ref: 006B6412
GetProcAddress.KERNEL32(006250A8,00624B88), ref: 006B6434
GetProcAddress.KERNEL32(00624F6C,00624924), ref: 006B6455
GetProcAddress.KERNEL32(00624F9C,00624C04), ref: 006B6476
GetProcAddress.KERNEL32(00624F9C,0041D12C), ref: 006B648D

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 4bf4faa6d80337b6a8c58e308678245154ae8b5c2676724c8d6fcdc68551e2bc
Instruction ID: 0d7cf2dc10770b2a3a76442a3debebf287282d6339018b488b8318ef89b21094
Opcode Fuzzy Hash: 4bf4faa6d80337b6a8c58e308678245154ae8b5c2676724c8d6fcdc68551e2bc
Instruction Fuzzy Hash: 79A160B5910E10AFC374DFA8FE88A5637ABBBCC3117116519A60AC72A0DF759482CF91

Uniqueness

Uniqueness Score: -1.00%

Function 006AECF7 Relevance: 48.4, APIs: 32, Instructions: 363stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

Part of subcall function 006B5747: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006B5772

Part of subcall function 006B7187: lstrcpy.KERNEL32(00000000,?), ref: 006B71D9
Part of subcall function 006B7187: lstrcat.KERNEL32(00000000), ref: 006B71E9

Part of subcall function 006B7107: lstrcpy.KERNEL32(?,0041D7D6), ref: 006B716C

Part of subcall function 006B7217: lstrlen.KERNEL32(?,006249EC,?,004215A4,0041D7D6), ref: 006B722C
Part of subcall function 006B7217: lstrcpy.KERNEL32(00000000), ref: 006B726B
Part of subcall function 006B7217: lstrcat.KERNEL32(00000000,00000000), ref: 006B7279

Part of subcall function 006B7007: lstrcpy.KERNEL32(?,00000000), ref: 006B704D

Part of subcall function 006A9607: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006A9633
Part of subcall function 006A9607: GetFileSizeEx.KERNEL32(000000FF,?), ref: 006A9658
Part of subcall function 006A9607: LocalAlloc.KERNEL32(00000040,?), ref: 006A9678
Part of subcall function 006A9607: ReadFile.KERNEL32(000000FF,?,00000000,006A16B6,00000000), ref: 006A96A1
Part of subcall function 006A9607: LocalFree.KERNEL32(006A16B6), ref: 006A96D7
Part of subcall function 006A9607: CloseHandle.KERNEL32(000000FF), ref: 006A96E1

Part of subcall function 006B5797: LocalAlloc.KERNEL32(00000040,-00000001), ref: 006B57B9

strtok_s.MSVCRT ref: 006AEDC2
GetProcessHeap.KERNEL32(00000000,000F423F,0041D77A,0041D777,0041D776,0041D773), ref: 006AEE09
RtlAllocateHeap.NTDLL(00000000), ref: 006AEE10
StrStrA.SHLWAPI(00000000,0041DCD4), ref: 006AEE2C
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 006AEE3A

Part of subcall function 006B5207: malloc.MSVCRT ref: 006B520F
Part of subcall function 006B5207: strncpy.MSVCRT ref: 006B522A

StrStrA.SHLWAPI(00000000,0041DCDC), ref: 006AEE76
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 006AEE84
StrStrA.SHLWAPI(00000000,0041DCE4), ref: 006AEEC0
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 006AEECE
StrStrA.SHLWAPI(00000000,0041DCEC), ref: 006AEF0A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 006AEF1C
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 006AEFA9
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 006AEFC1
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 006AEFD9
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 006AEFF1
lstrcat.KERNEL32(?,0041DD08), ref: 006AF009
lstrcat.KERNEL32(?,0041DD1C), ref: 006AF018
lstrcat.KERNEL32(?,0041DD2C), ref: 006AF027
lstrcat.KERNEL32(?,00000000), ref: 006AF03A
lstrcat.KERNEL32(?,0041DD34), ref: 006AF049
lstrcat.KERNEL32(?,00000000), ref: 006AF05C
lstrcat.KERNEL32(?,0041DD38), ref: 006AF06B
lstrcat.KERNEL32(?,0041DD3C), ref: 006AF07A
lstrcat.KERNEL32(?,00000000), ref: 006AF08D
lstrcat.KERNEL32(?,0041DD44), ref: 006AF09C
lstrcat.KERNEL32(?,0041DD48), ref: 006AF0AB
lstrcat.KERNEL32(?,00000000), ref: 006AF0BE
lstrcat.KERNEL32(?,0041DD54), ref: 006AF0CD
lstrcat.KERNEL32(?,0041DD58), ref: 006AF0DC
strtok_s.MSVCRT ref: 006AF120
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041D772), ref: 006AF135
memset.MSVCRT ref: 006AF17E

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeapstrtok_s$AllocateCloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID:
API String ID: 3689735781-0
Opcode ID: b16d59508813708b1d92d6ee10662e8f39c45857b8dfa9bcd2ae4a529fc321c5
Instruction ID: aa38691854eb4ee9e3b4ce32e8b53b4246b32d081985ef2825dbabaf1bfb2183
Opcode Fuzzy Hash: b16d59508813708b1d92d6ee10662e8f39c45857b8dfa9bcd2ae4a529fc321c5
Instruction Fuzzy Hash: 06D120F1D00208ABCB54FBE4DD9AEEE773AAF94300F50451DF102A6195DF749A85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 006AA297 Relevance: 32.0, APIs: 21, Instructions: 494stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006B72D7: StrCmpCA.SHLWAPI(DKb,006AA2AE,?,006AA2AE,00624B44), ref: 006B72F6

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 006AA5C9
RtlAllocateHeap.NTDLL(00000000), ref: 006AA5D0
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006AA3B1

Part of subcall function 006B7087: lstrlen.KERNEL32(006A4E2C,?,?,006A4E2C,0041D79A), ref: 006B7092
Part of subcall function 006B7087: lstrcpy.KERNEL32(0041D79A,00000000), ref: 006B70EC

Part of subcall function 006B7217: lstrlen.KERNEL32(?,006249EC,?,004215A4,0041D7D6), ref: 006B722C
Part of subcall function 006B7217: lstrcpy.KERNEL32(00000000), ref: 006B726B
Part of subcall function 006B7217: lstrcat.KERNEL32(00000000,00000000), ref: 006B7279

Part of subcall function 006B7107: lstrcpy.KERNEL32(?,0041D7D6), ref: 006B716C

lstrcat.KERNEL32(?,00000000), ref: 006AA711
lstrcat.KERNEL32(?,0041DA80), ref: 006AA720
lstrcat.KERNEL32(?,00000000), ref: 006AA733
lstrcat.KERNEL32(?,0041DA84), ref: 006AA742
lstrcat.KERNEL32(?,00000000), ref: 006AA755
lstrcat.KERNEL32(?,0041DA88), ref: 006AA764
lstrcat.KERNEL32(?,00000000), ref: 006AA777
lstrcat.KERNEL32(?,0041DA8C), ref: 006AA786
lstrcat.KERNEL32(?,00000000), ref: 006AA799
lstrcat.KERNEL32(?,0041DA90), ref: 006AA7A8
lstrcat.KERNEL32(?,00000000), ref: 006AA7BB
lstrcat.KERNEL32(?,0041DA94), ref: 006AA7CA

Part of subcall function 006A9A57: memcmp.MSVCRT ref: 006A9A72
Part of subcall function 006A9A57: memset.MSVCRT ref: 006A9AA5
Part of subcall function 006A9A57: LocalAlloc.KERNEL32(00000040,?), ref: 006A9AF5

lstrcat.KERNEL32(?,00000000), ref: 006AA813
lstrcat.KERNEL32(?,0041DA98), ref: 006AA82D
lstrlen.KERNEL32(?), ref: 006AA86C
lstrlen.KERNEL32(?), ref: 006AA87B
memset.MSVCRT ref: 006AA8C4

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

DeleteFileA.KERNEL32(00000000), ref: 006AA8F0

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpylstrlen$FileHeapmemset$AllocAllocateCopyDeleteLocalProcessmemcmp
String ID:
API String ID: 2228671196-0
Opcode ID: 9e42199074a90107a8dead1a7d243c1108800441b4ba894103f5affc1eeccc27
Instruction ID: 9072cf68e4a11bd623149e2466931c63065f42ea024adaa13aaa77a83fe3b5da
Opcode Fuzzy Hash: 9e42199074a90107a8dead1a7d243c1108800441b4ba894103f5affc1eeccc27
Instruction Fuzzy Hash: B6025CF1904108ABCB54FBA0DD96EEE737AAF94301F10015EF506A6191DF34AF85CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 006AC8A7 Relevance: 31.9, APIs: 21, Instructions: 374stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

Part of subcall function 006B7217: lstrlen.KERNEL32(?,006249EC,?,004215A4,0041D7D6), ref: 006B722C
Part of subcall function 006B7217: lstrcpy.KERNEL32(00000000), ref: 006B726B
Part of subcall function 006B7217: lstrcat.KERNEL32(00000000,00000000), ref: 006B7279

Part of subcall function 006B7107: lstrcpy.KERNEL32(?,0041D7D6), ref: 006B716C

Part of subcall function 006B54C7: GetSystemTime.KERNEL32(0041D7D7,00624AA0,0041D129,?,?,006A1620,?,0000001A,0041D7D7,00000000,?,006249EC,?,004215A4,0041D7D6), ref: 006B54ED

Part of subcall function 006B7187: lstrcpy.KERNEL32(00000000,?), ref: 006B71D9
Part of subcall function 006B7187: lstrcat.KERNEL32(00000000), ref: 006B71E9

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006AC93A
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 006ACA7E
RtlAllocateHeap.NTDLL(00000000), ref: 006ACA85
lstrcat.KERNEL32(?,00000000), ref: 006ACBBF
lstrcat.KERNEL32(?,0041DBD8), ref: 006ACBCE
lstrcat.KERNEL32(?,00000000), ref: 006ACBE1
lstrcat.KERNEL32(?,0041DBDC), ref: 006ACBF0
lstrcat.KERNEL32(?,00000000), ref: 006ACC03
lstrcat.KERNEL32(?,0041DBE0), ref: 006ACC12
lstrcat.KERNEL32(?,00000000), ref: 006ACC25
lstrcat.KERNEL32(?,0041DBE4), ref: 006ACC34
lstrcat.KERNEL32(?,00000000), ref: 006ACC47
lstrcat.KERNEL32(?,0041DBE8), ref: 006ACC56
lstrcat.KERNEL32(?,00000000), ref: 006ACC69
lstrcat.KERNEL32(?,0041DBEC), ref: 006ACC78
lstrcat.KERNEL32(?,00000000), ref: 006ACC8B
lstrcat.KERNEL32(?,0041DBF0), ref: 006ACC9A

Part of subcall function 006B7087: lstrlen.KERNEL32(006A4E2C,?,?,006A4E2C,0041D79A), ref: 006B7092
Part of subcall function 006B7087: lstrcpy.KERNEL32(0041D79A,00000000), ref: 006B70EC

lstrlen.KERNEL32(?), ref: 006ACCE1
lstrlen.KERNEL32(?), ref: 006ACCF0
memset.MSVCRT ref: 006ACD39

Part of subcall function 006B72D7: StrCmpCA.SHLWAPI(DKb,006AA2AE,?,006AA2AE,00624B44), ref: 006B72F6

DeleteFileA.KERNEL32(00000000), ref: 006ACD65

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 32b03903aea3df50e8a80283c090f6865379caf8b03cf1ca1c3a0eea1c34ea05
Instruction ID: d79153e566e4c326accb6d55e24104376ecc234d54e4889ab501f4658100f939
Opcode Fuzzy Hash: 32b03903aea3df50e8a80283c090f6865379caf8b03cf1ca1c3a0eea1c34ea05
Instruction Fuzzy Hash: E8E12AF1904108ABCB64FBA0DD96EEE737ABF94301F10415DF106A61A1DF35AE89CB64

Uniqueness

Uniqueness Score: -1.00%

Function 006A5877 Relevance: 29.0, APIs: 19, Instructions: 493networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006B7007: lstrcpy.KERNEL32(?,00000000), ref: 006B704D

Part of subcall function 006A46D7: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006A475D
Part of subcall function 006A46D7: InternetCrackUrlA.WININET(00000000,00000000), ref: 006A476D

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 006A590F
StrCmpCA.SHLWAPI(?,00624C68), ref: 006A592A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 006A5AAA
lstrlen.KERNEL32(00000000,00000000,?,?,00000000,?,0041E0DC,00000000,?,006248EC,00000000,?,00624AE4,00000000,?,0041E0D8), ref: 006A5D85
lstrlen.KERNEL32(00000000), ref: 006A5D96
GetProcessHeap.KERNEL32(00000000,?), ref: 006A5DA7
RtlAllocateHeap.NTDLL(00000000), ref: 006A5DAE
lstrlen.KERNEL32(00000000), ref: 006A5DC3
memcpy.MSVCRT ref: 006A5DDA
lstrlen.KERNEL32(00000000), ref: 006A5DEC
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 006A5E05
memcpy.MSVCRT ref: 006A5E12
lstrlen.KERNEL32(00000000,?,?), ref: 006A5E2F
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 006A5E43
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 006A5E60
InternetCloseHandle.WININET(00000000), ref: 006A5EC4
InternetCloseHandle.WININET(00000000), ref: 006A5ED1
HttpOpenRequestA.WININET(00000000,00624C84,?,00624AB0,00000000,00000000,00400100,00000000), ref: 006A5B0F

Part of subcall function 006B7217: lstrlen.KERNEL32(?,006249EC,?,004215A4,0041D7D6), ref: 006B722C
Part of subcall function 006B7217: lstrcpy.KERNEL32(00000000), ref: 006B726B
Part of subcall function 006B7217: lstrcat.KERNEL32(00000000,00000000), ref: 006B7279

Part of subcall function 006B7107: lstrcpy.KERNEL32(?,0041D7D6), ref: 006B716C

Part of subcall function 006B7187: lstrcpy.KERNEL32(00000000,?), ref: 006B71D9
Part of subcall function 006B7187: lstrcat.KERNEL32(00000000), ref: 006B71E9

InternetCloseHandle.WININET(00000000), ref: 006A5EDB

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocateConnectCrackFileProcessReadSend
String ID:
API String ID: 36004537-0
Opcode ID: 8b814884cedf4fc81417a9552fa435a5da42abb82068080e2803263974605ad5
Instruction ID: 800953ea973209d77dbe99126a38c333784a91fd36ff33a922b6c4dc0a591504
Opcode Fuzzy Hash: 8b814884cedf4fc81417a9552fa435a5da42abb82068080e2803263974605ad5
Instruction Fuzzy Hash: 8712DBB5814128AACB55FBA4DC95EEEB37ABF94700F00419EF10662191EF706B89CF64

Uniqueness

Uniqueness Score: -1.00%

Function 006AC367 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

Part of subcall function 006B7187: lstrcpy.KERNEL32(00000000,?), ref: 006B71D9
Part of subcall function 006B7187: lstrcat.KERNEL32(00000000), ref: 006B71E9

Part of subcall function 006B7107: lstrcpy.KERNEL32(?,0041D7D6), ref: 006B716C

Part of subcall function 006B7217: lstrlen.KERNEL32(?,006249EC,?,004215A4,0041D7D6), ref: 006B722C
Part of subcall function 006B7217: lstrcpy.KERNEL32(00000000), ref: 006B726B
Part of subcall function 006B7217: lstrcat.KERNEL32(00000000,00000000), ref: 006B7279

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00624E08,00000000,?,0041DBAC,00000000,?,?), ref: 006AC43D
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 006AC45A
GetFileSize.KERNEL32(00000000,00000000), ref: 006AC466
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 006AC479

Part of subcall function 006B5257: malloc.MSVCRT ref: 006B525F

ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 006AC4A9
StrStrA.SHLWAPI(?,006249AC,0041D72E), ref: 006AC4C7
StrStrA.SHLWAPI(00000000,00624B58), ref: 006AC4EE
StrStrA.SHLWAPI(?,00624CB4,00000000,?,0041DBB8,00000000,?,00000000,00000000,?,00624958,00000000,?,0041DBB4,00000000,?), ref: 006AC66C
StrStrA.SHLWAPI(00000000,00624CB0), ref: 006AC683

Part of subcall function 006AC1F7: memset.MSVCRT ref: 006AC22A
Part of subcall function 006AC1F7: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 006AC248
Part of subcall function 006AC1F7: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 006AC253
Part of subcall function 006AC1F7: memcpy.MSVCRT ref: 006AC2E9

StrStrA.SHLWAPI(?,00624CB0,00000000,?,0041DBBC,00000000,?,00000000,006248DC), ref: 006AC724
StrStrA.SHLWAPI(00000000,00624D8C), ref: 006AC73B

Part of subcall function 006AC1F7: lstrcat.KERNEL32(?,0041D726), ref: 006AC31A
Part of subcall function 006AC1F7: lstrcat.KERNEL32(?,0041D727), ref: 006AC32E
Part of subcall function 006AC1F7: lstrcat.KERNEL32(?,0041D72A), ref: 006AC34F

lstrlen.KERNEL32(00000000), ref: 006AC80E
CloseHandle.KERNEL32(00000000), ref: 006AC860

Strings

, xrefs: 006AC39A

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringmallocmemcpymemset
String ID:
API String ID: 3538457421-3916222277
Opcode ID: a45be58c568c268844c13b048b7103b6ab608b1b555d09365ef61c6c6f9f6565
Instruction ID: ff81dc029ec507309a1dd734892301a0790869c14474a81b87910edd3d1d54f2
Opcode Fuzzy Hash: a45be58c568c268844c13b048b7103b6ab608b1b555d09365ef61c6c6f9f6565
Instruction Fuzzy Hash: 3AE1DCB1D04108ABCB55EBA4DC92EEEB77ABF94300F04415EF106A6191EF356A85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0040C100 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00854D90,00000000,?,0041DBAC,00000000,?,?), ref: 0040C1D6
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040C1F3
GetFileSize.KERNEL32(00000000,00000000), ref: 0040C1FF
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040C212

Part of subcall function 00414FF0: malloc.MSVCRT ref: 00414FF8

ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040C242
StrStrA.SHLWAPI(?,00854C40,0041D72E), ref: 0040C260
StrStrA.SHLWAPI(00000000,00854C58), ref: 0040C287
StrStrA.SHLWAPI(?,008554C8,00000000,?,0041DBB8,00000000,?,00000000,00000000,?,0084DDF0,00000000,?,0041DBB4,00000000,?), ref: 0040C405
StrStrA.SHLWAPI(00000000,00855688), ref: 0040C41C

Part of subcall function 0040BF90: memset.MSVCRT ref: 0040BFC3
Part of subcall function 0040BF90: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,0084DE70), ref: 0040BFE1
Part of subcall function 0040BF90: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040BFEC
Part of subcall function 0040BF90: memcpy.MSVCRT ref: 0040C082

StrStrA.SHLWAPI(?,00855688,00000000,?,0041DBBC,00000000,?,00000000,0084DE70), ref: 0040C4BD
StrStrA.SHLWAPI(00000000,0084DDB0), ref: 0040C4D4

Part of subcall function 0040BF90: lstrcat.KERNEL32(?,0041D726), ref: 0040C0B3
Part of subcall function 0040BF90: lstrcat.KERNEL32(?,0041D727), ref: 0040C0C7
Part of subcall function 0040BF90: lstrcat.KERNEL32(?,0041D72A), ref: 0040C0E8

lstrlen.KERNEL32(00000000), ref: 0040C5A7
CloseHandle.KERNEL32(00000000), ref: 0040C5F9

Strings

, xrefs: 0040C133

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeStringmallocmemcpymemset
String ID:
API String ID: 3538457421-3916222277
Opcode ID: 2746a3d946b24cc4a74962c5034b8499d8c9a416517d30c07e085bd288c1bfb2
Instruction ID: 16cc530deb27457f536659a64f134916331f5af867ee6c6bf2a367595298ef92
Opcode Fuzzy Hash: 2746a3d946b24cc4a74962c5034b8499d8c9a416517d30c07e085bd288c1bfb2
Instruction Fuzzy Hash: 66E11075910208ABCB14EBA1DC91FEEBB79BF54304F41415EF10667191DF38AA86CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040FAE0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 145stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 0040FB05
ExitProcess.KERNEL32 ref: 0040FB11
strtok_s.MSVCRT ref: 0040FB28

Strings

block, xrefs: 0040FAF7

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 52d09828bd6328d95c269d46c52906f376363bf45c2a71b165d5bab26f2389d9
Instruction ID: 7825bcbe27da9618b603611e1cfecd621835b499ad6dca7fa43ef563d7fd58f0
Opcode Fuzzy Hash: 52d09828bd6328d95c269d46c52906f376363bf45c2a71b165d5bab26f2389d9
Instruction Fuzzy Hash: 0F514074A08209EFDB20DFA1D955BAE77B5BF44305F10807AE802B76C0D778E985CB59

Uniqueness

Uniqueness Score: -1.00%

Function 006B2197 Relevance: 19.7, APIs: 13, Instructions: 193stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 006B21B5
memset.MSVCRT ref: 006B21CC

Part of subcall function 006B5747: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006B5772

lstrcat.KERNEL32(?,00000000), ref: 006B2203
lstrcat.KERNEL32(?,00624B00), ref: 006B2222
lstrcat.KERNEL32(?,?), ref: 006B2236
lstrcat.KERNEL32(?,00624DAC), ref: 006B224A

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

Part of subcall function 006B56F7: GetFileAttributesA.KERNEL32(00000000,?,006A1CAB,?,?,004215E4,?,?,0041D7E2), ref: 006B5706

Part of subcall function 006A9927: StrStrA.SHLWAPI(00000000,006248E8), ref: 006A9982
Part of subcall function 006A9927: memcmp.MSVCRT ref: 006A99DB

Part of subcall function 006A9607: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006A9633
Part of subcall function 006A9607: GetFileSizeEx.KERNEL32(000000FF,?), ref: 006A9658
Part of subcall function 006A9607: LocalAlloc.KERNEL32(00000040,?), ref: 006A9678
Part of subcall function 006A9607: ReadFile.KERNEL32(000000FF,?,00000000,006A16B6,00000000), ref: 006A96A1
Part of subcall function 006A9607: LocalFree.KERNEL32(006A16B6), ref: 006A96D7
Part of subcall function 006A9607: CloseHandle.KERNEL32(000000FF), ref: 006A96E1

Part of subcall function 006B5D27: GlobalAlloc.KERNEL32(00000000,006B22EE,006B22EE), ref: 006B5D3A

StrStrA.SHLWAPI(?,006248D8), ref: 006B2304
GlobalFree.KERNEL32(?), ref: 006B2400

Part of subcall function 006A9707: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,006A4E15,00000000,00000000), ref: 006A9736
Part of subcall function 006A9707: LocalAlloc.KERNEL32(00000040,?,?,?,006A4E15,00000000,?), ref: 006A9748
Part of subcall function 006A9707: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,006A4E15,00000000,00000000), ref: 006A9771
Part of subcall function 006A9707: LocalFree.KERNEL32(?,?,?,?,006A4E15,00000000,?), ref: 006A9786

Part of subcall function 006A9A57: memcmp.MSVCRT ref: 006A9A72
Part of subcall function 006A9A57: memset.MSVCRT ref: 006A9AA5
Part of subcall function 006A9A57: LocalAlloc.KERNEL32(00000040,?), ref: 006A9AF5

lstrcat.KERNEL32(?,00000000), ref: 006B2391
StrCmpCA.SHLWAPI(?,0041D4AB,?,?,?,?,000003E8), ref: 006B23AE
lstrcat.KERNEL32(00000000,00000000), ref: 006B23C0
lstrcat.KERNEL32(00000000,?), ref: 006B23D3
lstrcat.KERNEL32(00000000,0041D840), ref: 006B23E2

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcat$Local$AllocFile$Freememset$BinaryCryptGlobalStringmemcmp$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 1812951797-0
Opcode ID: 3981b85e59352d7def05d6fd474150d6dc12845fb4d5c879c5cf0e4b84f5d486
Instruction ID: c527980df54bc8093fc81fe3bc4a8b72808e2de4b26c02c4e7282e4c83f7759d
Opcode Fuzzy Hash: 3981b85e59352d7def05d6fd474150d6dc12845fb4d5c879c5cf0e4b84f5d486
Instruction Fuzzy Hash: 097134F2900618BBCB64EBA0DC99FEE777AAF48300F044598F60697141DA75DB85CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00411F30 Relevance: 19.7, APIs: 13, Instructions: 193stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00411F4E
memset.MSVCRT ref: 00411F65

Part of subcall function 004154E0: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 0041550B

lstrcat.KERNEL32(?,00000000), ref: 00411F9C
lstrcat.KERNEL32(?,00855108), ref: 00411FBB
lstrcat.KERNEL32(?,?), ref: 00411FCF
lstrcat.KERNEL32(?,00854E98), ref: 00411FE3

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00415490: GetFileAttributesA.KERNEL32(00000000,?,0040E9F4,?,00000000,?,00000000,0041D76E,0041D76B), ref: 0041549F

Part of subcall function 004096C0: StrStrA.SHLWAPI(00000000,00854B38), ref: 0040971B
Part of subcall function 004096C0: memcmp.MSVCRT ref: 00409774

Part of subcall function 004093A0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004093CC
Part of subcall function 004093A0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004093F1
Part of subcall function 004093A0: LocalAlloc.KERNEL32(00000040,?), ref: 00409411
Part of subcall function 004093A0: ReadFile.KERNEL32(000000FF,?,00000000,'@,00000000), ref: 0040943A
Part of subcall function 004093A0: LocalFree.KERNEL32('@), ref: 00409470
Part of subcall function 004093A0: FindCloseChangeNotification.KERNEL32(000000FF), ref: 0040947A

Part of subcall function 00415AC0: GlobalAlloc.KERNEL32(00000000,00412087,00412087), ref: 00415AD3

StrStrA.SHLWAPI(?,008561D8), ref: 0041209D
GlobalFree.KERNEL32(?), ref: 00412199

Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 004094CF
Part of subcall function 004094A0: LocalAlloc.KERNEL32(00000040,?,?,?,00404BAE,00000000,?), ref: 004094E1
Part of subcall function 004094A0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00404BAE,00000000,00000000), ref: 0040950A
Part of subcall function 004094A0: LocalFree.KERNEL32(?,?,?,?,00404BAE,00000000,?), ref: 0040951F

Part of subcall function 004097F0: memcmp.MSVCRT ref: 0040980B
Part of subcall function 004097F0: memset.MSVCRT ref: 0040983E
Part of subcall function 004097F0: LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

lstrcat.KERNEL32(?,00000000), ref: 0041212A
StrCmpCA.SHLWAPI(?,0041D4AB,?,?,?,?,000003E8), ref: 00412147
lstrcat.KERNEL32(00000000,00000000), ref: 00412159
lstrcat.KERNEL32(00000000,?), ref: 0041216C
lstrcat.KERNEL32(00000000,0041D840), ref: 0041217B

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcat$Local$AllocFile$Freememset$BinaryCryptGlobalStringmemcmp$AttributesChangeCloseCreateFindFolderNotificationPathReadSizelstrcpy
String ID:
API String ID: 3662689742-0
Opcode ID: f5db646830afb3b51793a6e0b6e4721c7518e8da438697001fa247f991728a2a
Instruction ID: d5c3215e2bd1f08faed5fb03d7604f0585b4cbbeb5c4b7daf79ee1030fe867fa
Opcode Fuzzy Hash: f5db646830afb3b51793a6e0b6e4721c7518e8da438697001fa247f991728a2a
Instruction Fuzzy Hash: B97158B6900618BBCB24EBE0DD49FDE7779AF88304F004599F60997181EA78DB94CF94

Uniqueness

Uniqueness Score: -1.00%

Function 006B5977 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 184COMMON

Download Yara Rule

Strings

3kF, xrefs: 006B5B35, 006B5BAA, 006B5AE5, 006B5AB6, 006B5A89, 006B59E4, 006B59BB, 006B5B38
3kF, xrefs: 006B59A6, 006B5B6A, 006B59A9, 006B5B6D

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID:
String ID: 3kF$3kF
API String ID: 0-1737149515
Opcode ID: e40bc669b62f72619cb0d277483ebd7ad11248d88b4231bb2187a335cb0e4ec6
Instruction ID: 6dd447fef702d24b0d0ce5f55c3f7e59299788d7f82c636192a33a552ba68738
Opcode Fuzzy Hash: e40bc669b62f72619cb0d277483ebd7ad11248d88b4231bb2187a335cb0e4ec6
Instruction Fuzzy Hash: B3710DB5A00608EBDB14EFE4DC95FEDB7BABF48700F108508F516AB290DB74A945CB60

Uniqueness

Uniqueness Score: -1.00%

Function 006A47A7 Relevance: 17.0, APIs: 11, Instructions: 479networkstringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006B7007: lstrcpy.KERNEL32(?,00000000), ref: 006B704D

Part of subcall function 006A46D7: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006A475D
Part of subcall function 006A46D7: InternetCrackUrlA.WININET(00000000,00000000), ref: 006A476D

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 006A483C
StrCmpCA.SHLWAPI(?,00624C68), ref: 006A4861
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 006A49E1
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,0041D797,00000000,?,?,00000000,?,0041E044,00000000,?,00624CF4), ref: 006A4D0F
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 006A4D2B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 006A4D3F
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 006A4D70
InternetCloseHandle.WININET(00000000), ref: 006A4DD4
InternetCloseHandle.WININET(00000000), ref: 006A4DEC
HttpOpenRequestA.WININET(00000000,00624C84,?,00624AB0,00000000,00000000,00400100,00000000), ref: 006A4A3C

Part of subcall function 006B7217: lstrlen.KERNEL32(?,006249EC,?,004215A4,0041D7D6), ref: 006B722C
Part of subcall function 006B7217: lstrcpy.KERNEL32(00000000), ref: 006B726B
Part of subcall function 006B7217: lstrcat.KERNEL32(00000000,00000000), ref: 006B7279

Part of subcall function 006B7107: lstrcpy.KERNEL32(?,0041D7D6), ref: 006B716C

Part of subcall function 006B7187: lstrcpy.KERNEL32(00000000,?), ref: 006B71D9
Part of subcall function 006B7187: lstrcat.KERNEL32(00000000), ref: 006B71E9

InternetCloseHandle.WININET(00000000), ref: 006A4DF6

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID:
API String ID: 460715078-0
Opcode ID: 186e0976d42a377170bf95904968b890918cbcfc74f47cf10a8b65478b08e6f4
Instruction ID: d357c377691b7dc2d005e42bc19dbc354ec14629e946beef45c2772f25cdf1ab
Opcode Fuzzy Hash: 186e0976d42a377170bf95904968b890918cbcfc74f47cf10a8b65478b08e6f4
Instruction Fuzzy Hash: 7E12FCB5904218AACB55FB94DCA2FEEB37AAF94300F10419EB10662591DF706F88CF65

Uniqueness

Uniqueness Score: -1.00%

Function 006AF972 Relevance: 15.2, APIs: 10, Instructions: 205stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 006AF9A2

Part of subcall function 006B5747: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006B5772

Part of subcall function 006B5BC7: StrStrA.SHLWAPI(?,?), ref: 006B5BD3

lstrcpy.KERNEL32(?,00000000), ref: 006AF9DE

Part of subcall function 006B5BC7: lstrcpyn.KERNEL32(00625310,?,?), ref: 006B5BF7
Part of subcall function 006B5BC7: lstrlen.KERNEL32(?), ref: 006B5C0E
Part of subcall function 006B5BC7: wsprintfA.USER32 ref: 006B5C2E

lstrcpy.KERNEL32(?,00000000), ref: 006AFA26
lstrcpy.KERNEL32(?,00000000), ref: 006AFA6E
lstrcpy.KERNEL32(?,00000000), ref: 006AFAB5
lstrcpy.KERNEL32(?,00000000), ref: 006AFAFD
lstrcpy.KERNEL32(?,00000000), ref: 006AFB45
lstrcpy.KERNEL32(?,00000000), ref: 006AFB8C
lstrcpy.KERNEL32(?,00000000), ref: 006AFBD4

Part of subcall function 006B7087: lstrlen.KERNEL32(006A4E2C,?,?,006A4E2C,0041D79A), ref: 006B7092
Part of subcall function 006B7087: lstrcpy.KERNEL32(0041D79A,00000000), ref: 006B70EC

strtok_s.MSVCRT ref: 006AFCF6

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$FolderPathlstrcpynstrtok_swsprintf
String ID:
API String ID: 4276352425-0
Opcode ID: e6a7c0ac9f1fb61494969f18be3aa34b02d47fee828f2ee4e8056f5644afee52
Instruction ID: e0773c13d7c9565a6d45f3e2e8dc84d576361dc928e1d813f9744305fb35fc10
Opcode Fuzzy Hash: e6a7c0ac9f1fb61494969f18be3aa34b02d47fee828f2ee4e8056f5644afee52
Instruction Fuzzy Hash: 127142F29006189BCB64FB60DC99EEE737AAF54301F04459DF10AA2151EE719BC98F64

Uniqueness

Uniqueness Score: -1.00%

Function 006B3FF7 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT ref: 006B4005

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

OpenProcess.KERNEL32(001FFFFF,00000000,006B4234,0041D28B), ref: 006B4043
memset.MSVCRT ref: 006B4091
??_V@YAXPAX@Z.MSVCRT ref: 006B41E5

Strings

4Bk, xrefs: 006B4038
4Bk, xrefs: 006B41D5, 006B40A0, 006B40A3

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 4Bk$4Bk
API String ID: 224852652-2033144694
Opcode ID: 1a26b6fa8bdaeb359c51be8f7994c2d1375265ef96f370ef8ce744ae01cba673
Instruction ID: fe3332c482e93f236a592e578858413113d7c252925d5dc9ade18127471efa73
Opcode Fuzzy Hash: 1a26b6fa8bdaeb359c51be8f7994c2d1375265ef96f370ef8ce744ae01cba673
Instruction Fuzzy Hash: 93516CF0C042189BDB64EB94CC95BEEB7B6AF58304F1040ADE61566282EF346AC4CF58

Uniqueness

Uniqueness Score: -1.00%

Function 006B4427 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 006B4446
GetVolumeInformationA.KERNEL32(00624DC0,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 006B4483
GetProcessHeap.KERNEL32(00000000,00000104), ref: 006B4507
RtlAllocateHeap.NTDLL(00000000), ref: 006B450E
wsprintfA.USER32 ref: 006B4544

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

Strings

C, xrefs: 006B4450
\, xrefs: 006B4464
:, xrefs: 006B4460

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 6ca11245975395cfb749b767d31339a8af53aa26318921bdecc0eb4ed934f432
Instruction ID: c119b67c382a8b11acadb5886bdafa2d4497c2780f9bb97768c23008673d8e34
Opcode Fuzzy Hash: 6ca11245975395cfb749b767d31339a8af53aa26318921bdecc0eb4ed934f432
Instruction Fuzzy Hash: BC31B4B1D002489BDF20DBA4DC45FEE77B5AF08300F004098F649A7281DB75AAD5CF95

Uniqueness

Uniqueness Score: -1.00%

Function 006B8AAA Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 006B8AB6

Part of subcall function 006B7D93: __getptd_noexit.LIBCMT ref: 006B7D96
Part of subcall function 006B7D93: __amsg_exit.LIBCMT ref: 006B7DA3

__amsg_exit.LIBCMT ref: 006B8AD6
__lock.LIBCMT ref: 006B8AE6
InterlockedDecrement.KERNEL32(?), ref: 006B8B03
_free.LIBCMT ref: 006B8B16
InterlockedIncrement.KERNEL32(05B), ref: 006B8B2E

Strings

05B, xrefs: 006B8B1C, 006B8B24, 006B8B2D
05B, xrefs: 006B8B0D

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID: 05B$05B
API String ID: 3470314060-1918097640
Opcode ID: 30fd09fcb36eb232e569ea581c467d664f2ee35282cbedbbd802be78d6068a8c
Instruction ID: 1b57259dc1761173b2008ff7c63c4a1df14cecd30a8ff5e39c2c53101d333085
Opcode Fuzzy Hash: 30fd09fcb36eb232e569ea581c467d664f2ee35282cbedbbd802be78d6068a8c
Instruction Fuzzy Hash: BC01C4F1F05621AFC760BF2598057DE7B6ABF45711F50402AE810A7381CB7859C1CBD9

Uniqueness

Uniqueness Score: -1.00%

Function 006A5FA7 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006B7007: lstrcpy.KERNEL32(?,00000000), ref: 006B704D

Part of subcall function 006A46D7: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006A475D
Part of subcall function 006A46D7: InternetCrackUrlA.WININET(00000000,00000000), ref: 006A476D

InternetOpenA.WININET(0041D7D3,00000001,00000000,00000000,00000000), ref: 006A6016
StrCmpCA.SHLWAPI(?,00624C68), ref: 006A604E
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 006A6096
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 006A60BA
InternetReadFile.WININET(?,?,00000400,?), ref: 006A60E3
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 006A6111
CloseHandle.KERNEL32(?,?,00000400), ref: 006A6150
InternetCloseHandle.WININET(?), ref: 006A615A
InternetCloseHandle.WININET(00000000), ref: 006A6167

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 70d34ce9bea8a1359cdd25077828563097f5ce62b16191c8419b5346d4ddca54
Instruction ID: 950d6bca9174c82df1b185bf2d5b123b773335d7bd527c5f66218abf59c1b253
Opcode Fuzzy Hash: 70d34ce9bea8a1359cdd25077828563097f5ce62b16191c8419b5346d4ddca54
Instruction Fuzzy Hash: 185184B1A00608AFDB20EF64CC95BEE777AAB84301F108099B605A71C1DB74AFC5CF55

Uniqueness

Uniqueness Score: -1.00%

Function 006B4BC7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,00000000,00000000,?,00624B54,00000000,?,0041D774,00000000,?,00000000,00000000,?,0062496C), ref: 006B4BD4
RtlAllocateHeap.NTDLL(00000000), ref: 006B4BDB
GlobalMemoryStatusEx.KERNEL32(00000040), ref: 006B4BFC
__aulldiv.LIBCMT ref: 006B4C16
__aulldiv.LIBCMT ref: 006B4C24
wsprintfA.USER32 ref: 006B4C50

Strings

@, xrefs: 006B4BF1

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: @
API String ID: 2774356765-2766056989
Opcode ID: f62cb7ad2578be9c21b89e6e1bf921e4f1007482674ad6998ac9b57a816d1492
Instruction ID: 4be83fba67029fedab50aad5bda9c231d6facfddb186c5a23da8ae36a55dec9e
Opcode Fuzzy Hash: f62cb7ad2578be9c21b89e6e1bf921e4f1007482674ad6998ac9b57a816d1492
Instruction Fuzzy Hash: D6111BF0D40308ABEB10DBE4CC49FEEB7B9BB44704F104548F705AB285DBB4A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00418843 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041884F

Part of subcall function 00417B2C: __getptd_noexit.LIBCMT ref: 00417B2F
Part of subcall function 00417B2C: __amsg_exit.LIBCMT ref: 00417B3C

__amsg_exit.LIBCMT ref: 0041886F
__lock.LIBCMT ref: 0041887F
InterlockedDecrement.KERNEL32(?), ref: 0041889C
_free.LIBCMT ref: 004188AF
InterlockedIncrement.KERNEL32(00423530), ref: 004188C7

Strings

05B, xrefs: 004188B5, 004188BD

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID: 05B
API String ID: 3470314060-3788103304
Opcode ID: cb1538446801220004b0e94d2aebbf41e1672ae537431284a663a37179733970
Instruction ID: f16d68fd9582ac4125616c5e50f94de62243aa4c7be40d45a23fde697d24a6fa
Opcode Fuzzy Hash: cb1538446801220004b0e94d2aebbf41e1672ae537431284a663a37179733970
Instruction Fuzzy Hash: 4501AD32A05621ABD720BF6A98057CA7770AF04725F90402FF810A3390CB7CA9C2CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00413430 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,004136E6,0041D6E3), ref: 00413434
ExitProcess.KERNEL32 ref: 00413465
ExitProcess.KERNEL32 ref: 0041346F
ExitProcess.KERNEL32 ref: 00413479
ExitProcess.KERNEL32 ref: 00413483
ExitProcess.KERNEL32 ref: 0041348D

Strings

*, xrefs: 0041344C

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: b54c11c67429caad35af0389be56d96782f86342cf804ea28b4a9cbeb8073ebc
Instruction ID: 75b540bad49881e9417c8f8c63d74940121d586cf5f959f7794e893d96f52075
Opcode Fuzzy Hash: b54c11c67429caad35af0389be56d96782f86342cf804ea28b4a9cbeb8073ebc
Instruction Fuzzy Hash: 4BF05830508608EFE364EFE0EF0976CBBB1EB8E703F001195E60A86290CA744A119B65

Uniqueness

Uniqueness Score: -1.00%

Function 006A7207 Relevance: 12.1, APIs: 8, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006A6F07: memset.MSVCRT ref: 006A6F4B
Part of subcall function 006A6F07: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 006A6F71
Part of subcall function 006A6F07: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 006A6FE8
Part of subcall function 006A6F07: StrStrA.SHLWAPI(00000000,0041DD64,00000000), ref: 006A7044
Part of subcall function 006A6F07: GetProcessHeap.KERNEL32(00000000,?), ref: 006A7089
Part of subcall function 006A6F07: HeapFree.KERNEL32(00000000), ref: 006A7090

lstrcat.KERNEL32(00624E34,0041DEB8), ref: 006A723D
lstrcat.KERNEL32(00624E34,00000000), ref: 006A727F
lstrcat.KERNEL32(00624E34,0041DEBC), ref: 006A7291
lstrcat.KERNEL32(00624E34,00000000), ref: 006A72C6
lstrcat.KERNEL32(00624E34,0041DEC0), ref: 006A72D7
lstrcat.KERNEL32(00624E34,00000000), ref: 006A730A
lstrcat.KERNEL32(00624E34,0041DEC4), ref: 006A7324
task.LIBCPMTD ref: 006A7332

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID:
API String ID: 3191641157-0
Opcode ID: 9397bf8d36376b94ab8d5b1f9d61ba5fef7cd9a4105ae52593d090ef9b88bb39
Instruction ID: aac26dfcc9705514b2e0d8bf8bb4185b2f1d36fdeca9ad71660d6314bb22aab6
Opcode Fuzzy Hash: 9397bf8d36376b94ab8d5b1f9d61ba5fef7cd9a4105ae52593d090ef9b88bb39
Instruction Fuzzy Hash: 5E314FB2905505AFCB15FBA0DD99EFE777BBF55301B105018F202AB260DA34AD42CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00413BC0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00413BDF
??_U@YAPAXI@Z.MSVCRT ref: 00413C0D

Part of subcall function 00413890: strlen.MSVCRT ref: 004138A1
Part of subcall function 00413890: strlen.MSVCRT ref: 004138C5

VirtualQueryEx.KERNEL32(00413FCD,00000000,?,0000001C), ref: 00413C52
??_V@YAXPAX@Z.MSVCRT ref: 00413D73

Part of subcall function 00413AA0: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00413AB8

Strings

@, xrefs: 00413C66
Z>A, xrefs: 00413C38, 00413C3B

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @$Z>A
API String ID: 2950663791-2427737632
Opcode ID: c34cf874e28939f0e2f9d61df82db9ff8d9d9859511bff8662e41e87a2571aa0
Instruction ID: 18b3d1c53e1ab9283c7d4f20bb5e0d2682d9205760932c7229ac25ba092b9e39
Opcode Fuzzy Hash: c34cf874e28939f0e2f9d61df82db9ff8d9d9859511bff8662e41e87a2571aa0
Instruction Fuzzy Hash: 2851F9B5D00109ABDB04CF98E981AEFB7B5FF88305F108119F919A7340D738AA51CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 006A6F07 Relevance: 10.6, APIs: 7, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 006A6F4B
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 006A6F71
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 006A6FE8
StrStrA.SHLWAPI(00000000,0041DD64,00000000), ref: 006A7044
GetProcessHeap.KERNEL32(00000000,?), ref: 006A7089
HeapFree.KERNEL32(00000000), ref: 006A7090

Part of subcall function 006A8E87: vsprintf_s.MSVCRT ref: 006A8EA2

task.LIBCPMTD ref: 006A718C

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID:
API String ID: 2698061284-0
Opcode ID: 7f3f322cfc82e394cd4b1814abd93527b8f77dc1ed81e7b0c363f998f6c98cb9
Instruction ID: 6f7f9d3a195c031b313634e330b1e3fb7ae8099242cfb1b8aacee5c9e175e8cf
Opcode Fuzzy Hash: 7f3f322cfc82e394cd4b1814abd93527b8f77dc1ed81e7b0c363f998f6c98cb9
Instruction Fuzzy Hash: B3613DB19041689FDB24EB50CC45FD9B3B9BF59300F0081E9E649A6241DB706FC9CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 006A1537 Relevance: 10.6, APIs: 7, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 006A154E

Part of subcall function 006A14C7: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006A14DB
Part of subcall function 006A14C7: RtlAllocateHeap.NTDLL(00000000), ref: 006A14E2
Part of subcall function 006A14C7: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 006A14FE
Part of subcall function 006A14C7: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 006A151C
Part of subcall function 006A14C7: RegCloseKey.ADVAPI32(?), ref: 006A1526

lstrcat.KERNEL32(?,00000000), ref: 006A1576
lstrlen.KERNEL32(?), ref: 006A1583
lstrcat.KERNEL32(?,0042159C), ref: 006A159E

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

Part of subcall function 006B7217: lstrlen.KERNEL32(?,006249EC,?,004215A4,0041D7D6), ref: 006B722C
Part of subcall function 006B7217: lstrcpy.KERNEL32(00000000), ref: 006B726B
Part of subcall function 006B7217: lstrcat.KERNEL32(00000000,00000000), ref: 006B7279

Part of subcall function 006B7107: lstrcpy.KERNEL32(?,0041D7D6), ref: 006B716C

Part of subcall function 006B54C7: GetSystemTime.KERNEL32(0041D7D7,00624AA0,0041D129,?,?,006A1620,?,0000001A,0041D7D7,00000000,?,006249EC,?,004215A4,0041D7D6), ref: 006B54ED

Part of subcall function 006B7187: lstrcpy.KERNEL32(00000000,?), ref: 006B71D9
Part of subcall function 006B7187: lstrcat.KERNEL32(00000000), ref: 006B71E9

CopyFileA.KERNEL32(?,00000000,00000001), ref: 006A168C

Part of subcall function 006B7007: lstrcpy.KERNEL32(?,00000000), ref: 006B704D

Part of subcall function 006A9607: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006A9633
Part of subcall function 006A9607: GetFileSizeEx.KERNEL32(000000FF,?), ref: 006A9658
Part of subcall function 006A9607: LocalAlloc.KERNEL32(00000040,?), ref: 006A9678
Part of subcall function 006A9607: ReadFile.KERNEL32(000000FF,?,00000000,006A16B6,00000000), ref: 006A96A1
Part of subcall function 006A9607: LocalFree.KERNEL32(006A16B6), ref: 006A96D7
Part of subcall function 006A9607: CloseHandle.KERNEL32(000000FF), ref: 006A96E1

DeleteFileA.KERNEL32(00000000), ref: 006A1710
memset.MSVCRT ref: 006A1737

Part of subcall function 006A5027: lstrlen.KERNEL32(00000000), ref: 006A50B1
Part of subcall function 006A5027: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 006A5122
Part of subcall function 006A5027: StrCmpCA.SHLWAPI(?,00624C68), ref: 006A5140

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$lstrlen$CloseHeapLocalOpenmemset$AllocAllocateCopyCreateDeleteFreeHandleInternetProcessQueryReadSizeSystemTimeValue
String ID:
API String ID: 2735668777-0
Opcode ID: c8c279b3544a7551f314603e9532084fce410a271062ba78105d9905d8ac38f5
Instruction ID: 2bc997c5d40c4eb6c162b850fc40fc56d1443a1640cfaabfee14a2fef90e716c
Opcode Fuzzy Hash: c8c279b3544a7551f314603e9532084fce410a271062ba78105d9905d8ac38f5
Instruction Fuzzy Hash: AD512EF1D402189BCB65FB60DD92EED737AAF94300F40519DB60A62191EE305BC9CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 006A4ED7 Relevance: 10.6, APIs: 7, Instructions: 81networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 006A4EF1
RtlAllocateHeap.NTDLL(00000000), ref: 006A4EF8
InternetOpenA.WININET(0041D79B,00000000,00000000,00000000,00000000), ref: 006A4F11
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 006A4F38
InternetReadFile.WININET(?,?,00000400,00000000), ref: 006A4F68
InternetCloseHandle.WININET(?), ref: 006A4FDC
InternetCloseHandle.WININET(?), ref: 006A4FE9

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: f2ce6417e6930b23450b1961e67bb297c29231f482b2b7d409ac886f68cddac0
Instruction ID: 5ad854ecbc86aaeaf907cc167d42d40518b02b40e73e08036ba5d6bb76fc0192
Opcode Fuzzy Hash: f2ce6417e6930b23450b1961e67bb297c29231f482b2b7d409ac886f68cddac0
Instruction Fuzzy Hash: 8331E7F4A40218ABDB20DF54DD85BDDB7B5BB88304F5081D9B609A7281DBB06EC58F98

Uniqueness

Uniqueness Score: -1.00%

Function 006B1FE7 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 006B200C
RegOpenKeyExA.ADVAPI32(80000001,00624CBC,00000000,00020119,?), ref: 006B202B
RegQueryValueExA.ADVAPI32(?,006248D4,00000000,00000000,00000000,000000FF), ref: 006B204F
RegCloseKey.ADVAPI32(?), ref: 006B2059
lstrcat.KERNEL32(?,00000000), ref: 006B207E
lstrcat.KERNEL32(?,00624964), ref: 006B2092

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 8539df6e52ea8c8c9330ac04aa026fc9553460f4399a595536ed05b40d02364f
Instruction ID: cdddfd0357fa23397b93e2cd5b29bf16d82fbe1d3ae8148bbb395c72ecb36c32
Opcode Fuzzy Hash: 8539df6e52ea8c8c9330ac04aa026fc9553460f4399a595536ed05b40d02364f
Instruction Fuzzy Hash: 144161B2D1010CABDB55FBE0DD56EEA773BAB8A700F00454CB6295A180EE709B848BD1

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00417BAE

Part of subcall function 00417641: __mtinitlocknum.LIBCMT ref: 00417657
Part of subcall function 00417641: __amsg_exit.LIBCMT ref: 00417663
Part of subcall function 00417641: EnterCriticalSection.KERNEL32(00000000,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D,?,?,00417158,00000000,00421AC0,0041719F), ref: 0041766B

DecodePointer.KERNEL32(004219C8,00000020,00417CF1,00000000,00000001,00000000,?,00417D13,000000FF,?,00417668,00000011,00000000,?,00417A49,0000000D), ref: 00417BEA
DecodePointer.KERNEL32(?,00417D13,000000FF,?,00417668,00000011,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D), ref: 00417BFB

Part of subcall function 004179C2: EncodePointer.KERNEL32(00000000,004191B2,00423DC8,00000314,00000000,?,?,?,?,?,00417F08,00423DC8,Microsoft Visual C++ Runtime Library,00012010), ref: 004179C4

DecodePointer.KERNEL32(-00000004,?,00417D13,000000FF,?,00417668,00000011,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D), ref: 00417C21
DecodePointer.KERNEL32(?,00417D13,000000FF,?,00417668,00000011,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D), ref: 00417C34
DecodePointer.KERNEL32(?,00417D13,000000FF,?,00417668,00000011,00000000,?,00417A49,0000000D,?,?,004173CF,0041726D), ref: 00417C3E

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: 6a1b6e47f482ee4f200ebd968e601a8bdb3106e7e8c25533cbe6d2efabcc28cd
Instruction ID: 2ecc3aad81c9b81e2b27e7e3d170e1f8428b359c85680f8586e03e13f1a28f2c
Opcode Fuzzy Hash: 6a1b6e47f482ee4f200ebd968e601a8bdb3106e7e8c25533cbe6d2efabcc28cd
Instruction Fuzzy Hash: 39314C70A58309DBDF509FA9D8846DDBBF1BB48314F10802BE001A6290EB7C49C5CFAD

Uniqueness

Uniqueness Score: -1.00%

Function 006B3917 Relevance: 9.1, APIs: 6, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 006B6137: GetProcAddress.KERNEL32(00625074,00624A00), ref: 006B6178
Part of subcall function 006B6137: GetProcAddress.KERNEL32(00625074,00624DA4), ref: 006B6191
Part of subcall function 006B6137: GetProcAddress.KERNEL32(00625074,00624E10), ref: 006B61A9
Part of subcall function 006B6137: GetProcAddress.KERNEL32(00625074,00624A60), ref: 006B61C1
Part of subcall function 006B6137: GetProcAddress.KERNEL32(00625074,00624A4C), ref: 006B61DA
Part of subcall function 006B6137: GetProcAddress.KERNEL32(00625074,00624AEC), ref: 006B61F2
Part of subcall function 006B6137: GetProcAddress.KERNEL32(00625074,00624CB8), ref: 006B620A
Part of subcall function 006B6137: GetProcAddress.KERNEL32(00625074,00624B30), ref: 006B6223
Part of subcall function 006B6137: GetProcAddress.KERNEL32(00625074,00624D84), ref: 006B623B
Part of subcall function 006B6137: GetProcAddress.KERNEL32(00625074,00624D28), ref: 006B6253
Part of subcall function 006B6137: GetProcAddress.KERNEL32(00625074,00624BAC), ref: 006B626C
Part of subcall function 006B6137: GetProcAddress.KERNEL32(00625074,00624AE0), ref: 006B6284
Part of subcall function 006B6137: GetProcAddress.KERNEL32(00625074,00624DD8), ref: 006B629C
Part of subcall function 006B6137: GetProcAddress.KERNEL32(00625074,006248B0), ref: 006B62B5

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

Part of subcall function 006A13F7: ExitProcess.KERNEL32 ref: 006A1438

Part of subcall function 006A1387: GetSystemInfo.KERNEL32(?), ref: 006A1391
Part of subcall function 006A1387: ExitProcess.KERNEL32 ref: 006A13A5

Part of subcall function 006A1337: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 006A1352
Part of subcall function 006A1337: VirtualAllocExNuma.KERNEL32(00000000), ref: 006A1359
Part of subcall function 006A1337: ExitProcess.KERNEL32 ref: 006A136A

Part of subcall function 006A1447: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 006A1465
Part of subcall function 006A1447: __aulldiv.LIBCMT ref: 006A147F
Part of subcall function 006A1447: __aulldiv.LIBCMT ref: 006A148D
Part of subcall function 006A1447: ExitProcess.KERNEL32 ref: 006A14BB

Part of subcall function 006B3697: GetUserDefaultLangID.KERNEL32 ref: 006B369B

Part of subcall function 006A13B7: ExitProcess.KERNEL32 ref: 006A13ED

Part of subcall function 006B4627: GetProcessHeap.KERNEL32(00000000,00000104,006A13DE,00624DE8), ref: 006B4634
Part of subcall function 006B4627: RtlAllocateHeap.NTDLL(00000000), ref: 006B463B
Part of subcall function 006B4627: GetUserNameA.ADVAPI32(?,00000104), ref: 006B4653

Part of subcall function 006B4667: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006B4674
Part of subcall function 006B4667: RtlAllocateHeap.NTDLL(00000000), ref: 006B467B
Part of subcall function 006B4667: GetComputerNameA.KERNEL32(?,00000104), ref: 006B4693

Part of subcall function 006B7217: lstrlen.KERNEL32(?,006249EC,?,004215A4,0041D7D6), ref: 006B722C
Part of subcall function 006B7217: lstrcpy.KERNEL32(00000000), ref: 006B726B
Part of subcall function 006B7217: lstrcat.KERNEL32(00000000,00000000), ref: 006B7279

Part of subcall function 006B7107: lstrcpy.KERNEL32(?,0041D7D6), ref: 006B716C

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00624D20,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 006B39F1
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 006B3A0F
CloseHandle.KERNEL32(00000000), ref: 006B3A20
Sleep.KERNEL32(00001770), ref: 006B3A2B
CloseHandle.KERNEL32(?,00000000,?,00624D20,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 006B3A41
ExitProcess.KERNEL32 ref: 006B3A49

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 46515f5eae24d0a6147c7cb61a4b11b40ebb98da62e4e0d1738e1df983633f24
Instruction ID: 5fddf135f512ec67f82b2882d996dbc5fb374a2474051c3b2afed58d09c75f98
Opcode Fuzzy Hash: 46515f5eae24d0a6147c7cb61a4b11b40ebb98da62e4e0d1738e1df983633f24
Instruction Fuzzy Hash: 75315CF0A04214AADB54FBF0DC56EFD777BAF85300F10051DB15266682EF709A85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 006A9607 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006A9633
GetFileSizeEx.KERNEL32(000000FF,?), ref: 006A9658
LocalAlloc.KERNEL32(00000040,?), ref: 006A9678
ReadFile.KERNEL32(000000FF,?,00000000,006A16B6,00000000), ref: 006A96A1
LocalFree.KERNEL32(006A16B6), ref: 006A96D7
CloseHandle.KERNEL32(000000FF), ref: 006A96E1

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: f4e0d313ddcfb566cad0ad739db1598a31e32847b8e3d9904cd15aeed94fad13
Instruction ID: 0dd3800ab48cf0e75e1e54af0f5bde73b7cda6be3f71e1a6d43ad5d2411cac50
Opcode Fuzzy Hash: f4e0d313ddcfb566cad0ad739db1598a31e32847b8e3d9904cd15aeed94fad13
Instruction Fuzzy Hash: DD312174A00209EFDB24DF94C895BEE77B6BF49300F205158E911A7390D774AD41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00415960 Relevance: 9.0, APIs: 4, Strings: 2, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(008551F8,?,?,?,0040F76C,?,008551F8,00000000), ref: 0041596C
lstrcpyn.KERNEL32(C:\Users\user\AppData\Roaming\mRemoteNG\,008551F8,008551F8,?,0040F76C,?,008551F8), ref: 00415990
lstrlen.KERNEL32(?,?,0040F76C,?,008551F8), ref: 004159A7
wsprintfA.USER32 ref: 004159C7

Strings

%s%s, xrefs: 004159B5
C:\Users\user\AppData\Roaming\mRemoteNG\, xrefs: 0041598B, 004159C0, 004159D0

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s$C:\Users\user\AppData\Roaming\mRemoteNG\
API String ID: 1206339513-1027354905
Opcode ID: 145a19e204c32b80f721800f8dc263c6d3553908343d9ba3445ddbc103129e49
Instruction ID: ad4ab28855ecf1822f83189248f4f970b5300654cb1d5d0a0ffaf2e78bbea45f
Opcode Fuzzy Hash: 145a19e204c32b80f721800f8dc263c6d3553908343d9ba3445ddbc103129e49
Instruction Fuzzy Hash: 69015A75510908FFCB14DFA8D948EAE7BB9FF88344F108588F90A9B340CA71AA40CB94

Uniqueness

Uniqueness Score: -1.00%

Function 006B3E27 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 006B3E46
??_U@YAPAXI@Z.MSVCRT ref: 006B3E74

Part of subcall function 006B3AF7: strlen.MSVCRT ref: 006B3B08
Part of subcall function 006B3AF7: strlen.MSVCRT ref: 006B3B2C

VirtualQueryEx.KERNEL32(?,00000000,?,0000001C), ref: 006B3EB9
??_V@YAXPAX@Z.MSVCRT ref: 006B3FDA

Part of subcall function 006B3D07: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 006B3D1F

Strings

@, xrefs: 006B3ECD

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @
API String ID: 2950663791-2766056989
Opcode ID: c34cf874e28939f0e2f9d61df82db9ff8d9d9859511bff8662e41e87a2571aa0
Instruction ID: bbc09dc93cd5c1c7fc3ecf0e375a3e19aef240d974b9617cc3d8393630b24c40
Opcode Fuzzy Hash: c34cf874e28939f0e2f9d61df82db9ff8d9d9859511bff8662e41e87a2571aa0
Instruction Fuzzy Hash: 2051E2B5E00119ABDB04CF98D891AEFB7BAFF88300F108119F919A7340D735EA51CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 006B2657 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00624B00), ref: 006B26B2

Part of subcall function 006B5747: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006B5772

lstrcat.KERNEL32(?,00000000), ref: 006B26D8
lstrcat.KERNEL32(?,?), ref: 006B26F7
lstrcat.KERNEL32(?,?), ref: 006B270B
lstrcat.KERNEL32(?,00624A80), ref: 006B271E
lstrcat.KERNEL32(?,?), ref: 006B2732
lstrcat.KERNEL32(?,00624AC0), ref: 006B2746

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

Part of subcall function 006B56F7: GetFileAttributesA.KERNEL32(00000000,?,006A1CAB,?,?,004215E4,?,?,0041D7E2), ref: 006B5706

Part of subcall function 006B2457: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 006B2467
Part of subcall function 006B2457: RtlAllocateHeap.NTDLL(00000000), ref: 006B246E
Part of subcall function 006B2457: wsprintfA.USER32 ref: 006B248A
Part of subcall function 006B2457: FindFirstFileA.KERNEL32(?,?), ref: 006B24A1

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: b61a0952c10ec22559f8ff21dd1990cb91526dcb0d4337808e705547aad6b932
Instruction ID: 4af2c2a3d629b64371dd744af5f305c6444b59a19994a48c4dbaac8f948325e7
Opcode Fuzzy Hash: b61a0952c10ec22559f8ff21dd1990cb91526dcb0d4337808e705547aad6b932
Instruction Fuzzy Hash: 243183F294061867CB64FBA0DC89EE9737EAF58700F44058DB7569A081EEB497C8CF94

Uniqueness

Uniqueness Score: -1.00%

Function 006A1447 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 006A1465
__aulldiv.LIBCMT ref: 006A147F
__aulldiv.LIBCMT ref: 006A148D
ExitProcess.KERNEL32 ref: 006A14BB

Strings

@, xrefs: 006A145A

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: bb81cb4acda70f26030c3c2501203c3bf716c46d07ed01ddf58a3b899f1b5564
Instruction ID: d27755231f37ee2acdc61891f96bbd332f4411afadd563fcd8ecb9c2bc287257
Opcode Fuzzy Hash: bb81cb4acda70f26030c3c2501203c3bf716c46d07ed01ddf58a3b899f1b5564
Instruction Fuzzy Hash: 660162B0D40308FAEB10EBD4CD45BDDB6F9EB46705F248048E705BA2C0D77499458F69

Uniqueness

Uniqueness Score: -1.00%

Function 0040F200 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0040F228
strtok_s.MSVCRT ref: 0040F36D

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,0084A930,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 89292260d13e06a3ccf44185258d8082ce40877a689944c47bb1047c3bb279de
Instruction ID: 34556820f6e5338ba8e8a845a83fb71131f6fb13afd6d5a2f2d9a2f2ab0dc7f0
Opcode Fuzzy Hash: 89292260d13e06a3ccf44185258d8082ce40877a689944c47bb1047c3bb279de
Instruction Fuzzy Hash: 4F514FB5A04209DFCB18CF54D595AAE7BB6FF48308F10817DE802AB390D734EA95CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004097F0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 115memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 0040980B
memset.MSVCRT ref: 0040983E
LocalAlloc.KERNEL32(00000040,?), ref: 0040988E

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416E20: lstrlen.KERNEL32(00000000,?,?,00412BE0,0041D59B,0041D59A,?,?,004137D6,00000000,?,0084A930,?,0041D8AC,?,00000000), ref: 00416E2B
Part of subcall function 00416E20: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416E85

Part of subcall function 00416DA0: lstrcpy.KERNEL32(?,00000000), ref: 00416DE6

Strings

v10, xrefs: 00409802
@, xrefs: 00409847

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocallstrlenmemcmpmemset
String ID: @$v10
API String ID: 1400469952-24753345
Opcode ID: 6d1a1abe6e6826a1ce0dbdd1ef6ea650f8487a8d622505b14063b63e06140071
Instruction ID: 87859f0eaa1cac66c0422607c8296a2f5b7cfd88fdb957a476e5adb471fb7cf1
Opcode Fuzzy Hash: 6d1a1abe6e6826a1ce0dbdd1ef6ea650f8487a8d622505b14063b63e06140071
Instruction Fuzzy Hash: 00414EB0A00208EBDB04DFA5DC55FDE7B75BF44304F108119F909AB295DB78AE85CB98

Uniqueness

Uniqueness Score: -1.00%

Function 006B8C93 Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

IsValidCodePage.KERNEL32 ref: 006B8CC4
GetCPInfo.KERNEL32(?,?), ref: 006B8CD7
memset.MSVCRT ref: 006B8CEF
setSBUpLow.LIBCMT ref: 006B8DC5

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValidmemset
String ID:
API String ID: 703783727-0
Opcode ID: 6951f29c36c94b1d073d54955c1dcc818f8d448c9a4e816d0e34e81470273be2
Instruction ID: 14806cf527faf5350390d1b90455e6d49ca789a5eb83a8885aea2e8c8deeea5b
Opcode Fuzzy Hash: 6951f29c36c94b1d073d54955c1dcc818f8d448c9a4e816d0e34e81470273be2
Instruction Fuzzy Hash: B43129A0A042958FDB259F34C8813FABFAA9F55301F18456FD891DB2C2CF38C886D750

Uniqueness

Uniqueness Score: -1.00%

Function 006B3847 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 006B3893
sscanf.NTDLL ref: 006B38C0
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006B38D9
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006B38E7
ExitProcess.KERNEL32 ref: 006B3901

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 3210208c9ff9191fbd103aa9c2d0b3e8e7c47af46a118988f5807df95a5cb685
Instruction ID: 3c8690fb1c5a119acea46c66fd4877a1e6aa60e2e5dc0dfe5113e34115f82fdb
Opcode Fuzzy Hash: 3210208c9ff9191fbd103aa9c2d0b3e8e7c47af46a118988f5807df95a5cb685
Instruction Fuzzy Hash: 2221DCB5E04219ABCF54EFE4D9459EEB7B6BF8C300F04852EE506E3250EB345644CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004135E0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(0041D8AC,?,?,004137D1,00000000,?,0084A930,?,0041D8AC,?,00000000,?), ref: 0041362C
sscanf.NTDLL ref: 00413659
SystemTimeToFileTime.KERNEL32(0041D8AC,00000000,?,?,?,?,?,?,?,?,?,?,?,0084A930,?,0041D8AC), ref: 00413672
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,0084A930,?,0041D8AC), ref: 00413680
ExitProcess.KERNEL32 ref: 0041369A

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 1317ddf1f9c1afdd93909f223843f69075992d328c88535c6b58c76ddc48183c
Instruction ID: a268315634fda69ed0a537ef202e87298384d27024bdd5aae2ec85167a5c17e0
Opcode Fuzzy Hash: 1317ddf1f9c1afdd93909f223843f69075992d328c88535c6b58c76ddc48183c
Instruction Fuzzy Hash: 6421BA75D14209ABCB14EFE4D945AEEB7BABF4C305F04852EE50AE3250EB345644CB68

Uniqueness

Uniqueness Score: -1.00%

Function 006B5BC7 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(?,?), ref: 006B5BD3
lstrcpyn.KERNEL32(00625310,?,?), ref: 006B5BF7
lstrlen.KERNEL32(?), ref: 006B5C0E
wsprintfA.USER32 ref: 006B5C2E

Strings

C:\Users\user\AppData\Roaming\mRemoteNG\, xrefs: 006B5BF2, 006B5C27, 006B5C37

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: C:\Users\user\AppData\Roaming\mRemoteNG\
API String ID: 1206339513-1097819735
Opcode ID: 145a19e204c32b80f721800f8dc263c6d3553908343d9ba3445ddbc103129e49
Instruction ID: c464bde301ef6d22cab64705b4d924978e9695e0b561d3727c9aaef7ccf82cd1
Opcode Fuzzy Hash: 145a19e204c32b80f721800f8dc263c6d3553908343d9ba3445ddbc103129e49
Instruction Fuzzy Hash: 18015E75510508FFCB14DFA8D944EAE7B7AFF48344F108588F90A9B340CB71AA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 006A14C7 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006A14DB
RtlAllocateHeap.NTDLL(00000000), ref: 006A14E2
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 006A14FE
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 006A151C
RegCloseKey.ADVAPI32(?), ref: 006A1526

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: df6da7dedf044903e367d3d8a7ae0c03a7d74832a2c3d67e0360b54011cb2cfc
Instruction ID: 45f5d502073f56c1e4709fbd8acf9139ace9282611790cff60f9c1cd40193edd
Opcode Fuzzy Hash: df6da7dedf044903e367d3d8a7ae0c03a7d74832a2c3d67e0360b54011cb2cfc
Instruction Fuzzy Hash: 99011DB9A40608BFDB20DFE0DD49FAEB77DAB88700F008154FA0697280DA709A018B90

Uniqueness

Uniqueness Score: -1.00%

Function 006B4567 Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 006B457B
RtlAllocateHeap.NTDLL(00000000), ref: 006B4582
RegOpenKeyExA.ADVAPI32(80000002,00624B8C,00000000,00020119,00000000), ref: 006B45A2
RegQueryValueExA.ADVAPI32(00000000,00624C24,00000000,00000000,000000FF,000000FF), ref: 006B45C3
RegCloseKey.ADVAPI32(00000000), ref: 006B45CD

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 423f413abd2b9c08310d568d7ed0a8882adbdfbf2920ff6ae677e6fc83315809
Instruction ID: eda40868f1afc4cc421103cd7ce2ac1d00803bacb491d84dccc09276a7baa6fa
Opcode Fuzzy Hash: 423f413abd2b9c08310d568d7ed0a8882adbdfbf2920ff6ae677e6fc83315809
Instruction Fuzzy Hash: 1A013CB5A40608BFDB20DBE4ED49FAEB77DEB88701F005154FA05A7294DA70AA058B90

Uniqueness

Uniqueness Score: -1.00%

Function 006B49A7 Relevance: 7.5, APIs: 5, Instructions: 38registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 006B49BB
RtlAllocateHeap.NTDLL(00000000), ref: 006B49C2
RegOpenKeyExA.ADVAPI32(80000002,006249D0,00000000,00020119,00000000), ref: 006B49E2
RegQueryValueExA.ADVAPI32(00000000,00624CD0,00000000,00000000,000000FF,000000FF), ref: 006B4A03
RegCloseKey.ADVAPI32(00000000), ref: 006B4A0D

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 3dd853a6faa74efcafe4ce3258c312c5c269cfcf31c2ef5712d88dc1f31cf0da
Instruction ID: 4968a6f64b57b5eb457453632c8b91457a4d4dbd4bb29679a9ad4d720f4d8f43
Opcode Fuzzy Hash: 3dd853a6faa74efcafe4ce3258c312c5c269cfcf31c2ef5712d88dc1f31cf0da
Instruction Fuzzy Hash: 87013CB5A40608FFDB20DBE4ED49FAEB77DEB88700F008158FA05E6294DA705A05CF90

Uniqueness

Uniqueness Score: -1.00%

Function 006B880E Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 006B881A

Part of subcall function 006B7D93: __getptd_noexit.LIBCMT ref: 006B7D96
Part of subcall function 006B7D93: __amsg_exit.LIBCMT ref: 006B7DA3

__getptd.LIBCMT ref: 006B8831
__amsg_exit.LIBCMT ref: 006B883F
__lock.LIBCMT ref: 006B884F
__updatetlocinfoEx_nolock.LIBCMT ref: 006B8863

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: cc7480a914060d8b5643a9d0b0f25a761215b1338a518c63d358d0bb6fed0dfa
Instruction ID: f62943eb430a0f8a8ec2126f26e1f034b43bd86fddf82757fde8a70f121d4fb6
Opcode Fuzzy Hash: cc7480a914060d8b5643a9d0b0f25a761215b1338a518c63d358d0bb6fed0dfa
Instruction Fuzzy Hash: 95F062B2A082109FD7A1BB6498067DD33A79F80721F94412DF404672D3CF6859C1DB5D

Uniqueness

Uniqueness Score: -1.00%

Function 004185A7 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004185B3

Part of subcall function 00417B2C: __getptd_noexit.LIBCMT ref: 00417B2F
Part of subcall function 00417B2C: __amsg_exit.LIBCMT ref: 00417B3C

__getptd.LIBCMT ref: 004185CA
__amsg_exit.LIBCMT ref: 004185D8
__lock.LIBCMT ref: 004185E8
__updatetlocinfoEx_nolock.LIBCMT ref: 004185FC

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: ce05a91ea9c2b8e711ac95fae42e6a284d9b9390d13ac8f67e08820a18d7d66a
Instruction ID: cdd0eec35e4bf80da2317afb9b55000317a90f0185e5a3c9ee5e330d7cc08b67
Opcode Fuzzy Hash: ce05a91ea9c2b8e711ac95fae42e6a284d9b9390d13ac8f67e08820a18d7d66a
Instruction Fuzzy Hash: A4F09632A49710AAD721BBBA9C027CA77B1AF00739F10411FF505A62D2CF6C69C1CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 006A9BD7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(006248B4,00625B18,0000FFFF), ref: 006A9BF4
LoadLibraryA.KERNEL32(00624D5C), ref: 006A9C7D

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

Part of subcall function 006B7087: lstrlen.KERNEL32(006A4E2C,?,?,006A4E2C,0041D79A), ref: 006B7092
Part of subcall function 006B7087: lstrcpy.KERNEL32(0041D79A,00000000), ref: 006B70EC

Part of subcall function 006B7217: lstrlen.KERNEL32(?,006249EC,?,004215A4,0041D7D6), ref: 006B722C
Part of subcall function 006B7217: lstrcpy.KERNEL32(00000000), ref: 006B726B
Part of subcall function 006B7217: lstrcat.KERNEL32(00000000,00000000), ref: 006B7279

Part of subcall function 006B7187: lstrcpy.KERNEL32(00000000,?), ref: 006B71D9
Part of subcall function 006B7187: lstrcat.KERNEL32(00000000), ref: 006B71E9

Part of subcall function 006B7107: lstrcpy.KERNEL32(?,0041D7D6), ref: 006B716C

SetEnvironmentVariableA.KERNEL32(006248B4,00000000,00000000,?,0041DA4C,?,?,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0041D6EF), ref: 006A9C69

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 006A9BE9, 006A9BFD, 006A9C13

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: b2dd7637c59b690ccd9544fd7c3a25ee13020c69252a2405901a327e0c7b7510
Instruction ID: 6a4a825096b739c34a6c355ca861474bc6640b54cc91a722a284f4d776a2d5c4
Opcode Fuzzy Hash: b2dd7637c59b690ccd9544fd7c3a25ee13020c69252a2405901a327e0c7b7510
Instruction Fuzzy Hash: 99418EB1904A009BDB64EBA4ED89AE937B7FF48301F15511DF142A72A0DFB09D86CF20

Uniqueness

Uniqueness Score: -1.00%

Function 006B3557 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 006B358A

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

Part of subcall function 006B7217: lstrlen.KERNEL32(?,006249EC,?,004215A4,0041D7D6), ref: 006B722C
Part of subcall function 006B7217: lstrcpy.KERNEL32(00000000), ref: 006B726B
Part of subcall function 006B7217: lstrcat.KERNEL32(00000000,00000000), ref: 006B7279

Part of subcall function 006B7107: lstrcpy.KERNEL32(?,0041D7D6), ref: 006B716C

ShellExecuteEx.SHELL32(0000003C), ref: 006B364D
ExitProcess.KERNEL32 ref: 006B367C

Strings

<, xrefs: 006B3600

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 966933ccc87c1a91f6790240733d41a2cf755532164395114738cccf7d819298
Instruction ID: ce5889d2b05f5c933986628fdc41b25ccf7bd97105fe47e2b80529e955cd0687
Opcode Fuzzy Hash: 966933ccc87c1a91f6790240733d41a2cf755532164395114738cccf7d819298
Instruction Fuzzy Hash: 46312CF1D012189ADB54EB90DD92FEDB779AF84300F80518DF20666191DF746B88CF68

Uniqueness

Uniqueness Score: -1.00%

Function 004132F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00413323

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

ShellExecuteEx.SHELL32(0000003C), ref: 004133E6
ExitProcess.KERNEL32 ref: 00413415

Strings

<, xrefs: 00413399

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: a5d1b37f986b235e74009d80e8fbc32bcc8850f3779d9eab120d07b03b3823a9
Instruction ID: 9270ca21e45796c21bf284f368f95b7d0dbf71ea93a5a7258f1c6a627d8bac6b
Opcode Fuzzy Hash: a5d1b37f986b235e74009d80e8fbc32bcc8850f3779d9eab120d07b03b3823a9
Instruction Fuzzy Hash: 383144B19012189BDB14EB91DD91FDDBB78AF48304F80518DF20566191DF746B89CF9C

Uniqueness

Uniqueness Score: -1.00%

Function 00415450 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00415C1E,00000000), ref: 0041545B
HeapAlloc.KERNEL32(00000000,?,?,00415C1E,00000000), ref: 00415462
wsprintfW.USER32 ref: 00415478

Strings

%hs, xrefs: 0041546F

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: 9d0e4c61c44ae66937b299eb0154705507e44eb3acdcd074a2a0d5819eeee3b8
Instruction ID: 2a04a3b42468460cff415e79ad4cc7303691da2b1e165ac812b33aed5ccf4e4e
Opcode Fuzzy Hash: 9d0e4c61c44ae66937b299eb0154705507e44eb3acdcd074a2a0d5819eeee3b8
Instruction Fuzzy Hash: A5E0ECB5A40608BFDB20DFD4ED0AEAD77A9EB48701F100194F90AD7640DA719E109B95

Uniqueness

Uniqueness Score: -1.00%

Function 006A9D97 Relevance: 6.4, APIs: 4, Instructions: 360filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

Part of subcall function 006B7217: lstrlen.KERNEL32(?,006249EC,?,004215A4,0041D7D6), ref: 006B722C
Part of subcall function 006B7217: lstrcpy.KERNEL32(00000000), ref: 006B726B
Part of subcall function 006B7217: lstrcat.KERNEL32(00000000,00000000), ref: 006B7279

Part of subcall function 006B7107: lstrcpy.KERNEL32(?,0041D7D6), ref: 006B716C

Part of subcall function 006B54C7: GetSystemTime.KERNEL32(0041D7D7,00624AA0,0041D129,?,?,006A1620,?,0000001A,0041D7D7,00000000,?,006249EC,?,004215A4,0041D7D6), ref: 006B54ED

Part of subcall function 006B7187: lstrcpy.KERNEL32(00000000,?), ref: 006B71D9
Part of subcall function 006B7187: lstrcat.KERNEL32(00000000), ref: 006B71E9

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006A9E18
lstrlen.KERNEL32(00000000), ref: 006AA1D1

Part of subcall function 006A9A57: memcmp.MSVCRT ref: 006A9A72
Part of subcall function 006A9A57: memset.MSVCRT ref: 006A9AA5
Part of subcall function 006A9A57: LocalAlloc.KERNEL32(00000040,?), ref: 006A9AF5

lstrlen.KERNEL32(00000000,00000000), ref: 006A9F14
DeleteFileA.KERNEL32(00000000), ref: 006AA252

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$AllocCopyDeleteLocalSystemTimememcmpmemset
String ID:
API String ID: 3258613111-0
Opcode ID: 799f4e43c5f134c97f91417602cae88205eca33e556a901edf62be0764f24219
Instruction ID: dfa760d9fa27c3e5925fc0530c68589a62a428275dd43e3873c9d37f43d122e3
Opcode Fuzzy Hash: 799f4e43c5f134c97f91417602cae88205eca33e556a901edf62be0764f24219
Instruction Fuzzy Hash: 6AD1A9F2C041189ACB55FBA4DCA2DEE733AAF94300F54915EF15672192EF306B88CB65

Uniqueness

Uniqueness Score: -1.00%

Function 006ACDB7 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

Part of subcall function 006B7217: lstrlen.KERNEL32(?,006249EC,?,004215A4,0041D7D6), ref: 006B722C
Part of subcall function 006B7217: lstrcpy.KERNEL32(00000000), ref: 006B726B
Part of subcall function 006B7217: lstrcat.KERNEL32(00000000,00000000), ref: 006B7279

Part of subcall function 006B7107: lstrcpy.KERNEL32(?,0041D7D6), ref: 006B716C

Part of subcall function 006B54C7: GetSystemTime.KERNEL32(0041D7D7,00624AA0,0041D129,?,?,006A1620,?,0000001A,0041D7D7,00000000,?,006249EC,?,004215A4,0041D7D6), ref: 006B54ED

Part of subcall function 006B7187: lstrcpy.KERNEL32(00000000,?), ref: 006B71D9
Part of subcall function 006B7187: lstrcat.KERNEL32(00000000), ref: 006B71E9

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006ACE38
lstrlen.KERNEL32(00000000), ref: 006AD04F
lstrlen.KERNEL32(00000000), ref: 006AD063
DeleteFileA.KERNEL32(00000000), ref: 006AD0DC

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: be897372b75303ba80917d01fc52a5d1a0540ec3c5e777bfdcc3a35dd85c6f1a
Instruction ID: 05d2ab729878db866beb243e44bac18380604209ef2f8f3fa0b1032ca631fe0a
Opcode Fuzzy Hash: be897372b75303ba80917d01fc52a5d1a0540ec3c5e777bfdcc3a35dd85c6f1a
Instruction Fuzzy Hash: 44911CF2D041089ACF54FBA4DCA2DEE733AAF94300F50416DF516A2191EF34AB89CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040CB50 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Part of subcall function 00416FB0: lstrlen.KERNEL32(?,0041D8B0,?,00000000,0041D6E3), ref: 00416FC5
Part of subcall function 00416FB0: lstrcpy.KERNEL32(00000000), ref: 00417004
Part of subcall function 00416FB0: lstrcat.KERNEL32(00000000,00000000), ref: 00417012

Part of subcall function 00416EA0: lstrcpy.KERNEL32(?,0041D6E3), ref: 00416F05

Part of subcall function 00415260: GetSystemTime.KERNEL32(?,0084FF90,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Part of subcall function 00416F20: lstrcpy.KERNEL32(00000000,?), ref: 00416F72
Part of subcall function 00416F20: lstrcat.KERNEL32(00000000), ref: 00416F82

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040CBD1
lstrlen.KERNEL32(00000000), ref: 0040CDE8
lstrlen.KERNEL32(00000000), ref: 0040CDFC
DeleteFileA.KERNEL32(00000000), ref: 0040CE75

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 13c4360a770eee10df006b79e432abb8dc62caa594f8ba422d42d8748747eb26
Instruction ID: 6e212494759c8e3b152de70cf12e9653d7fde48daaab02ad2b76da051d612c4f
Opcode Fuzzy Hash: 13c4360a770eee10df006b79e432abb8dc62caa594f8ba422d42d8748747eb26
Instruction Fuzzy Hash: 1B914A729102049BCB14FBA1DC51EEE7739BF14304F51425EF51676491EF38AA89CBB8

Uniqueness

Uniqueness Score: -1.00%

Function 006AD127 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

Part of subcall function 006B7217: lstrlen.KERNEL32(?,006249EC,?,004215A4,0041D7D6), ref: 006B722C
Part of subcall function 006B7217: lstrcpy.KERNEL32(00000000), ref: 006B726B
Part of subcall function 006B7217: lstrcat.KERNEL32(00000000,00000000), ref: 006B7279

Part of subcall function 006B7107: lstrcpy.KERNEL32(?,0041D7D6), ref: 006B716C

Part of subcall function 006B54C7: GetSystemTime.KERNEL32(0041D7D7,00624AA0,0041D129,?,?,006A1620,?,0000001A,0041D7D7,00000000,?,006249EC,?,004215A4,0041D7D6), ref: 006B54ED

Part of subcall function 006B7187: lstrcpy.KERNEL32(00000000,?), ref: 006B71D9
Part of subcall function 006B7187: lstrcat.KERNEL32(00000000), ref: 006B71E9

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 006AD1A8
lstrlen.KERNEL32(00000000), ref: 006AD346
lstrlen.KERNEL32(00000000), ref: 006AD35A
DeleteFileA.KERNEL32(00000000), ref: 006AD3D3

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: c558b7e00d0d76aa72a1bcc311bbf49d9e1781368b121fae5ccf1dcd978b6673
Instruction ID: 6b0aa72da5159eebe2f85f86c5524713f29d14a73bc46cad62545611a23dff08
Opcode Fuzzy Hash: c558b7e00d0d76aa72a1bcc311bbf49d9e1781368b121fae5ccf1dcd978b6673
Instruction Fuzzy Hash: A1810FF29042189ACF54FBA4DCA2DEE733ABF94300F50451DF516A6191EF34AB88CB65

Uniqueness

Uniqueness Score: -1.00%

Function 006A9A57 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 115memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 006A9A72
memset.MSVCRT ref: 006A9AA5
LocalAlloc.KERNEL32(00000040,?), ref: 006A9AF5

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

Part of subcall function 006B7087: lstrlen.KERNEL32(006A4E2C,?,?,006A4E2C,0041D79A), ref: 006B7092
Part of subcall function 006B7087: lstrcpy.KERNEL32(0041D79A,00000000), ref: 006B70EC

Part of subcall function 006B7007: lstrcpy.KERNEL32(?,00000000), ref: 006B704D

Strings

@, xrefs: 006A9AAE

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocallstrlenmemcmpmemset
String ID: @
API String ID: 1400469952-2766056989
Opcode ID: cf0923edcf58d9fd68d49d25af9debf8b9c2c01576fe0c70bfcba815ecf84208
Instruction ID: dfdff1ed5e2af03fa9907dd36c1bf101300e9dfc32a3647a2f84ec4c4029ddee
Opcode Fuzzy Hash: cf0923edcf58d9fd68d49d25af9debf8b9c2c01576fe0c70bfcba815ecf84208
Instruction Fuzzy Hash: C641EAB1A14208ABDF04DF94DC55FEE77B6BF44304F108118F509AB694DB74AE85CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 006B5E37 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 006B5E52

Part of subcall function 006B56B7: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,006B5E85,00000000), ref: 006B56C2
Part of subcall function 006B56B7: RtlAllocateHeap.NTDLL(00000000), ref: 006B56C9
Part of subcall function 006B56B7: wsprintfW.USER32 ref: 006B56DF

OpenProcess.KERNEL32(00001001,00000000,?), ref: 006B5F12
TerminateProcess.KERNEL32(00000000,00000000), ref: 006B5F30
CloseHandle.KERNEL32(00000000), ref: 006B5F3D

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 6407d1539de54230c31308d720df9c4720da3bccaf40962f38996e6942d990c9
Instruction ID: a34e5823adda7d96dbf7fe55bf63b93c9968b486dcd483329d6e584da0c4bda3
Opcode Fuzzy Hash: 6407d1539de54230c31308d720df9c4720da3bccaf40962f38996e6942d990c9
Instruction Fuzzy Hash: 99312BB1E00248EFDB24DFE0CD49BEDB7BABB48700F104459F506AA284DB75AA85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00415BD0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00415BEB

Part of subcall function 00415450: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00415C1E,00000000), ref: 0041545B
Part of subcall function 00415450: HeapAlloc.KERNEL32(00000000,?,?,00415C1E,00000000), ref: 00415462
Part of subcall function 00415450: wsprintfW.USER32 ref: 00415478

OpenProcess.KERNEL32(00001001,00000000,?), ref: 00415CAB
TerminateProcess.KERNEL32(00000000,00000000), ref: 00415CC9
CloseHandle.KERNEL32(00000000), ref: 00415CD6

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: fdfea1e36e01ba5dc6c08a707d84f87bfe87981db8c2dab46dee4399722e953d
Instruction ID: 9bd26bda15b00488fb04890a05ea267a73874a1d1a12279ce6d54c29d70e7cb6
Opcode Fuzzy Hash: fdfea1e36e01ba5dc6c08a707d84f87bfe87981db8c2dab46dee4399722e953d
Instruction Fuzzy Hash: B7311E71A00708DFDB24DFD0CD49BEDB775BB88304F204459E506AA284EB78AA85CF95

Uniqueness

Uniqueness Score: -1.00%

Function 006B5047 Relevance: 6.1, APIs: 4, Instructions: 60processCOMMON

Download Yara Rule

APIs

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 006B506E
Process32First.KERNEL32(00000000,00000128), ref: 006B5082
Process32Next.KERNEL32(00000000,00000128), ref: 006B5097

Part of subcall function 006B7217: lstrlen.KERNEL32(?,006249EC,?,004215A4,0041D7D6), ref: 006B722C
Part of subcall function 006B7217: lstrcpy.KERNEL32(00000000), ref: 006B726B
Part of subcall function 006B7217: lstrcat.KERNEL32(00000000,00000000), ref: 006B7279

Part of subcall function 006B7107: lstrcpy.KERNEL32(?,0041D7D6), ref: 006B716C

CloseHandle.KERNEL32(00000000), ref: 006B5105

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: b52d0566d22262ac0ca84fccd2a79ab41aaba5a1cfdbd13057ab198f5e8d9997
Instruction ID: dd4d25762f431a580df9997bfa6d318fb154285df1ff02d64c7ff7aa04358ab0
Opcode Fuzzy Hash: b52d0566d22262ac0ca84fccd2a79ab41aaba5a1cfdbd13057ab198f5e8d9997
Instruction Fuzzy Hash: BC21F9B19006189BCB65EB50DC95FEDB37AAF84300F10419EA50AA6191DF346FC4CF94

Uniqueness

Uniqueness Score: -1.00%

Function 006AFD47 Relevance: 6.1, APIs: 4, Instructions: 53stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,0041D70C), ref: 006AFD6C
ExitProcess.KERNEL32 ref: 006AFD78
strtok_s.MSVCRT ref: 006AFD8F

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID:
API String ID: 3407564107-0
Opcode ID: 38c53f5a606269b64edeae665f1f90b57f3911939e66431622d8e48dd442a9d3
Instruction ID: 05aef39fe3210f55c2f00dce4a02d49c27c7c2543f0ee1cd9ceb94a4fd3fe789
Opcode Fuzzy Hash: 38c53f5a606269b64edeae665f1f90b57f3911939e66431622d8e48dd442a9d3
Instruction Fuzzy Hash: 15115B70C00209EFCB14EFE4D954AEDBB76EF44304F108069E815A7290E7305B44CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00414ED0 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00414F1C
HeapAlloc.KERNEL32(00000000), ref: 00414F23
wsprintfA.USER32 ref: 00414F3D

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

Strings

%dx%d, xrefs: 00414F34

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 2716131235-2206825331
Opcode ID: f08cde69876725b708423540da4c5a3f365b361f564d4ee0880696cb78a15392
Instruction ID: 6eb13fdbeba78ce7d97bae5a893604665d2c333b41188d65ffcc19bab192dd48
Opcode Fuzzy Hash: f08cde69876725b708423540da4c5a3f365b361f564d4ee0880696cb78a15392
Instruction Fuzzy Hash: 5C112DB1A40708AFDB10DFE4DD49FBE77B9FB48701F104548FA09AB280CA719901CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00416F20 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00416F72
lstrcat.KERNEL32(00000000), ref: 00416F82

Strings

6F@, xrefs: 00416F37
6F@, xrefs: 00416F29

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcatlstrcpy
String ID: 6F@$6F@
API String ID: 3905823039-140834422
Opcode ID: 0fd21debb5ed307de285645c5bfc8b86321b2cbbfd8b437667256a76d532ad3c
Instruction ID: 671097608d67a6365fb22a17cf1e01146cf6df4f1a405ab7b22d056337cae9f2
Opcode Fuzzy Hash: 0fd21debb5ed307de285645c5bfc8b86321b2cbbfd8b437667256a76d532ad3c
Instruction Fuzzy Hash: F411D674A00208ABCB04DF94E884AEEB375BF44304F518599E829AB391C734AA85CB94

Uniqueness

Uniqueness Score: -1.00%

Function 006B5C47 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(006B1AE0,80000000,00000003,00000000,00000003,00000080,00000000,?,006B1AE0,?), ref: 006B5C63
GetFileSizeEx.KERNEL32(000000FF,006B1AE0), ref: 006B5C80
CloseHandle.KERNEL32(000000FF), ref: 006B5C8E

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: f3a5877fc348a9a64368c001e27037213673241a1fda354ede690d4ee948c5a4
Instruction ID: 4cd16d08bb6216f3b0c7a93e2fa9023dcf99b60a38430c78ae111e211af209fc
Opcode Fuzzy Hash: f3a5877fc348a9a64368c001e27037213673241a1fda354ede690d4ee948c5a4
Instruction Fuzzy Hash: 5FF03179F00704BBDB20DBB0DC49BDE7B7BBB44710F11C558FA55A7284DA7096428B40

Uniqueness

Uniqueness Score: -1.00%

Function 006B46B7 Relevance: 6.0, APIs: 4, Instructions: 34memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,0041D748,00000000,?,00000000,0041D2B1), ref: 006B46C4
RtlAllocateHeap.NTDLL(00000000), ref: 006B46CB
GetLocalTime.KERNEL32(?), ref: 006B46D8
wsprintfA.USER32 ref: 006B4707

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: ecd3a08835dc28e24e172d3ec6c3ea9534f2ed94b9f2de78f98134f4a4fefc06
Instruction ID: 4df586b6dc15b0ab72eaa90ec8b013cc5aca6a98c8dd6c86bd1e3c66c74c2495
Opcode Fuzzy Hash: ecd3a08835dc28e24e172d3ec6c3ea9534f2ed94b9f2de78f98134f4a4fefc06
Instruction Fuzzy Hash: 1FF06DB6804618ABCB20DBD9DD48DBFB3FDBF4CB02F000549FA46A2180E6384A41D7B1

Uniqueness

Uniqueness Score: -1.00%

Function 006B4717 Relevance: 6.0, APIs: 4, Instructions: 32memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?,00624A44,00000000,?,0041D758,00000000,?,00000000,00000000,?,00624B08,00000000), ref: 006B4727
RtlAllocateHeap.NTDLL(00000000), ref: 006B472E
GetTimeZoneInformation.KERNEL32(?), ref: 006B4741
wsprintfA.USER32 ref: 006B477B

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 3e8ee039c0baa52381bc867147264b9e0472758f99ecf5fc77eb662dd471fe6c
Instruction ID: 4e085879e95b3155335257b0516c7d8506ed295ae8c040254632ce7c0be32662
Opcode Fuzzy Hash: 3e8ee039c0baa52381bc867147264b9e0472758f99ecf5fc77eb662dd471fe6c
Instruction Fuzzy Hash: 11F067B0A047289BDB309B60DD49BA9737BFB04311F0002E4EA1AA3291DB705E85CF82

Uniqueness

Uniqueness Score: -1.00%

Function 006B3A1A Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00624D20,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 006B39F1
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 006B3A0F
CloseHandle.KERNEL32(00000000), ref: 006B3A20
Sleep.KERNEL32(00001770), ref: 006B3A2B
CloseHandle.KERNEL32(?,00000000,?,00624D20,?,0041D8AC,?,00000000,?,0041D8B0,?,00000000,0041D6E3), ref: 006B3A41
ExitProcess.KERNEL32 ref: 006B3A49

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: a22c4b3d544938e112ab0244007d15e0e25d35ff1a82b9a1ac98b22b723a5bcb
Instruction ID: 2d60f25ffe605ef1e481642e2078abeed637e9a96d35b0db0a7da6d5334bb53b
Opcode Fuzzy Hash: a22c4b3d544938e112ab0244007d15e0e25d35ff1a82b9a1ac98b22b723a5bcb
Instruction Fuzzy Hash: F5F082B0B48225AFE730BBE0DC46BFD76B6BB54701F200518B552A52C0DBB09681CB55

Uniqueness

Uniqueness Score: -1.00%

Function 006A46D7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

Part of subcall function 006B5257: malloc.MSVCRT ref: 006B525F

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 006A475D
InternetCrackUrlA.WININET(00000000,00000000), ref: 006A476D

Strings

<, xrefs: 006A46F0

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlenmalloc
String ID: <
API String ID: 3848002758-4251816714
Opcode ID: 36b56b5e4384ba13abe14ae141d0212bab6192fe2a1ddf460b4795af489f13cc
Instruction ID: 63e18085556952524a56adf110c4612d1e8c8039566d90ec4f261a88afeabd63
Opcode Fuzzy Hash: 36b56b5e4384ba13abe14ae141d0212bab6192fe2a1ddf460b4795af489f13cc
Instruction Fuzzy Hash: 9E214FB1D00208ABDF14EFA4E845ADD7B75AF84320F104229FA15B72C0EB716A45CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00415260 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00416D40: lstrcpy.KERNEL32(0041D6E3,00000000), ref: 00416D88

GetSystemTime.KERNEL32(?,0084FF90,0041D129,?,?,?,?,?,?,?,?,?,00404623,?,00000014), ref: 00415286

Strings

#F@, xrefs: 004152B1, 004152E1, 004152E4
#F@, xrefs: 0041526C, 004152E5, 004152F0, 00415304, 004152D3, 004152F3

Memory Dump Source

Source File: 0000000F.00000002.2876636083.0000000000400000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.2876636083.0000000000447000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000549000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000624000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000F.00000002.2876636083.0000000000636000.00000040.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_syncUpd.jbxd

Yara matches

Similarity

API ID: SystemTimelstrcpy
String ID: #F@$#F@
API String ID: 62757014-661595268
Opcode ID: 3a859b8b0cbacdc11ebfb3e047a024e7a283962ea90257fbacdd3e9563b3f0f0
Instruction ID: 513f033f75459e748f43dcf9dcce4e772375218857ee2e068f26327ba23d5006
Opcode Fuzzy Hash: 3a859b8b0cbacdc11ebfb3e047a024e7a283962ea90257fbacdd3e9563b3f0f0
Instruction Fuzzy Hash: 8511D636D00108DFCB04EFA9D891AEE7B75EF98304F54C05EE41567251DF38AA85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 006AB4B7 Relevance: 5.3, APIs: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006B6FA7: lstrcpy.KERNEL32(0041D7D6,00000000), ref: 006B6FEF

Part of subcall function 006B7217: lstrlen.KERNEL32(?,006249EC,?,004215A4,0041D7D6), ref: 006B722C
Part of subcall function 006B7217: lstrcpy.KERNEL32(00000000), ref: 006B726B
Part of subcall function 006B7217: lstrcat.KERNEL32(00000000,00000000), ref: 006B7279

Part of subcall function 006B7187: lstrcpy.KERNEL32(00000000,?), ref: 006B71D9
Part of subcall function 006B7187: lstrcat.KERNEL32(00000000), ref: 006B71E9

Part of subcall function 006B7107: lstrcpy.KERNEL32(?,0041D7D6), ref: 006B716C

Part of subcall function 006A9A57: memcmp.MSVCRT ref: 006A9A72
Part of subcall function 006A9A57: memset.MSVCRT ref: 006A9AA5
Part of subcall function 006A9A57: LocalAlloc.KERNEL32(00000040,?), ref: 006A9AF5

lstrlen.KERNEL32(00000000), ref: 006AB6B4

Part of subcall function 006B5797: LocalAlloc.KERNEL32(00000040,-00000001), ref: 006B57B9

StrStrA.SHLWAPI(00000000,0041DB40), ref: 006AB6E2
lstrlen.KERNEL32(00000000), ref: 006AB7BA
lstrlen.KERNEL32(00000000), ref: 006AB7CE

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$AllocLocallstrcat$memcmpmemset
String ID:
API String ID: 2910778473-0
Opcode ID: 4c841f1622f07f685f6db9995fa84ba6bb6fd9757794a01dbc2b5751afcccf63
Instruction ID: eafc02c9e107fae61e560452dee31c33568718d0cbf7c0727a394a703c75e6ef
Opcode Fuzzy Hash: 4c841f1622f07f685f6db9995fa84ba6bb6fd9757794a01dbc2b5751afcccf63
Instruction Fuzzy Hash: 80A11CF19042189ACB54FBA0CC92EEE737ABF94300F50515DF50662192EF34AF88CB65

Uniqueness

Uniqueness Score: -1.00%

Function 006B5377 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,Jk,?,006B4AE8,00000000), ref: 006B5380
RtlAllocateHeap.NTDLL(00000000,?,006B4AE8), ref: 006B5387

Strings

Jk, xrefs: 006B537A, 006B537D

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID: Jk
API String ID: 1357844191-885492675
Opcode ID: 0f6f15f30fe197b716aff048ef91885df5184b5f5eae685ae0b2461a0b01e6f0
Instruction ID: 405c0980f79346ffd7f8af494a5ad95d8eaf73793f93639fddef56fb6e8f8f5f
Opcode Fuzzy Hash: 0f6f15f30fe197b716aff048ef91885df5184b5f5eae685ae0b2461a0b01e6f0
Instruction Fuzzy Hash: 02C09B71540B08AFDB205BD8EC0DEA5375DFB4C751F405400B60EC6550CA70E44547E5

Uniqueness

Uniqueness Score: -1.00%

Function 006B2BE7 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006B5747: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 006B5772

lstrcat.KERNEL32(?,00000000), ref: 006B2C21
lstrcat.KERNEL32(?,0041D888), ref: 006B2C3E
lstrcat.KERNEL32(?,00624DC4), ref: 006B2C52
lstrcat.KERNEL32(?,0041D88C), ref: 006B2C64

Part of subcall function 006B27D7: wsprintfA.USER32 ref: 006B27F0
Part of subcall function 006B27D7: FindFirstFileA.KERNEL32(?,?), ref: 006B2807

Part of subcall function 006B27D7: StrCmpCA.SHLWAPI(?,0041D864), ref: 006B2835
Part of subcall function 006B27D7: StrCmpCA.SHLWAPI(?,0041D868), ref: 006B284B
Part of subcall function 006B27D7: FindNextFileA.KERNEL32(000000FF,?), ref: 006B2A20
Part of subcall function 006B27D7: FindClose.KERNEL32(000000FF), ref: 006B2A35

Memory Dump Source

Source File: 0000000F.00000002.2877180819.00000000006A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 006A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6a0000_syncUpd.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 5d2293bb92b353d421a5094c8b8f6ff56762a29023f594da7c4d3e6856184f9a
Instruction ID: 42f2ffe88c15badb0802a7e267d39649871bce66a89a609758daea3e0fee24ce
Opcode Fuzzy Hash: 5d2293bb92b353d421a5094c8b8f6ff56762a29023f594da7c4d3e6856184f9a
Instruction Fuzzy Hash: F721C9F69005087BD764FBA0DC46EE9337F9F54740F000599B65A5A180DEB49BC48FD5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: UPwYHcUA3TbsX6l2qc9SZcBH.exePID: 13116, Parent PID: 10536COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.2%
Total number of Nodes:	135
Total number of Limit Nodes:	9

Executed Functions

Function 001A16B0 Relevance: 61.9, APIs: 26, Strings: 9, Instructions: 661filewindowlibraryCOMMON

Download Yara Rule

APIs

VerSetConditionMask.NTDLL ref: 001A16F9
VerSetConditionMask.NTDLL(00000000,?,00000001,00000003), ref: 001A1707
VerSetConditionMask.NTDLL(00000000,?,00000020,00000003), ref: 001A170E
VerifyVersionInfoW.KERNEL32(?,00000023,00000000), ref: 001A1731
FindResourceW.KERNEL32(00000000,000007D1,0000000A,?,?,00000020,00000003,?,00000001,00000003), ref: 001A176A
LoadResource.KERNEL32(00000000,00000000,?,?,00000020,00000003,?,00000001,00000003), ref: 001A177D
SizeofResource.KERNEL32(00000000,00000000,?,?,00000020,00000003,?,00000001,00000003), ref: 001A1790
FreeLibrary.KERNEL32(?,?,00000001,00000003), ref: 001A17DD

Part of subcall function 001D7570: _strlen.LIBCMT ref: 001D7580

FreeLibrary.KERNEL32(?,?,00000001,00000003), ref: 001A18F6
DeleteFileW.KERNEL32(00000000,?,00000001,00000003), ref: 001A1912
LockResource.KERNEL32(00000000,?,?,00000020,00000003,?,00000001,00000003), ref: 001A17A1

Part of subcall function 001A25D0: GetTempPathW.KERNEL32(00000000,00000000), ref: 001A2609
Part of subcall function 001A25D0: GetTempPathW.KERNEL32(00000000,?), ref: 001A2683
Part of subcall function 001A25D0: DeleteFileW.KERNEL32(?), ref: 001A2722
Part of subcall function 001A25D0: LoadLibraryW.KERNEL32(Kernel32.dll), ref: 001A278B

GetLastError.KERNEL32(?,?,00000020,00000003,?,00000001,00000003), ref: 001A184C
GetLastError.KERNEL32(?,?,00000020,00000003,?,00000001,00000003), ref: 001A18A5
DeleteFileW.KERNEL32(00000000,?,?,?,?,001EF243,..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at,00000003), ref: 001A19A8
GetLastError.KERNEL32(?,?,00000020,00000003,?,00000001,00000003), ref: 001A1A43
GetProcAddress.KERNEL32(00000000,RunInstaller), ref: 001A1A97
FreeLibrary.KERNELBASE(00000000,?,?,001EF243,..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at,00000003), ref: 001A1ABC
DeleteFileW.KERNELBASE(?,?,?,001EF243,..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at,00000003), ref: 001A1AD8
MessageBoxW.USER32(00000000,This Opera installer works only on Windows 7 or higher.Visit www.opera.com to download compatible version.,Opera installer 108.0.5067.24.0,00000000), ref: 001A1B83
FreeLibrary.KERNEL32(?,?,001EF243,..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at,00000003), ref: 001A1C1F
FreeLibrary.KERNEL32(?,?,001EF243,..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at,00000003), ref: 001A1CBD
DeleteFileW.KERNEL32(00000000,?,001EF243,..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at,00000003), ref: 001A1CD9
FreeLibrary.KERNEL32(?,?,?,001EF243,..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at,00000003), ref: 001A1D73
GetLastError.KERNEL32(?,?,00000020,00000003,?,00000001,00000003), ref: 001A1D7E
MessageBoxW.USER32(00000000,?,Opera installer 108.0.5067.24.0,00000000), ref: 001A1E30
FormatMessageA.KERNEL32(00001200,00000000,?,00000409,?,00000100,00000000,?,In line ,00000008,00000003,?,00000001,00000003), ref: 001A20AB

Strings

In line , xrefs: 001A1FBC
Opera installer 108.0.5067.24.0, xrefs: 001A1B78, 001A1E29
Fatal error upon loading installer executable:, xrefs: 001A1DD5
3To, xrefs: 001A1B6F
..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at, xrefs: 001A1BB0
This Opera installer works only on Windows 7 or higher.Visit www.opera.com to download compatible version., xrefs: 001A1B7D
When reporting this error, click on this text and press Ctrl+C to copy it., xrefs: 001A1E0D
RunInstaller, xrefs: 001A1A91
(Error cannot be retrieved), xrefs: 001A1E9F

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: Library$Free$DeleteFile$ErrorLastResource$ConditionMaskMessage$LoadPathTemp$AddressFindFormatInfoLockProcSizeofVerifyVersion_strlen
String ID: When reporting this error, click on this text and press Ctrl+C to copy it.$(Error cannot be retrieved)$..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at$Fatal error upon loading installer executable:$In line $Opera installer 108.0.5067.24.0$RunInstaller$This Opera installer works only on Windows 7 or higher.Visit www.opera.com to download compatible version.$3To
API String ID: 2238626007-215584465
Opcode ID: a996fd395db52ddcecfca2c6dfd9416bc467f795c53a7d0f4f9aaa1cf9c36e88
Instruction ID: 01a4c5863ba7c9c727c9747250fba7d6665f565787c6518ce9591b8f503c6ca0
Opcode Fuzzy Hash: a996fd395db52ddcecfca2c6dfd9416bc467f795c53a7d0f4f9aaa1cf9c36e88
Instruction Fuzzy Hash: 42527074E00268ABEF329B20CC457EABBB5AF5A304F0481D9E449A7251EB745FC5CF91

Uniqueness

Uniqueness Score: -1.00%

Function 001A25D0 Relevance: 40.7, APIs: 18, Strings: 5, Instructions: 405
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000000,00000000), ref: 001A2609
GetTempPathW.KERNEL32(00000000,?), ref: 001A2683
DeleteFileW.KERNEL32(?), ref: 001A2722
LoadLibraryW.KERNEL32(Kernel32.dll), ref: 001A278B
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 001A27A1
LoadLibraryW.KERNELBASE(version.dll), ref: 001A27D5
GetLastError.KERNEL32 ref: 001A27E5
GetLastError.KERNEL32 ref: 001A27F9
GetLastError.KERNEL32 ref: 001A283D
FreeLibrary.KERNEL32(?), ref: 001A28A1
DeleteFileW.KERNEL32(?), ref: 001A28C3
GetLastError.KERNEL32 ref: 001A292C
LoadLibraryW.KERNELBASE(?), ref: 001A29DB
FreeLibrary.KERNEL32(00000000), ref: 001A29EC
DeleteFileW.KERNEL32(?), ref: 001A2A13
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 001A2A8E
GetLastError.KERNEL32(?), ref: 001A2AE1

Strings

version.dll, xrefs: 001A27D0
..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at, xrefs: 001A25BE
Kernel32.dll, xrefs: 001A2786
SetDefaultDllDirectories, xrefs: 001A279B
..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at, xrefs: 001A25AF

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: ErrorLastLibrary$File$DeleteLoad$FreePathTemp$AddressModuleNameProc
String ID: ..\..\third_party\libc++\src\include\__memory\construct_at.h:40: assertion __location != nullptr failed: null pointer given to construct_at$..\..\third_party\libc++\src\include\__memory\construct_at.h:66: assertion __loc != nullptr failed: null pointer given to destroy_at$Kernel32.dll$SetDefaultDllDirectories$version.dll
API String ID: 115772218-1760150911
Opcode ID: a98181f1346b3cf58f7baad6bc7107da678475b71fe507d9f57cc3dc3fb2a125
Instruction ID: 0d4bac004736dc02197f121993aa4e48c3c4844f6f46d531d9108a2e44fcbaea
Opcode Fuzzy Hash: a98181f1346b3cf58f7baad6bc7107da678475b71fe507d9f57cc3dc3fb2a125
Instruction Fuzzy Hash: E902B474D00369ABDF219F24CC887EABBB1BF66304F1442D5E849A7251EB74AEC4CB51

Uniqueness

Uniqueness Score: -1.00%

Function 001A2C70 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 316
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTime.KERNEL32(?), ref: 001A2CA7
GetCurrentProcessId.KERNEL32 ref: 001A2CC8
CreateFileW.KERNELBASE ref: 001A2EB8
GetLastError.KERNEL32 ref: 001A2ECC
FindCloseChangeNotification.KERNELBASE(00000000,?,?,?,?,?,?,?,.dll,00000004,?,?,?,?), ref: 001A2F1E
WriteFile.KERNELBASE(00000000,?,?,FFFFFFFF,00000000), ref: 001A2F96
GetLastError.KERNEL32 ref: 001A2FF9

Strings

%02d%02d%02d%02d%02d%02d%03d%d, xrefs: 001A2D16
..\..\third_party\libc++\src\include\__string\char_traits.h:322: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 001A3036
Opera_installer_, xrefs: 001A2D4F, 001A2DD8, 001A2DE0, 001A2DF3
.dll, xrefs: 001A2E42

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: ErrorFileLast$ChangeCloseCreateCurrentFindNotificationProcessSystemTimeWrite
String ID: %02d%02d%02d%02d%02d%02d%03d%d$..\..\third_party\libc++\src\include\__string\char_traits.h:322: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$.dll$Opera_installer_
API String ID: 3535564618-2505208828
Opcode ID: 7b7fe40941c50e705db1e7e67029155c052f0b0a188f3d8a52c98182ccb125e9
Instruction ID: a39ead49581b3f463f6ce0e58f253feee341f2fb00c3aa2e4b35d2a87201533d
Opcode Fuzzy Hash: 7b7fe40941c50e705db1e7e67029155c052f0b0a188f3d8a52c98182ccb125e9
Instruction Fuzzy Hash: 29C1F475D007589FDF21DFA4C8846EEBBB5BF9A300F20821EF8456B252E7709985CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001BED8B Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(001BEC98,?,001BEE4D,00000000,?,?,001BEC98,958EF2C5,?,001BEC98), ref: 001BED9C
TerminateProcess.KERNEL32(00000000,?,001BEE4D,00000000,?,?,001BEC98,958EF2C5,?,001BEC98), ref: 001BEDA3
ExitProcess.KERNEL32 ref: 001BEDB5

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 34a4a48500505fde7ccac47a4481531cc4e0610715f782fee638e2d66a384465
Instruction ID: 7d2040df42311854cd179c1a4d6461da0d0c997c6ab756765917d4372a1c802a
Opcode Fuzzy Hash: 34a4a48500505fde7ccac47a4481531cc4e0610715f782fee638e2d66a384465
Instruction Fuzzy Hash: 36D06C36000548BBCB426FA1ED0E9E93FAAAB50385B044410F90A4A462CBB29992DA80

Uniqueness

Uniqueness Score: -1.00%

Function 001C6E17 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,?), ref: 001C6E58

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e2f4ff988dbe2bc3287fce695e3e1b8278e70aa2d31a1caabc45218392751a13
Instruction ID: feffba46b601cc471f49967bc45848bf5d6f5b1b9cf6783eca5bf816c100b7f6
Opcode Fuzzy Hash: e2f4ff988dbe2bc3287fce695e3e1b8278e70aa2d31a1caabc45218392751a13
Instruction Fuzzy Hash: 99F0E939645724A6DB22AB71DC05FAB37599FB1B70B15802FFC04D6091CB30DC00C6E0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 001D2492 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1479COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 001D26A9

Strings

1#IND, xrefs: 001D2597
1#QNAN, xrefs: 001D25A5
1#INF, xrefs: 001D25C8
1#SNAN, xrefs: 001D259E

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: adafd81acc7401269554c4ca46c0c27be89ddb8764ef5383d74c77be3f30eafd
Instruction ID: fe9f495fc8636965577e42bf022c4ad301c921efaf247260bd2bebe8b8fccd14
Opcode Fuzzy Hash: adafd81acc7401269554c4ca46c0c27be89ddb8764ef5383d74c77be3f30eafd
Instruction Fuzzy Hash: AED24972E086298FDB65CF28DD807EAB7B5EB54305F1441EAD41DE7240EB78AE818F41

Uniqueness

Uniqueness Score: -1.00%

Function 001CCA04 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,001CC3D5,00000002,00000000,?,?,?,001CC3D5,?,00000000), ref: 001CCA9D
GetLocaleInfoW.KERNEL32(?,20001004,001CC3D5,00000002,00000000,?,?,?,001CC3D5,?,00000000), ref: 001CCAC6
GetACP.KERNEL32(?,?,001CC3D5,?,00000000), ref: 001CCADB

Strings

ACP, xrefs: 001CCA22
OCP, xrefs: 001CCA58

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 5004ebba4f97f21461ae2d9c82ee52fe231650d76fdbf0797deaa7dfd2e58114
Instruction ID: 5330eea5e432c2bd0bca61a9b951d38a4090c7b3a462986b5e720282d5b52b8d
Opcode Fuzzy Hash: 5004ebba4f97f21461ae2d9c82ee52fe231650d76fdbf0797deaa7dfd2e58114
Instruction Fuzzy Hash: 26217F32A40108ABDB35CF65C909FA772A6AB74B50B56846CE90ED7201FB32DD41C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 001CC29F Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 001C74DC: GetLastError.KERNEL32(00000000,?,001C9356), ref: 001C74E0
Part of subcall function 001C74DC: SetLastError.KERNEL32(00000000,?,?,00000028,001C38EC), ref: 001C7582

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 001CC3A7
IsValidCodePage.KERNEL32(00000000), ref: 001CC3E5
IsValidLocale.KERNEL32(?,00000001), ref: 001CC3F8
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 001CC440
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 001CC45B

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: c4409a26e5d02f97c10bb82ac23be8d88f8cba0bc12f56850a7b14c0b413c346
Instruction ID: 7fa5f9d77adb34e05dcb57f44118b2d2528d9909357ac04e49a17b8c1e830ca6
Opcode Fuzzy Hash: c4409a26e5d02f97c10bb82ac23be8d88f8cba0bc12f56850a7b14c0b413c346
Instruction Fuzzy Hash: 98515C71A00249AEDB14DBA4DC51FBE77B8BF29700F14842DE949EB191E7B0DD40CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 001BA230 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2408a4ea1b81ad33686c194f309c0590f5cc1222851812f6294d3ee0799cdb6b
Instruction ID: e03ee561e9794b7f56aab50490360744200d45a9b4c3491187f95bc647f9bb47
Opcode Fuzzy Hash: 2408a4ea1b81ad33686c194f309c0590f5cc1222851812f6294d3ee0799cdb6b
Instruction Fuzzy Hash: 32023AB1E012199BDF14CFA8C890AEEBBF1FF48314F698269D519E7340D771AA41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001CCF22 Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 001CCFBD
FindNextFileW.KERNEL32(00000000,?), ref: 001CD038
FindClose.KERNEL32(00000000), ref: 001CD05A
FindClose.KERNEL32(00000000), ref: 001CD07D

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: cbd75b61be17a64eaafb350d24779ef2889daabb1d0cbc433e4509d94c08f156
Instruction ID: 3a7991021f7d30c9fa82fac5c2bc69e593fdef4fd93b8240cb03bbfb9cd1488c
Opcode Fuzzy Hash: cbd75b61be17a64eaafb350d24779ef2889daabb1d0cbc433e4509d94c08f156
Instruction Fuzzy Hash: 00418471900519AFDB20DF68DC89FBAB7B9EBA5344F10419DF40997180E730DE85CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 001B1ACE Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 001B1ADA
IsDebuggerPresent.KERNEL32 ref: 001B1BA6
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 001B1BC6
UnhandledExceptionFilter.KERNEL32(?), ref: 001B1BD0

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 7e94d01681da1b34d1bedc5658a87a28ab5c348c43d429847ea066edf32da517
Instruction ID: b40b44e55c8e6379ea3ed3e14ff16b0cebe7aee3ea4001258008fb6949a174f8
Opcode Fuzzy Hash: 7e94d01681da1b34d1bedc5658a87a28ab5c348c43d429847ea066edf32da517
Instruction Fuzzy Hash: 92312975D4521CEBDB11EFA4D989BCDBBB8AF18300F5041AAE408AB250EB719A85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 001D6A72 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,001D69CD,?,?,00000008,?,?,001D659F,00000000), ref: 001D6C9F

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 542ed274bcc35af8fd5070b2ca10eb5dd7ed943622e8287471334ba2b1ca4984
Instruction ID: 1bd5626315e42b68d65e983c43974f930d096cb0e3a5ddb2521929d21dbc4335
Opcode Fuzzy Hash: 542ed274bcc35af8fd5070b2ca10eb5dd7ed943622e8287471334ba2b1ca4984
Instruction Fuzzy Hash: 63B11B31610609DFD719CF28C48AB657BA1FF45364F29865AE8DACF3A1C335E992CB40

Uniqueness

Uniqueness Score: -1.00%

Function 001B1C3F Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 001B1C55

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 95b90e610a242786447ccbbf2bd110a4eefe9c198cc7eea40890b2740cc699dc
Instruction ID: 9a32f7dff727406bca6df94112c0c95bfbaba2e68605ad74f0804c51f98a918a
Opcode Fuzzy Hash: 95b90e610a242786447ccbbf2bd110a4eefe9c198cc7eea40890b2740cc699dc
Instruction Fuzzy Hash: 2851A171A01605EFDB15CF94D899BAEBBF1FB48350F26806AD809EB660D375D980CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001B8454 Relevance: 1.6, Strings: 1, Instructions: 385COMMON

Download Yara Rule

Strings

0, xrefs: 001B85E5

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: e99deb9c01d5d8a52c089afbd969a42103669a20bb069ea1b31895d0023de479
Instruction ID: 4a2f2ef53661d927e85a48f2bbe64607ee3beb8c1a44047fd091a170a3c803f5
Opcode Fuzzy Hash: e99deb9c01d5d8a52c089afbd969a42103669a20bb069ea1b31895d0023de479
Instruction Fuzzy Hash: C9D1C034A006068FCB38DF68C584AFAB7B9FF48B14B644A1DD5569B690DF30ED42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 001B7419 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 001B7589

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: e95f05faa77c5f7374f9100826eb5c0e0ee1cc80676bd91d69bd528945f4316e
Instruction ID: ec5e230fda97fc0f73725ca07eabcbdd0100972d6a663774545ed29e5673231b
Opcode Fuzzy Hash: e95f05faa77c5f7374f9100826eb5c0e0ee1cc80676bd91d69bd528945f4316e
Instruction Fuzzy Hash: A1C10030A08B068FDB39CF6CC598AFABBB1AF95300F244A59E4569B6D1D730ED45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 001B6788 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 001B690C

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: fbc1cbca58bad578614c5051a7ba52746b06770f0589fe0742d34edd6ababade
Instruction ID: b2216f558266b15bf113de6b2d9558a7df56bfd5afccfe95dc724cfd002aef0e
Opcode Fuzzy Hash: fbc1cbca58bad578614c5051a7ba52746b06770f0589fe0742d34edd6ababade
Instruction Fuzzy Hash: D5B1AE7190070A8BCF288F68C595AFEBBB1AF34308F14461ED592A7691CB39EE41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 001BABB4 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fb42f0b88572e1b4eef828bc511e7a844c078b4884ed1823cc705c6ac6f049d
Instruction ID: 44070dbf501b13aeb3141db793ef5c6d62de652703222baeea1fec5baa7ecc3b
Opcode Fuzzy Hash: 9fb42f0b88572e1b4eef828bc511e7a844c078b4884ed1823cc705c6ac6f049d
Instruction Fuzzy Hash: B051AE72D00219EFDF14CF98C840AEEBBB6FF88304F498459E915AB201D735AA40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001B33F0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 91d8e614efc737e59657ea6244b7efa43eef3eae8fbdd94c6eecc4b62973189e
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: ED11277720008247D616CA2DD8B86F7E795EBD632076D837AD0B24B758DB22EB659600

Uniqueness

Uniqueness Score: -1.00%

Function 001D6093 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDecodePointer.NTDLL(?), ref: 001D60AC

Strings

pow, xrefs: 001D614A, 001D61F4, 001D6241
acos, xrefs: 001D61E2
log, xrefs: 001D6109, 001D6118
asin, xrefs: 001D61D9
exp, xrefs: 001D612B, 001D6190
log10, xrefs: 001D60EE, 001D60FD
sqrt, xrefs: 001D61EB

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 38fde18161811d87b22214a46f41585fef87b8b411aadb4b1927710802042bc5
Instruction ID: 0f1feb5d5664d214f7b27df6ed4e82cc8c00da520f52ed633d784bfaf8fbbc1f
Opcode Fuzzy Hash: 38fde18161811d87b22214a46f41585fef87b8b411aadb4b1927710802042bc5
Instruction Fuzzy Hash: C451C072904A0ADBCF149FA9E94C1BDBFB0FF99314F21405AE481BB355CBB48A64CB50

Uniqueness

Uniqueness Score: -1.00%

Function 001C64B4 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 001C65D3
CatchIt.LIBVCRUNTIME ref: 001C6732
_UnwindNestedFrames.LIBCMT ref: 001C6833
CallUnexpected.LIBVCRUNTIME ref: 001C684E

Strings

csm, xrefs: 001C660A
csm, xrefs: 001C64F1
csm, xrefs: 001C655E

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: CallCatchFramesNestedUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2332921423-393685449
Opcode ID: e8187ca54bdaf062810dde8063c699110aad30823fead8644cf0972b69cd8ff5
Instruction ID: 96463540289bf73d0fbacf3b565b997cf7c19732530177cbd2e73088d4c116df
Opcode Fuzzy Hash: e8187ca54bdaf062810dde8063c699110aad30823fead8644cf0972b69cd8ff5
Instruction Fuzzy Hash: 70B15871800319AFCF29DFA4C981EAEBBB5FF34314B24456EE8116B216D731EA51CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001C9C8D Relevance: 10.8, APIs: 7, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strrchr.LIBCMT ref: 001C9D13

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b621c3caa90bacfb1be4dffcdc3bee6e17dee7aeac8b5a805dc308621c0f457b
Instruction ID: 2be003083579dffeeecceaaa595db40649a4d26c96ce7b5af615deb7613b2f01
Opcode Fuzzy Hash: b621c3caa90bacfb1be4dffcdc3bee6e17dee7aeac8b5a805dc308621c0f457b
Instruction Fuzzy Hash: F9B12232A00295AFDB15CF68C886FEEBFA5EF75310F15419EE905AB282D774D901C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 001C807D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,001C818C,00000000,00000000,00000000,?,001E5E11,?,001C7D6E,00000022,FlsSetValue,001EA4D4,FlsSetValue,?), ref: 001C813E

Strings

api-ms-, xrefs: 001C80D4
ext-ms-, xrefs: 001C80E8

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 8f18777d5e320df717e367c8faf80ea5df93ae07a85674dcedcf1d16068da6cf
Instruction ID: b906943562952c8a62cfcee942f291ae8e431b050334ed1a977a3679a5d457b1
Opcode Fuzzy Hash: 8f18777d5e320df717e367c8faf80ea5df93ae07a85674dcedcf1d16068da6cf
Instruction Fuzzy Hash: 8021D536A01215FFC7219B65DCC1FAE37A9AF61760F290118ED06A7291EB70EE42C6D0

Uniqueness

Uniqueness Score: -1.00%

Function 001B24E6 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,001B2561,001B2769), ref: 001B24FD
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 001B2513
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 001B2528

Strings

KERNEL32.DLL, xrefs: 001B24F8
AcquireSRWLockExclusive, xrefs: 001B250D
ReleaseSRWLockExclusive, xrefs: 001B251D

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 3beba215a62faab981606c2ff187a21f2a0873de7f3f9edc26e9341afca50535
Instruction ID: 6ec21fe9f16a811a7c22c4b8d0aab51018e49810159a424a7fd996e0ab37ece4
Opcode Fuzzy Hash: 3beba215a62faab981606c2ff187a21f2a0873de7f3f9edc26e9341afca50535
Instruction Fuzzy Hash: 9DF0C271746212EB9F324FA96CA02FB22DC9F0A7513010039F901D3580EB78CC89D6D0

Uniqueness

Uniqueness Score: -1.00%

Function 001CFDDF Relevance: 9.3, APIs: 6, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b50444c199a53a31b2cbd98946cbf49d098afd17bddf58a99fe8c37c9bbb6f1
Instruction ID: 7cfa014ad1f4cb8b5efee89f7d78e7537742c17146af984197f1aaf4d558dc46
Opcode Fuzzy Hash: 0b50444c199a53a31b2cbd98946cbf49d098afd17bddf58a99fe8c37c9bbb6f1
Instruction Fuzzy Hash: 26B1E174A04249AFDB16DFA8D881BBE7BB1BF69350F14425EF4059B392C770D982CB60

Uniqueness

Uniqueness Score: -1.00%

Function 001C5C43 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,001C5C3A,001C63C6,?,?,?,?,001B3047,?,?,?,?,?,00000000,00000000), ref: 001C5C51
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 001C5C5F
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 001C5C78
SetLastError.KERNEL32(00000000,?,?,001B3047,?,?,?,?,?,00000000,00000000,00000000,?,?,?), ref: 001C5CCA

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 3aa71673adb7d032b040d2d2c5e40db8c4be877354a8831c1e8fa214449a920c
Instruction ID: 422ecc1e8b184cc94222ca118e7c43d03b9cb37b3fb399a95501dbe09495c19e
Opcode Fuzzy Hash: 3aa71673adb7d032b040d2d2c5e40db8c4be877354a8831c1e8fa214449a920c
Instruction Fuzzy Hash: B001B132109F117FA72526F9AC89F662B5BEB717B8724022EF610817E1EF61BC819148

Uniqueness

Uniqueness Score: -1.00%

Function 001BECF0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,958EF2C5,?,?,00000000,001E6860,000000FF,?,001BEDB1,001BEC98,?,001BEE4D,00000000), ref: 001BED25
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 001BED37
FreeLibrary.KERNEL32(00000000,?,?,00000000,001E6860,000000FF,?,001BEDB1,001BEC98,?,001BEE4D,00000000), ref: 001BED59

Strings

mscoree.dll, xrefs: 001BED1E
CorExitProcess, xrefs: 001BED2F

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a72ac501750dfb595d5335472b40edfe7eac95f471f46b16a09f8be4f898a1ce
Instruction ID: 9383449a168c519611195df646ae12cfe185c0fe3620411262c98438c05dfe10
Opcode Fuzzy Hash: a72ac501750dfb595d5335472b40edfe7eac95f471f46b16a09f8be4f898a1ce
Instruction Fuzzy Hash: F0016232940A59FFDB128B91DC09FFEBBF8FB04B11F040625F911A26A0DBB49944CA94

Uniqueness

Uniqueness Score: -1.00%

Function 001B160A Relevance: 7.5, APIs: 5, Instructions: 37COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(001F6CB8), ref: 001B1614
RtlLeaveCriticalSection.NTDLL(001F6CB8), ref: 001B1647
RtlWakeAllConditionVariable.NTDLL ref: 001B16BA
SetEvent.KERNEL32(?,001F7944,?,001D7D3A,?,001A3492,ios_base::clear,00000000,?,?,001D714C,00000000), ref: 001B16C4
ResetEvent.KERNEL32(?,001F7944,?,001D7D3A,?,001A3492,ios_base::clear,00000000,?,?,001D714C,00000000), ref: 001B16D0

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: CriticalEventSection$ConditionEnterLeaveResetVariableWake
String ID:
API String ID: 3916383385-0
Opcode ID: fc8378e80e9228aeb88ec23b332e18f3a706eadce7f212bad3ffa38706c24d31
Instruction ID: 989913fe75227241ae0092ff65f57809d6338495a5356e74e74cb628cb2e1bef
Opcode Fuzzy Hash: fc8378e80e9228aeb88ec23b332e18f3a706eadce7f212bad3ffa38706c24d31
Instruction Fuzzy Hash: EE014F35A05524EFC7059F28FD189B53BB6FB09741749806AFA4693B24CF715C80DBC4

Uniqueness

Uniqueness Score: -1.00%

Function 001CEBF1 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 370COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 001CED6B
__freea.LIBCMT ref: 001CED87

Strings

a/p, xrefs: 001CEE4D
am/pm, xrefs: 001CEDE9

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: __freea
String ID: a/p$am/pm
API String ID: 240046367-3206640213
Opcode ID: 97dcf017e3f0f9e44b1b8950aa3583f77523e0ad25d1989fe9523cbe30d58045
Instruction ID: 674296e6d97487f9cb96d166cca152a86ed4970e74d7adf8cd53ee0692f07666
Opcode Fuzzy Hash: 97dcf017e3f0f9e44b1b8950aa3583f77523e0ad25d1989fe9523cbe30d58045
Instruction Fuzzy Hash: 7EC1CB35900246DADB289FA8C885FBAB7F2FF35700F29415EE902AB291D335ED41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 001C68D9 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 001C68FE
CatchIt.LIBVCRUNTIME ref: 001C69E4

Strings

MOC, xrefs: 001C6910
RCC, xrefs: 001C6918

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: e2adcaa9030b48c964d0930d300e9bcde000bf4a7c55a66033b45297d6625a1b
Instruction ID: 78eedc81060fb893a8b3dbce80a8e39d1d6bdc3858759b6020faff174cdc4bb3
Opcode Fuzzy Hash: e2adcaa9030b48c964d0930d300e9bcde000bf4a7c55a66033b45297d6625a1b
Instruction Fuzzy Hash: 1C412571900209AFCF15DF98CC81EEEBBB5BF58304F148159FA05A7211D335DA50DB50

Uniqueness

Uniqueness Score: -1.00%

Function 001D1E76 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,001D1F12,00000000,?,?,?,?,?,001D1DD0,00000002,FlsGetValue,001EB8C8,001EB8D0), ref: 001D1E83
GetLastError.KERNEL32(?,001D1F12,00000000,?,?,?,?,?,001D1DD0,00000002,FlsGetValue,001EB8C8,001EB8D0,00000000,?,001C5CF6), ref: 001D1E8D
LoadLibraryExW.KERNEL32(?,00000000,00000000,001D77C8,?,001D7101), ref: 001D1EB5

Strings

api-ms-, xrefs: 001D1E9A

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: f0842ac40b2ff8c64e06c1a4d103fedcc4bab42af79bc40d079232d131af0b07
Instruction ID: 4dcc2198616a25f112e0ac3e35be245a7aec44fa54d951ac35f8e2cd1e47252c
Opcode Fuzzy Hash: f0842ac40b2ff8c64e06c1a4d103fedcc4bab42af79bc40d079232d131af0b07
Instruction Fuzzy Hash: 2BE04F31680208FBEB121B61ED06F6A3F56BB10B55F644421FD0DE85E2E7B1E8A0D654

Uniqueness

Uniqueness Score: -1.00%

Function 001A32A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 001A32A8
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 001A32B4

Strings

GetSystemTimePreciseAsFileTime, xrefs: 001A32AE
kernel32.dll, xrefs: 001A32A3

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 1646373207-706389432
Opcode ID: 87c8fc1d08718d815dd4e9725357914d6342bf09ea46071fc50cbe254671cf4b
Instruction ID: 4ca072b06a904bb5cbd705eee0eaef5fed3795108e34563e360c119aa86cdd55
Opcode Fuzzy Hash: 87c8fc1d08718d815dd4e9725357914d6342bf09ea46071fc50cbe254671cf4b
Instruction Fuzzy Hash: 31D01235A44344FFC6116FE6FD09A353B6CB709B653000825FD05C2961E7E294C0CB50

Uniqueness

Uniqueness Score: -1.00%

Function 001CF5A1 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(958EF2C5,00000000,00000000,?), ref: 001CF604

Part of subcall function 001CD8D3: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,001C7452,?,00000000,-00000008), ref: 001CD934

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 001CF856
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 001CF89C
GetLastError.KERNEL32 ref: 001CF93F

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 4347b421cccbe979d127711e0e2be4b1b244afcca2ce7e7e0a221ad7048e478d
Instruction ID: e11de3584eff034b8493fe93e641a4254c005482ba6563df0fb47a95cce0d2f2
Opcode Fuzzy Hash: 4347b421cccbe979d127711e0e2be4b1b244afcca2ce7e7e0a221ad7048e478d
Instruction Fuzzy Hash: 76D15975D04258AFCF15CFA8D880AADBBB6FF29314F24412EE556EB251D730E942CB50

Uniqueness

Uniqueness Score: -1.00%

Function 001C61DB Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 001C62A2
___AdjustPointer.LIBCMT ref: 001C62C5
___AdjustPointer.LIBCMT ref: 001C6361

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: c32aef8bf78030cf1a4ddb8e3601976811aeaee5b085020adad4f186be138d29
Instruction ID: 84a8f20db9bfa78cb2216b53eded632b0ee2086fd8fd23aa2e71ebbd1774438a
Opcode Fuzzy Hash: c32aef8bf78030cf1a4ddb8e3601976811aeaee5b085020adad4f186be138d29
Instruction Fuzzy Hash: 2851DE72601642EFEB298F54D981FBAB7B4FF24710F14452DE94A4B2A1D731ED81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001C220E Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16fc2affa276ee569fce9bba0798cb705177e2eaf7186154a9978ceb4b23792c
Instruction ID: fa505d774a7b232f6db672ed7f88cf150154a1510075dea7b58661d81d66bf93
Opcode Fuzzy Hash: 16fc2affa276ee569fce9bba0798cb705177e2eaf7186154a9978ceb4b23792c
Instruction Fuzzy Hash: 36216D31200206AFEB20AFA5DC80F6B77A9AF71364721852DF919D7152EB30EC51C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 001D5708 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,001D5181,00000000,00000001,?,?,?,001CF993,?,00000000,00000000), ref: 001D571F
GetLastError.KERNEL32(?,001D5181,00000000,00000001,?,?,?,001CF993,?,00000000,00000000,?,?,?,001CF2D9,?), ref: 001D572B

Part of subcall function 001D577C: CloseHandle.KERNEL32(FFFFFFFE,001D573B,?,001D5181,00000000,00000001,?,?,?,001CF993,?,00000000,00000000,?,?), ref: 001D578C

___initconout.LIBCMT ref: 001D573B

Part of subcall function 001D575D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,001D56F9,001D516E,?,?,001CF993,?,00000000,00000000,?), ref: 001D5770

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,001D5181,00000000,00000001,?,?,?,001CF993,?,00000000,00000000,?), ref: 001D5750

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 76e8795a1f492680924c87e2702ceba015247b04793827d2e8b18ce5381b8ee9
Instruction ID: eb874b72f4a534e32d6dcb4427e4610035933df9606293ea1972f61ee5eb5fc1
Opcode Fuzzy Hash: 76e8795a1f492680924c87e2702ceba015247b04793827d2e8b18ce5381b8ee9
Instruction Fuzzy Hash: 9FF03036000554FBCF221F95EC049EA3F67FB493A1BA04011FE0996630C7329870EB90

Uniqueness

Uniqueness Score: -1.00%

Function 001B1654 Relevance: 6.0, APIs: 4, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,001B15B9,00000064), ref: 001B1677
RtlLeaveCriticalSection.NTDLL(001F6CB8), ref: 001B1681
WaitForSingleObjectEx.KERNEL32(?,00000000,?,001B15B9,00000064,?,001D7CB1,001F7944,?,001D7D3A,?,001A3492,ios_base::clear,00000000), ref: 001B1692
RtlEnterCriticalSection.NTDLL(001F6CB8), ref: 001B1699

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: ec44ab0be2dee9a59b703441fb91ba3893dbc4edced17bb16ea024d74fa2d8b1
Instruction ID: b5a0bf47201e1016398feccea8f965fa1be85184d1201fcf7fe0fd4b9f15b31b
Opcode Fuzzy Hash: ec44ab0be2dee9a59b703441fb91ba3893dbc4edced17bb16ea024d74fa2d8b1
Instruction Fuzzy Hash: F5E04836641138F7C7021F90ED199FD7F3AFB09791B4E4015FE8566560CBA15850DBD4

Uniqueness

Uniqueness Score: -1.00%

Function 001CB9A3 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

Part of subcall function 001C74DC: GetLastError.KERNEL32(00000000,?,001C9356), ref: 001C74E0
Part of subcall function 001C74DC: SetLastError.KERNEL32(00000000,?,?,00000028,001C38EC), ref: 001C7582

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,001BF702,?,?,?,00000055,?,-00000050,?,?,?), ref: 001CBA62
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,001BF702,?,?,?,00000055,?,-00000050,?,?), ref: 001CBA99

Strings

utf8, xrefs: 001CBB6B

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 84e6f6bf3274e4f815aacbf378fc94fb0b0069266f6c0222c10467244c444e8b
Instruction ID: f85d8d49a1ad9aa8ae2da8c23e6aaeeeb9f039731a296a10544e71198b3c59de
Opcode Fuzzy Hash: 84e6f6bf3274e4f815aacbf378fc94fb0b0069266f6c0222c10467244c444e8b
Instruction Fuzzy Hash: 0E51A371A08345AAEB35AB758CC7FBA73A8AF74700F15042DF945D7181EB70ED40C665

Uniqueness

Uniqueness Score: -1.00%

Function 001B3270 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 001B32AF
__IsNonwritableInCurrentImage.LIBCMT ref: 001B3363

Strings

csm, xrefs: 001B334D

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 969a5a68a70a6a460dbfd07a0e89b9588740b3260aba7f2460405b71d4c5fa3b
Instruction ID: c72b95e8eadf8e41810f57f80aea57b0f2890c8fcf8d31fd3ccb48a27af96e99
Opcode Fuzzy Hash: 969a5a68a70a6a460dbfd07a0e89b9588740b3260aba7f2460405b71d4c5fa3b
Instruction Fuzzy Hash: EB41A534A00209ABCF10DF69C884AEEBBF5BF55314F148159E9255B3A2DB31DB25CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001C6144 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 001C63BB

Strings

csm, xrefs: 001C644E
csm, xrefs: 001C63DD

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: f95d1cd23805bc0203970e79ceffbe017ec84b684d7b96e960862d94792a10e7
Instruction ID: f0d370fb15a057c8406df75875753ffe5013f7af4b3457b34d207acb799bb8b8
Opcode Fuzzy Hash: f95d1cd23805bc0203970e79ceffbe017ec84b684d7b96e960862d94792a10e7
Instruction Fuzzy Hash: FF316236500258EBCF2A9F50CC45EBE7B6AFF28715B15855DFC5449112C333D8A1DB91

Uniqueness

Uniqueness Score: -1.00%

Function 001D7560 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 001D7580

Strings

..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap, xrefs: 001D75E3
out_of_range was thrown in -fno-exceptions mode with message "%s", xrefs: 001D7566

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: _strlen
String ID: ..\..\third_party\libc++\src\include\__string\char_traits.h:245: assertion !std::__is_pointer_in_range(__s1, __s1 + __n, __s2) failed: char_traits::copy: source and destination ranges overlap$out_of_range was thrown in -fno-exceptions mode with message "%s"
API String ID: 4218353326-7849678
Opcode ID: 2e6fdfb016124d735161d74f07e44f6fd43341ae49ceb05b72655eb0982bd28b
Instruction ID: 1c781414f729cf1f3509162b543fb63c4a31524906dda1cddbe849b494311e3c
Opcode Fuzzy Hash: 2e6fdfb016124d735161d74f07e44f6fd43341ae49ceb05b72655eb0982bd28b
Instruction Fuzzy Hash: 750148B27046466BD7202A66AC52A2F7789DB61708B14843FF501C7381FBA1DC0183B2

Uniqueness

Uniqueness Score: -1.00%

Function 001B1E79 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 001B1F6D
___raise_securityfailure.LIBCMT ref: 001B2055

Strings

:qj, xrefs: 001B2046

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: :qj
API String ID: 3761405300-759796859
Opcode ID: c77ef754bf9941f3818112c0cee6cd5360729e923e1383c821e9eaeb6825d578
Instruction ID: 0ac6be1f0dd027d0f61d8093ad3d16aa8c283211426090ca4df348daf1a3623a
Opcode Fuzzy Hash: c77ef754bf9941f3818112c0cee6cd5360729e923e1383c821e9eaeb6825d578
Instruction Fuzzy Hash: 0521F3BA600204EBD714DF54FD55AA13BF5BB08310F60802AE9498BBA2E3F199C5CF85

Uniqueness

Uniqueness Score: -1.00%

Function 001B2642 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 001B2653
GetSystemInfo.KERNEL32(?), ref: 001B266E

Strings

D, xrefs: 001B2662

Memory Dump Source

Source File: 0000001F.00000001.2097354505.00000000001A1000.00000040.00000001.01000000.0000001A.sdmp, Offset: 001A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_1_1a1000_UPwYHcUA3TbsX6l2qc9SZcBH.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 0c3adf341c984531f51db495016064f8b944385bcac9c697c34d91a4d56eebb8
Instruction ID: 52d35df537915e3d437ce4dabe3936f93a6561d10d6c2602bfc93397b5a5b55e
Opcode Fuzzy Hash: 0c3adf341c984531f51db495016064f8b944385bcac9c697c34d91a4d56eebb8
Instruction Fuzzy Hash: 7501DB77600109ABDB14DE6ADC05BED7BA9AFC4324F0CC224ED59D7254DB74DD46C680

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3SqWYf8qFi.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AIXACVYBSB.docx

C:\ProgramData\BAEBFIIE

C:\ProgramData\BPMLNOBVSB.docx

C:\ProgramData\BPMLNOBVSB.xlsx

C:\ProgramData\BXAJUJAOEO.xlsx

C:\ProgramData\DTBZGIOOSO.docx

C:\ProgramData\DTBZGIOOSO.xlsx

Windows Analysis Report
3SqWYf8qFi.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre